Goultarde/CVE-2025-6018_CVE-2025-6019_autopwn

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that automates a local privilege escalation chain (CVE-2025-6018 and CVE-2025-6019) by connecting to a target via SSH, injecting a malicious PAM environment, and exploiting a UDisks2 vulnerability to mount a SUID-root shell image, ultimately providing an interactive root shell.

Backdoor review

No backdoor observed in reviewed code

The provided PoC automates a local privilege escalation chain (CVE-2025-6018 and CVE-2025-6019) against a target host via SSH. All actions are consistent with the disclosed exploit: creating a malicious XFS image with a SUID bash, injecting PAM environment variables, and executing a local script on the target to gain root. No concealed or materially misrepresented behavior harming the operator or an unrelated system was found.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesPython
Target softwareLinux PAMlibblockdevudisks2systemd-logindpolkit
Attack typesLocal Privilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Python script that actively exploits CVE-2025-6018 and CVE-2025-6019 to escalate privileges to root. It performs the full attack chain: creating a malicious SUID binary, injecting PAM environment variables, and triggering a UDisks2 vulnerability to mount the image and spawn a root shell. The README explicitly describes it as a 'full exploit chain' and 'Auto-Pwn'.

CVE-2025-6018_CVE-2025-6019_autopwn.py:70-142README.md:3-8

Requirements

  • Valid SSH credentials (username and password) for the target system.CVE-2025-6018_CVE-2025-6019_autopwn.py:87
  • Local sudo access on the attacker machine to create the XFS image.CVE-2025-6018_CVE-2025-6019_autopwn.py:92-98
  • The target system must be vulnerable to CVE-2025-6018 (PAM environment injection) and CVE-2025-6019 (UDisks2 privilege escalation).README.md:3-6

Observed behavior

  • Connects to the target system over SSH using provided credentials.CVE-2025-6018_CVE-2025-6019_autopwn.py:85-87
  • Downloads /bin/bash from the target to create a local SUID-root binary.CVE-2025-6018_CVE-2025-6019_autopwn.py:90
  • Creates a local XFS filesystem image containing the SUID-root bash binary.CVE-2025-6018_CVE-2025-6019_autopwn.py:92-98
  • Uploads the malicious XFS image and an exploit script to the target via SFTP.CVE-2025-6018_CVE-2025-6019_autopwn.py:102-103
  • Injects PAM environment variables (XDG_SEAT, XDG_VTNR) into ~/.pam_environment on the target to gain allow_active status.CVE-2025-6018_CVE-2025-6019_autopwn.py:106-107
  • Reconnects to the target to trigger the PAM injection, then executes the uploaded exploit script to mount the malicious image and obtain an interactive root shell.CVE-2025-6018_CVE-2025-6019_autopwn.py:118-140
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Execution
ssh.exec_command('echo "XDG_SEAT OVERRIDE=seat0" > ~/.pam_environment')This command is executed on the remote target to inject the PAM environment, which is the core of the CVE-2025-6018 exploit.CVE-2025-6018_CVE-2025-6019_autopwn.py:106
Command Execution
channel.send(f"/tmp/exploit.sh stage3 /tmp/{image_name}\n")This executes the local 'exploit.sh' script on the target, which is the CVE-2025-6019 exploit to mount the malicious image and gain root.CVE-2025-6018_CVE-2025-6019_autopwn.py:129
File Upload
sftp.put(image_name, f"/tmp/{image_name}")The locally crafted XFS image containing the SUID bash is uploaded to the target, a necessary step for the CVE-2025-6019 exploit.CVE-2025-6018_CVE-2025-6019_autopwn.py:102
File Upload
sftp.put(exploit_sh_local, "/tmp/exploit.sh")The local 'exploit.sh' script is uploaded to the target. Its content is not provided in the evidence, but its execution is part of the disclosed exploit chain.CVE-2025-6018_CVE-2025-6019_autopwn.py:103
Credential Usage
ssh.connect(ip, username=user, password=password)The operator-supplied credentials are used to connect to the target host. No hardcoded or exfiltrated credentials are present.CVE-2025-6018_CVE-2025-6019_autopwn.py:87
Review boundaries

What the analysis did not establish

  • The exploit script (exploit.sh) referenced in the Python code is not included in the provided evidence, so the exact UDisks2 exploitation steps cannot be fully analyzed.
  • The evidence does not include the two omitted files from the repository, which may contain additional exploit logic or documentation.
  • The content of the 'exploit.sh' script is not included in the evidence, so its exact behavior on the target cannot be verified. However, its execution is consistent with the disclosed exploit and no evidence suggests it performs actions beyond the stated LPE.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2