AzureADTrent/CVE-2025-6018-and-CVE-2025-6019-Privilege-Escalation

GitHubRepository PoCWriteup

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A README file providing a brief, high-level narrative on chaining CVE-2025-6018 and CVE-2025-6019 to achieve root privileges. It references external tools and scripts but contains no exploit or scanner code itself.

Backdoor review

Backdoor review undetermined

The artifact is a README.md file providing instructions to exploit CVE-2025-6018 and CVE-2025-6019. It directs the operator to download and execute two external scripts from different GitHub repositories. The behavior of these external scripts is not included in the reviewed evidence, making it impossible to determine if they contain backdoor or deceptive payloads.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
LanguagesMarkdown
Target softwarepam-configlibblockdevudisks
Attack typesLocal Privilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file containing only a textual description of an attack chain. It does not include any executable code, scripts, or scanner logic. It references external repositories for the actual exploit tools, making it a technical writeup rather than an exploit or scanner.

README.md:1-20

Requirements

  • An unprivileged local user session (e.g., via SSH) to exploit CVE-2025-6018.README.md:7
  • Access to an external tool from ibrahmsql/CVE-2025-6018 to obtain an initial shell.README.md:4-5
  • Ability to run a script locally as sudo to generate a malicious XFS image.README.md:9-10
  • Ability to transfer files (the script and XFS image) to the victim machine.README.md:12

Observed behavior

  • The artifact describes a multi-step attack: first, use an external tool to gain a shell as an unprivileged user via CVE-2025-6018.README.md:4-7
  • Second, generate a malicious XFS image containing a SUID-root shell using an external script for CVE-2025-6019.README.md:9-10
  • Third, transfer the script and image to the victim, set the PATH, and run the script to trigger the libblockdev/udisks vulnerability, resulting in root access.README.md:12-19
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
https://raw.githubusercontent.com/ibrahmsql/CVE-2025-6018/refs/heads/main/CVE-202External script referenced for CVE-2025-6018 exploitation. The URL appears truncated in the evidence.README.md:5
Url
https://raw.githubusercontent.com/guinea-offensive-security/CVE-2025-6019/External script referenced for CVE-2025-6019 exploitation.README.md:10
Review boundaries

What the analysis did not establish

  • The artifact is a single README file with no executable code; the actual exploit and scanner code are hosted in external repositories not included in this evidence.
  • The analysis is based solely on the supplied text; the referenced external tools were not inspected or verified.
  • The evidence consists solely of a README.md file with instructions. The actual exploit scripts referenced via external URLs are not included in the reviewed material.
  • The URL for the CVE-2025-6018 script appears to be truncated in the provided text, preventing full identification of the resource.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2