Realtek rtl819x - Local Privilege
PoC files
1 fileFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
A local privilege escalation exploit for the Realtek rtl819x Wi-Fi driver. It uses unrestricted ioctl handlers (0x89F5/0x89F6) to gain arbitrary kernel read/write, locates the current task_struct, and overwrites its credentials to gain root.
Backdoor review
No backdoor observed in reviewed code
The supplied C source code is a local privilege escalation exploit for CVE-2026-36355. It uses ioctl 0x89F5/0x89F6 to read and write kernel memory, locates the current task_struct, and overwrites credential fields to gain root. All behavior is consistent with the stated exploit purpose; no concealed payload, persistence mechanism, credential exfiltration, or unrelated remote access is present.
Classification basis and observed behavior
Classification basis
The code actively exploits a vulnerability to escalate privileges. It uses kernel read/write primitives to locate and modify the current process's credentials, then spawns a root shell. This is a full exploit, not just a scanner or writeup.
exploits/linux/local/52580.c:10exploits/linux/local/52580.c:405-419Requirements
- Unprivileged local user access on a system with a vulnerable Realtek rtl819x Wi-Fi driver loaded.
exploits/linux/local/52580.c:15 - A network interface using the vulnerable driver must be present.
exploits/linux/local/52580.c:99-118
Observed behavior
- Opens a UDP socket and uses it to send ioctl commands to a network interface.
exploits/linux/local/52580.c:340exploits/linux/local/52580.c:61 - Scans kernel memory for the init_task structure by searching for the string "swapper".
exploits/linux/local/52580.c:139-177 - Auto-detects task_struct field offsets (tasks, pid, cred, comm) from the init_task memory dump.
exploits/linux/local/52580.c:188-277 - Walks the kernel task list to find the task_struct of the current process.
exploits/linux/local/52580.c:281-325 - Overwrites the process's kernel credentials (UID, GID, capabilities) to gain root privileges.
exploits/linux/local/52580.c:407-408 - Executes /bin/sh to provide an interactive root shell.
exploits/linux/local/52580.c:419
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Uses ioctl 0x89F5 (write_mem) and 0x89F6 (read_mem) on a wireless interface to read and write kernel memory.This is the documented vulnerability mechanism for CVE-2026-36355.
exploits/linux/local/52580.c:35-36exploits/linux/local/52580.c:48-95 - Exploit Behavior
- Scans kernel memory for init_task, auto-detects task_struct offsets, and locates the current process's task_struct.Standard kernel exploitation technique to find and modify the target process's credentials.
exploits/linux/local/52580.c:122-277exploits/linux/local/52580.c:281-325 - Exploit Behavior
- Overwrites credential fields (uid, gid, capabilities) to zero and 0xFFFFFFFF to escalate to root.This is the privilege escalation payload, directly matching the exploit's stated goal.
exploits/linux/local/52580.c:405-408 - Exploit Behavior
- Executes /bin/sh after successful privilege escalation.Standard post-exploitation action to provide an interactive root shell.
exploits/linux/local/52580.c:419
What the analysis did not establish
- Only the supplied C source file was reviewed; no binary or runtime analysis was performed.
- The exploit's behavior depends on the vulnerable kernel driver; the review does not assess whether the exploit is functional or safe to execute.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.