CVE-2024-48990 PoC — needrestart 安全漏洞

Description

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.

介绍

## Proof of Concept (PoC) for CVE-2024-48990 in `needrestart`

**CVE-2024-48990**: Linux Local Privilege Escalation (LPE) via `needrestart`

- **Patched**: Nov 19, 2024
- **More Information**: [Qualys Advisory](https://www.qualys.com/2024/11/19/needrestart/needrestart.txt)

---

## How to Use?

1. Run the script `./start.sh`.
   - This will compile a malicious `importlib` library.
   - It will then start a Python script (`e.py`) that sets up a listener and waits for `needrestart` to be executed by the `root` user.

2. When `needrestart` is triggered (typically by an update like `apt upgrade`), it will load the fake library and execute the payload.

3. Upon successful execution, a shell will be opened.

---

文件快照

备注