GitHub Exploit Metadata - Exploit Intel

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-12

Technical assessment

A Python script that exploits CVE-2022-29799 (directory traversal) and CVE-2022-29800 (TOCTOU race condition) in networkd-dispatcher to achieve local privilege escalation by replacing root-owned executables with a payload that creates a setuid root shell.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script (exploit.py) targeting CVE-2022-29799 and CVE-2022-29800 in networkd-dispatcher. The script performs a local privilege escalation by exploiting a directory traversal and a TOCTOU race condition to write a payload that copies /bin/sh to /tmp/sh and sets the setuid bit. All behavior is consistent with the stated exploit goals; no concealed backdoor, unrelated payload, or operator-directed harm beyond the documented PoC is observed.

ClassificationExploit

Model confidence98%

AuthenticationRequired

Languagespython

Target softwarenetworkd-dispatcher

Attack typeslocal_privilege_escalationrace_conditiondirectory_traversal

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerabilities by sending malicious D-Bus signals and performing symlink swaps to execute attacker-controlled code with elevated privileges, resulting in a root shell. This is exploitation, not mere detection or scanning.

exploit.py:48-95

Requirements

Local low-privileged user access to a system running vulnerable networkd-dispatcher.exploit.py:1-95
Ability to send D-Bus signals on the system bus (requires local access).exploit.py:60-69

Observed behavior

Registers a fake D-Bus service 'org.freedesktop.network1' to impersonate systemd-networkd.exploit.py:20-24
Creates a temporary directory with a symlink 'poc.d' pointing to '/sbin'.exploit.py:26-29
Sends a crafted D-Bus PropertiesChanged signal with a directory traversal path in OperationalState to trigger networkd-dispatcher to read scripts from the attacker-controlled directory.exploit.py:60-69
Exploits a TOCTOU race condition by replacing the symlink after networkd-dispatcher discovers scripts but before it executes them, causing it to execute attacker-written payloads instead of legitimate root-owned binaries.exploit.py:72-80
Payload creates a setuid root shell at /tmp/sh.exploit.py:12-16
Checks for successful exploitation by verifying existence of /tmp/sh and spawns a root shell.exploit.py:82-85

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload: cp /bin/sh /tmp/sh; chmod 4777 /tmp/shThe payload written by the exploit creates a setuid root shell at /tmp/sh, which is the expected outcome of a local privilege escalation PoC for the targeted CVEs.exploit.py:12-16
Exploit Mechanism: TOCTOU symlink swap between /sbin and attacker-controlled directoryThe script creates a symlink to /sbin, sends a crafted D-Bus signal to trigger networkd-dispatcher to read scripts from the symlink path, then swaps the symlink to point to the attacker's directory containing the payload. This matches the described CVE-2022-29800 race condition.exploit.py:26-46exploit.py:58-77
Exploit Mechanism: D-Bus signal with directory traversal in OperationalStateThe script sends a PropertiesChanged signal with an OperationalState containing a path traversal (../../..) to escape the base directory, matching CVE-2022-29799.exploit.py:60-69

Review boundaries

What the analysis did not establish

Evidence is limited to static source code analysis; no runtime behavior or environment was observed.
The exploit targets a specific Linux component (networkd-dispatcher) and may not function on all distributions or versions.
The race condition exploit may require multiple attempts and is not guaranteed to succeed on every run.
Only the two text files (README.md and exploit.py) were reviewed; no binary or other files were present in the evidence.
The review does not assess whether the exploit actually works or is safe to execute.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

ngtuonghung/nimbuspwn-CVE-2022-29800-CVE-2022-29799