Privesc-need-restart-2024-48990

Exploit Explanation (CVE-2024-48990 - Pure Python)

This script exploits the CVE-2024-48990 vulnerability in the needrestart Linux utility through library path hijacking (PYTHONPATH hijacking). Unlike the original vector, this method uses exclusively Python, bypassing the need for compilers like gcc to be installed on the victim machine.

Step-by-Step Operation

1. Directory Structure: The /tmp/malicious/importlib/ directory is created. This mimics the structure of the Python standard library.
2. Malicious Payload (importlib/__init__.py): Contains the code that will be executed with elevated privileges. When loaded, it checks if the current user is root (UID 0). If so, it copies the /bin/bash binary to /tmp/poc and sets the SUID bit (chmod 4755). This creates a backdoor that allows any user to escalate privileges.
3. Decoy Process (e.py): It is a harmless script that stays running in an infinite loop. It serves two purposes:

• Keep a Python interpreter running on the system so that needrestart intercepts it.
• Constantly monitor the /tmp directory. As soon as it detects that the /tmp/poc file has been created, it automatically executes it with the -p flag (to keep root privileges), delivering the interactive shell.

4. Environment Variable Hijacking: When running the decoy with PYTHONPATH="$PWD" python3 e.py, we alter Python's behavior. We force any import to first look in /tmp/malicious before checking legitimate system paths.
5. Trigger and Escalation (needrestart): When needrestart runs with administrator privileges (either manually or by a scheduled system task), it scans active processes. Upon reaching our e.py, it extracts its environment variables and starts its own Python process to analyze them. By inheriting the malicious PYTHONPATH, the root process of needrestart imports our fake importlib library and executes the payload, granting full control over the machine.