PEdit-CoW

This repository contains a standalone local privilege escalation exploit for CVE-2026-46331 in Linux net/sched act_pedit, plus a reusable primitive and a verification harness. The codebase is small and focused: packet_edit_meme.c is the main exploit, pedit_primitive.c/.h implement the page-cache overwrite primitive, test_cve.c validates the primitive against a temporary file, and the Makefile builds static binaries. CI workflow files build and release precompiled binaries for multiple Linux distributions. Core capability: the primitive abuses tc pedit on loopback egress so that one pedit key inflates the IPv4 header length and subsequent TCP-header pedit keys write beyond the intended copy-on-write range into a page-cache page populated via sendfile. The exported API api_fd_write(fd, offset, src, size) allows overwriting page-cache contents of an O_RDONLY file descriptor in 4-byte slots, up to 36 bytes per call. Main exploit flow in packet_edit_meme.c: it must be run as a non-root user. It discovers a usable setuid-root ELF binary by scanning the filesystem with find for root-owned mode-4000 regular files and selecting the first world-readable ELF. It then uses the primitive to overwrite cached ELF metadata and inject x86_64 syscall shellcode that calls setgid(0), setuid(0), and execve("/bin/sh"). The parent process remains in the initial user namespace and execs the corrupted setuid binary, yielding an interactive root shell. The README notes special handling for Alpine PIE binaries by modifying ELF program-header flags and splitting shellcode/trampoline placement across safe offsets. The exploit also includes an Ubuntu-specific path: when invoked with --ubuntu, it attempts to bypass AppArmor restrictions on unprivileged user namespaces by re-executing itself through aa-exec under one of several permissive profiles (trinity, chrome, flatpak). This is not remote exploitation; it is a local kernel LPE that combines namespace-derived CAP_NET_ADMIN with tc/netlink configuration and loopback TCP traffic. The test harness test_cve.c is not the exploit itself but demonstrates the primitive reliably by creating /tmp/cve_target, reopening it read-only, issuing 10 overwrite attempts at different offsets and sizes, and verifying that the modified bytes are visible through the read-only descriptor. Overall, the repository is a real, operational exploit implementation with a hardcoded root-shell payload rather than a mere detector or README.

Repository contains a single C proof-of-concept exploit plus a README. The main file, cve-2026-46331.c, is a standalone local privilege escalation PoC for CVE-2026-46331, described in comments as a Linux kernel net/sched act_pedit partial COW page-cache corruption issue. The code is not a scanner or detector: it builds raw netlink/rtnetlink requests, configures traffic-control related state, uses loopback traffic on 127.0.0.1:4445 to exercise the vulnerable kernel path, and performs calibration using /tmp/.pedit_calib. The exploit then locates a setuid-root su binary, parses its ELF entry point, attempts to corrupt that entry in page cache, and finally execves the su binary to obtain a root shell. Structurally, the code includes helpers for constructing nested netlink attributes and sending requests, constants for pedit/matchall/tc metadata, loopback networking parameters, and the final exploitation routine in run_exploit() invoked by main(). Overall purpose: demonstrate reliable local root escalation on vulnerable Linux kernels by abusing traffic-control pedit behavior to alter cached contents of a privileged executable.

