# CTT-Vsyslog-Vortex

**Temporal Resonance Exploit for CVE-2023-6246 (glibc __vsyslog_internal() heap overflow)**

Copyright © 2026 Americo Simoes. All Rights Reserved.

---

## Overview

CVE-2023-6246 is a heap-based buffer overflow in glibc's `__vsyslog_internal()` function (called by `syslog()` and `vsyslog()`). The vulnerability was introduced in glibc 2.37 and backported to 2.36, affecting:

- Debian 12 & 13
- Ubuntu 23.04 & 23.10
- Fedora 37–39

Standard exploitation is unreliable due to heap layout randomization. **CTT-Vsyslog-Vortex** applies Convergent Time Theory (CTT) to:

- Predict heap layout across 33 temporal layers
- Align allocations using α = 0.0302011 decay
- Phase-lock the trigger to the optimal moment

**Result:** Reliable local privilege escalation to root.

---

## CTT Physics Applied

| CTT Concept | Exploit Application |
|-------------|----------------------|
| α = 0.0302011 | Timing of heap spray allocations |
| 33 layers | Batch allocations across layers for predictable layout |
| Temporal wedge | Only allocations that "survive" contribute to coherent heap |
| Phase lock | Trigger vsyslog at optimal phase for overflow landing |
| Energy decay E(d) = E₀e^{-αd} | Heap spray intensity decays across layers |

---

## How It Works

### 1. Temporal Heap Spray

Instead of brute-force spraying, allocations are batched across 33 layers with delays calculated by α decay:

### 2. Phase-Locked Trigger

The exploit waits for the optimal temporal phase (zero crossing of α-harmonic) before triggering `__vsyslog_internal()`.

### 3. Overflow Landing

The heap overflow lands on a predictable address because the temporal structure of allocations is coherent.

---

## Usage

```bash
# On vulnerable system (Debian 12, Ubuntu 23.04, Fedora 37-39)
git clone https://github.com/SimoesCTT/CTT-Vsyslog-Vortex
cd CTT-Vsyslog-Vortex
python3 ctt_vsyslog_exploit.py

// glibc-2.37/misc/syslog.c
void __vsyslog_internal(int pri, const char *fmt, va_list ap, int mode) {
    // Heap buffer allocation based on message length
    char *buf = malloc(len);
    // No bounds check on vsnprintf output
    vsnprintf(buf, len, fmt, ap);
    // Buffer overflow if fmt expands beyond len
}

1. Spray heap with 10,000 objects across 33 layers (α-timed)
2. Wait for phase lock (zero crossing of 60 Hz * α)
3. Send crafted syslog message with overflow payload
4. Overflow lands on predictable address
5. Shellcode executes → root shell

# Debian/Ubuntu
sudo apt update && sudo apt upgrade libc6

# Fedora
sudo dnf update glibc

# Run at your own risk. Authorized testing only.
python3 ctt_vsyslog_exploit.py