AzureADTrent/CVE-2025-4517-POC

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that creates a malicious tar archive exploiting CVE-2025-4517 to write arbitrary content to /etc/sudoers, and a README describing its usage for privilege escalation.

Backdoor review

No backdoor observed in reviewed code

The PoC is a Python script that exploits CVE-2025-4517 to escalate privileges by writing to /etc/sudoers. It constructs a malicious tar archive using symlinks and hardlinks, deploys it, and triggers extraction via a vulnerable script. All behavior is consistent with the stated exploit goal; no concealed backdoor, unrelated payload, or deceptive operator-directed harm is present.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesPython
Target softwarePython tarfile moduleCPython
Attack typesprivilege escalationpath traversalarbitrary file write
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script (CVE-2025-4517-POC.py) that programmatically constructs a malicious tar archive and executes it to gain root privileges by modifying /etc/sudoers. This is code intended to exercise a vulnerability, meeting the definition of an exploit.

CVE-2025-4517-POC.py:1-203README.md:1-4

Requirements

  • User access with sudo permissions for a vulnerable script that extracts tar archives using tarfile with filter='data'README.md:65-66
  • Write access to the directory where the malicious tar archive is deployedREADME.md:66
  • Python 3.8.0 through 3.13.1 installed on the target systemCVE-2025-4517-POC.py:6

Observed behavior

  • Creates a tar archive containing a deep nested directory structure, symlink chains, and a hardlink designed to bypass the tarfile data filter and write to /etc/sudoersCVE-2025-4517-POC.py:23-86
  • Copies the malicious tar archive to a target backup directory and executes a vulnerable restore script via sudo to trigger extractionCVE-2025-4517-POC.py:88-128
  • Verifies the exploit by checking if the current user's entry with NOPASSWD: ALL was added to /etc/sudoersCVE-2025-4517-POC.py:130-153
  • Offers to spawn a root shell using sudo /bin/bash after successful exploitationCVE-2025-4517-POC.py:155-161
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Script creates a tar archive with symlink and hardlink chains to write to /etc/sudoers, then deploys and triggers extraction via a vulnerable script.This is the normal, documented exploit behavior for CVE-2025-4517 and does not constitute a backdoor.CVE-2025-4517-POC.py:23-86CVE-2025-4517-POC.py:88-128
Privilege Escalation
Script adds the current user to /etc/sudoers with NOPASSWD: ALL and offers to spawn a root shell.This is the intended outcome of the privilege escalation exploit, not a hidden backdoor.CVE-2025-4517-POC.py:36CVE-2025-4517-POC.py:155-161
Review boundaries

What the analysis did not establish

  • One file (LICENSE) was omitted from the packet; its content is not available for analysis.
  • The evidence includes a README that states the exploit was tested and confirmed working, but the analysis does not verify this claim.
  • One file (LICENSE) was omitted from the text evidence; its content is not reviewed.
  • Binary content was not analyzed; the artifact contains no identified binary files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1