Exploitation Summary
EIP tracks 2 public exploits for CVE-2024-28085. PoCs published by skyler-ferrante, oditynet.
AI-analyzed exploit summary This PoC exploits CVE-2024-28085, a vulnerability in the util-linux `wall` command that fails to filter escape sequences, allowing unprivileged users to inject arbitrary text into other users' terminals. The exploit leverages this to create a fake sudo prompt and harvest passwords via process monitoring.
Description
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.
Exploits (2)
This PoC exploits CVE-2024-28085, a vulnerability in the util-linux `wall` command that fails to filter escape sequences, allowing unprivileged users to inject arbitrary text into other users' terminals. The exploit leverages this to create a fake sudo prompt and harvest passwords via process monitoring.
The repository claims to be a PoC for CVE-2024-2805 but is actually a trojan that steals sudo passwords by manipulating terminal escape sequences and exfiltrating credentials to a remote server. It disguises itself as a legitimate exploit but functions as malware.
References (18)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N