Fedora - Local Privilege Escalation

ExploitDBExploitDB exploitExploitEDB-52515

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2025-12744, a command injection in Fedora's ABRT daemon, to escalate privileges to root by injecting shell metacharacters via mountinfo and writing a sudoers entry.

Backdoor review

No backdoor observed in reviewed code

The PoC is a local privilege escalation exploit for CVE-2025-12744 in Fedora's ABRT. It crafts payloads to inject shell commands via the ABRT socket, writes a helper script to the current directory, and uses the vulnerability to append the current user to /etc/sudoers. All actions are consistent with the stated exploit goal and no concealed, deceptive, or unrelated harmful behavior is observed.

ClassificationExploit
Model confidence98%
AuthenticationRequired
Languagespython
Target softwareABRTFedora
Attack typescommand injectionprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits CVE-2025-12744 by injecting shell commands via the mountinfo field to write and execute a payload that modifies /etc/sudoers, granting root privileges. It is not merely detecting or reporting the vulnerability.

exploits/linux/local/52515.py:1-8exploits/linux/local/52515.py:39-74exploits/linux/local/52515.py:96-145

Requirements

  • Local unprivileged user access on a vulnerable Fedora system running ABRT <= 2.17.7exploits/linux/local/52515.py:1-8
  • ABRT daemon socket accessible at /var/run/abrt/abrt.socketexploits/linux/local/52515.py:28

Observed behavior

  • Sends crafted HTTP POST requests to the ABRT Unix socket with a mountinfo field containing a 12-character shell injection payloadexploits/linux/local/52515.py:39-74
  • Writes a helper script to the current directory that uses systemd-run to append the current user to /etc/sudoers with NOPASSWD: ALLexploits/linux/local/52515.py:99-109
  • Uses a reset token to clear a file, then iteratively appends characters to build a second-stage script on the target, and finally executes it to chain to the sudoers-modifying scriptexploits/linux/local/52515.py:31-33exploits/linux/local/52515.py:120-139
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Write
helper_script_path.write_text(...) writes a script that appends the current user to /etc/sudoersThis is the final payload of the exploit, achieving privilege escalation as described.exploits/linux/local/52515.py:105-108
Socket Communication
Sends crafted HTTP-like POST requests to /var/run/abrt/abrt.socketThis is the attack vector for the CVE-2025-12744 command injection vulnerability.exploits/linux/local/52515.py:62-74
Command Injection
Payloads include shell metacharacters (e.g., ';sh\tq;:;:;:;') to execute commands via the vulnerable ABRT daemonThis is the core exploitation technique for the described CVE.exploits/linux/local/52515.py:32exploits/linux/local/52515.py:89-93
Review boundaries

What the analysis did not establish

  • Only the exploit script content was analyzed; no external dependencies, libraries, or target environment were inspected.
  • The script's effectiveness, reliability, or safety was not tested or verified.
  • Only the single Python script was reviewed; no external dependencies or referenced resources were inspected.
  • The review does not assess whether the exploit is functional or safe to execute.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1