initstring
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHubinitstring/abrt_root
Repository PoCStars: 7Created 2025-10-18ExploitCVE-2025-127443 files
Analysis
Technical assessment
A Python script that exploits CVE-2025-12744, a command injection in the ABRT daemon, to add the current low-privilege user to /etc/sudoers, granting root access.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python exploit script (abrt_root.py) for CVE-2025-12744. The script performs the documented local privilege escalation by injecting commands into the ABRT daemon to add the current user to /etc/sudoers. No concealed, deceptive, or unrelated harmful behavior was observed. The script's actions are consistent with the stated exploit goal.
Classification basis and observed behavior
Classification basis
The artifact is a complete Python script that actively exploits a command injection vulnerability to escalate privileges by modifying /etc/sudoers. It sends malicious payloads to the ABRT daemon and executes a multi-stage attack chain.
README.md:3abrt_root.py:1-138Requirements
- Local unprivileged user access on a vulnerable Fedora system with ABRT daemon running.
README.md:3-5 - Write access to a directory without special characters (e.g., home directory) to stage a helper script.
README.md:17
Observed behavior
- Writes a helper script (final) to the current working directory that uses systemd-run to append a sudoers entry for the current user.
abrt_root.py:96-102 - Sends crafted HTTP POST requests over a Unix socket to the ABRT daemon, injecting shell metacharacters into the mountinfo field.
abrt_root.py:44abrt_root.py:55-67 - Uses a multi-stage injection: first clears a file, then writes a second-stage script character by character, and finally executes it to chain to the third-stage helper script.
abrt_root.py:113-132
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the final payload of the exploit, matching the documented purpose of gaining root privileges.
abrt_root.py:98-101 - Exploit Behavior
- Payload withheldThis is the core exploitation technique described in the CVE and README.
abrt_root.py:55-67 - Exploit Behavior
- Payload withheldThis is part of the multi-stage exploit chain described in the script comments.
abrt_root.py:122-126
What the analysis did not establish
- One file (total 3) was omitted from the packet; its content is not available for analysis.
- The evidence does not include the ABRT daemon source code or the vulnerable function, only the exploit script and README.
- One file (metadata only, flagged as non-text) was not inspected; its content is unknown but classified as non-text media.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.