This repository is a standalone multi-file local privilege escalation exploit framework written primarily in C, with auxiliary Python and Bash tooling. Its stated purpose is exploitation of CVE-2026-46331, described as a Linux kernel page-cache corruption bug involving TC pedit, IPsec ESP, and TEE packet duplication. The repository structure is organized into: headers under include/ defining exploit context, packet, memory, and persistence APIs; C source files under src/ implementing an 8-stage attack chain; Python helper modules for reconnaissance and packet crafting; and shell scripts for setup, cleanup, and target discovery. Main execution starts in src/main.c, which parses flags such as --target, --remote, --stealth, --persist, --cleanup, and --test, generates a payload, and runs eight stages: environment analysis, namespace bypass, network setup, page-cache corruption, privilege escalation, persistence, evasion, and cleanup. The exploit is clearly intended as an actual offensive tool rather than a detector: it contains shellcode, persistence installers, cleanup/evasion logic, and shell-spawning behavior. Core capabilities: 1) Reconnaissance: stage_env_analysis.c and modules/exploit_analyzer.py inspect kernel version, distro, user namespace availability, AppArmor/SELinux, tc/ipsec/netfilter support, and ELF entry offsets of target SUID binaries. 2) Namespace/network preparation: stage_namespace_bypass.c attempts unshare(CLONE_NEWUSER|CLONE_NEWNET), AppArmor profile hopping via aa-exec, LD_PRELOAD tricks against SUID binaries, and a clone/unshare fallback. stage_network_setup.c configures loopback, clsact qdisc, tc pedit filters that set IP IHL=15, xfrm/IPsec state and policy, and an iptables TEE rule for UDP/4500 traffic. 3) Corruption primitives: stage_page_cache_corrupt.c uses find_elf_entry() to locate the target ELF entry point and then tries multiple write methods: sendfile, mmap, splice, raw packet sending, and /proc/pid/mem. memory_ops.c implements these primitives plus cache flushing and verification helpers. 4) Privilege escalation: stage_privilege_escalation.c first executes the corrupted target binary, then falls back to partially implemented ptrace injection, LD_PRELOAD-based escalation, and optional kernel-module loading. 5) Post-exploitation: stage_persistence.c and persistence.c implement cron, SSH authorized_keys, hidden SUID copy, systemd service, LD_PRELOAD, kernel module, and bind-shell persistence. stage_evasion.c and stage_cleanup.c attempt anti-forensics by truncating logs, disabling audit, clearing histories, flushing caches, removing rules, and deleting artifacts. Notable implementation observations: the repository is operational but imperfect. The packet trigger path in src/packet_engine.c is stubbed and returns -1, while stage_page_cache_corrupt.c still treats successful raw packet sends as corruption success without validating the kernel-side trigger. The reverse-shell payload generator does not generate distinct shellcode; instead, connect_reverse_shell() later runs a bash /dev/tcp command. Despite these gaps, the codebase contains real exploit-oriented logic and multiple offensive post-exploitation features, making it more than a simple PoC. Fingerprintable targets and infrastructure are concentrated around local Linux resources rather than external C2: loopback 127.0.0.1, UDP port 4500 for IPsec/TEE traffic, target binaries such as /usr/bin/su and /usr/bin/sudo, persistence files under /etc and /root/.ssh, and temporary artifacts under /tmp and /opt/dirtyclone. Overall, this is a local/network-assisted Linux kernel LPE framework with built-in payload delivery, persistence, and anti-forensics components.

This repository is a compact local privilege escalation proof-of-concept for CVE-2026-46331. It contains two files: a single C exploit source file and a README describing the vulnerability and impact. The main file, CVE-2026-46331.c, is a standalone Linux exploit that builds raw NETLINK_ROUTE messages to configure traffic-control state in the kernel, specifically matchall/pedit-related objects in net/sched. It uses loopback traffic on 127.0.0.1:4445 to exercise the vulnerable act_pedit path and appears to include an integrated write primitive ('pedit_primitive') with calibration support via /tmp/.pedit_calib. The exploit then locates a setuid-root su binary, parses its ELF entry point, and repeatedly writes shellcode into that entry offset through the corruption primitive. After successful corruption, it execve()s the modified su binary to obtain root code execution. This is not a scanner or detector; it is an actual exploit with a hardcoded payload, making it operational rather than a bare PoC. No external C2 or remote infrastructure is present; the exploit is entirely local and relies on vulnerable kernel behavior plus the presence of a usable setuid-root su target.

Repository contains a standalone local Linux privilege-escalation exploit for CVE-2026-46331 plus a reusable primitive and a verification harness. Structure: (1) pedit_primitive.c/.h implement the core page-cache overwrite primitive by configuring tc/netlink state on the loopback interface and abusing net/sched act_pedit to write beyond a stale COW range into page-cache-backed data sent via sendfile; setup() prepares loopback networking, opens a local TCP listener on 127.0.0.1:4445, and calibrates the file-offset delta using /tmp/.pedit_calib. api_fd_write() exposes the primitive as bounded 4-byte-slot writes to an arbitrary file descriptor, including O_RDONLY descriptors. (2) test_cve.c is a non-privilege-escalation testcase that creates /tmp/cve_target, reopens it read-only, performs 10 overwrite attempts at varying offsets/sizes, and verifies that the page cache changed despite only holding an O_RDONLY fd. (3) packet_edit_meme.c weaponizes the primitive into unprivileged local root: it locates a setuid-root su binary, parses ELF headers to find the executable entry-point file offset, forks a child that unshares user and network namespaces, maps itself to uid/gid 0 inside the namespace, calls setup(), and writes x86_64 shellcode over the cached su entry point. The parent then execves su from the initial namespace, causing the setuid-root binary to execute the injected shellcode and spawn an interactive root /bin/sh. Ubuntu-specific logic optionally re-execs through aa-exec with profiles trinity/chrome/flatpak to bypass AppArmor userns restrictions. Overall, this is a real exploit repository, not just a detector: it provides both a generic arbitrary page-cache overwrite primitive and an operational local root exploit payload.