https://github.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit

A root exploit for CVE-2022-0847 (Dirty Pipe)
https://github.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit

Last synced: 21 days ago
JSON representation

A root exploit for CVE-2022-0847 (Dirty Pipe)

• Host: GitHub
• URL: https://github.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit
• Owner: Arinerron
• License: gpl-2.0
• Created: 2022-03-07T18:55:20.000Z (almost 3 years ago)
• Default Branch: main
• Last Pushed: 2022-03-08T06:20:05.000Z (almost 3 years ago)
• Last Synced: 2024-08-05T17:24:57.010Z (4 months ago)
• Language: C
• Homepage:
• Size: 17.6 KB
• Stars: 1,080
• Watchers: 17
• Forks: 221
• Open Issues: 8
• Metadata Files:
  • Readme: README.md
  • License: LICENSE.txt

Awesome Lists containing this project

• awesome-hacking-lists - Arinerron/CVE-2022-0847-DirtyPipe-Exploit - A root exploit for CVE-2022-0847 (Dirty Pipe) (C)

README

        
# What is this

This is Max Kellermann's proof of concept for Dirty Pipe, but modified to overwrite root's password field in /etc/passwd and restore after popping a root shell.

**Side Note:** I do not claim any credit for finding this vulnerability or writing the proof of concept. This exploit is merely a small modification of Kellermann's proof of concept to enable quick/easy exploitation. Please read the original article on this extremely interesting vulnerability @ https://dirtypipe.cm4all.com/ when you get the opportunity. It really does deserve your time to understand it.

# How to use this

1. Compile with `./compile.sh` (assumes `gcc` is installed)

2. Run `./exploit` and it'll pop a root shell

# su: must be run from a terminal

If you get this error message:

1. Login as `root` with the password `aaron`.

2. Then, restore `/etc/passwd` by running `mv /tmp/passwd.bak /etc/passwd`

(oops sorry my laptop battery is dying and my charger broke so I don't have time to fix this the right now, sorry)