feat: /etc/passwd-based exploit

Author: tgies

.github/workflows/build.yml

@@ -45,19 +45,22 @@ jobs:
           fi
       - name: verify
         run: |
-          file payload exploit
+          file payload exploit exploit-passwd
           echo "payload: $(stat -c%s payload) bytes"
           echo "exploit: $(stat -c%s exploit) bytes"
-      - name: upload binary
+          echo "exploit-passwd: $(stat -c%s exploit-passwd) bytes"
+      - name: upload binaries
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: copy-fail-c-${{ matrix.target.arch }}-glibc
-          path: exploit
+          path: |
+            exploit
+            exploit-passwd
           retention-days: 90
 
-  # zig cc + musl-static. Produces deploy-anywhere binaries (no glibc
-  # version dependency, no dynamic loader). zig ships musl libc for every
-  # target; we still need GNU binutils-<arch>-cross for the
+  # zig cc + musl-static. Produces deploy-anywhere binaries with a fully
+  # static link and no runtime libc version dependency. zig ships musl libc
+  # for every target; we still need GNU binutils-<arch>-cross for the
   # `ld -r -b binary` step that wraps the payload as a relocatable .o,
   # plus kernel UAPI headers for nolibc and linux/if_alg.h.
   build-musl:
@@ -98,32 +101,35 @@ jobs:
             UAPI_LINUX_DIR=${{ matrix.target.uapi_base }}/linux \
             UAPI_ASM_GENERIC_DIR=${{ matrix.target.uapi_base }}/asm-generic \
             UAPI_ASM_DIR=${{ matrix.target.uapi_asm }}
-      - name: strip binary
+      - name: strip binaries
         env:
           LD_PREFIX: ${{ matrix.target.ld_prefix }}
         run: |
           STRIP=strip
           if [ -n "$LD_PREFIX" ]; then
             STRIP="${LD_PREFIX}-strip"
           fi
-          BEFORE=$(stat -c%s exploit)
-          "$STRIP" --strip-all exploit
-          AFTER=$(stat -c%s exploit)
-          echo "stripped: $BEFORE -> $AFTER bytes"
+          for bin in exploit exploit-passwd; do
+            BEFORE=$(stat -c%s "$bin")
+            "$STRIP" --strip-all "$bin"
+            AFTER=$(stat -c%s "$bin")
+            echo "$bin stripped: $BEFORE -> $AFTER bytes"
+          done
       - name: verify
         run: |
-          file payload exploit
+          file payload exploit exploit-passwd
           echo "payload: $(stat -c%s payload) bytes"
           echo "exploit: $(stat -c%s exploit) bytes"
-      - name: upload binary
+          echo "exploit-passwd: $(stat -c%s exploit-passwd) bytes"
+      - name: upload binaries
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: copy-fail-c-${{ matrix.target.arch }}-musl
-          path: exploit
+          path: |
+            exploit
+            exploit-passwd
           retention-days: 90
 
-  # Tagged releases attach all twelve binaries to a GitHub Release.
-  # Triggered only on `v*` tag pushes; ordinary main pushes skip this job.
   release:
     if: startsWith(github.ref, 'refs/tags/v')
     needs: [build-glibc, build-musl]
@@ -143,8 +149,10 @@ jobs:
           mkdir -p release
           for d in artifacts/copy-fail-c-*; do
             base=$(basename "$d")
+            passwd_name="${base/copy-fail-c-/copy-fail-c-passwd-}"
             cp "$d/exploit" "release/$base"
-            chmod +x "release/$base"
+            cp "$d/exploit-passwd" "release/$passwd_name"
+            chmod +x "release/$base" "release/$passwd_name"
           done
           ls -la release/
       - name: create release
@@ -162,8 +170,19 @@ jobs:
 
           ## Binaries
 
-          Each binary is statically linked. Download the one matching the target's
-          architecture and either libc variant.
+          Each binary is statically linked. Download the one matching the
+          target's architecture, libc, and exploit variant.
+
+          Exploit variants:
+
+          * \`copy-fail-c-<arch>-<libc>\`: binary-mutation variant. Mutates
+            a setuid binary's page cache, then execs it.
+          * \`copy-fail-c-passwd-<arch>-<libc>\`: /etc/passwd UID-flip variant.
+            Mutates four bytes of /etc/passwd's page cache, then execs `su`.
+            Works where the binary-mutation route is blocked but has a
+            narrower cashout surface; see README for details.
+
+          Build modes:
 
           * \`-glibc\` builds: GNU cross-toolchain, glibc-static. Larger (~800 KB)
             but functionally identical to source-built binaries on a glibc system.

.gitignore

@@ -1,5 +1,6 @@
 # build artifacts
 exploit
+exploit-passwd
 payload
 payload.o
 *.o

Makefile

@@ -60,7 +60,7 @@ PAYLOAD_CFLAGS ?= $(PAYLOAD_BASE_CFLAGS) $(PAYLOAD_PACK_LDFLAGS)
 
 .PHONY: all clean info musl-shim musl-static zig-musl-static FORCE
 
-all: exploit
+all: exploit exploit-passwd
 
 # musl-static: tiny (~55 KB exploit + ~1.5 KB payload), no glibc dependency.
 # Requires musl-tools and linux-libc-dev. musl-gcc isolates its include path
@@ -119,6 +119,11 @@ payload-abi.o: FORCE
 exploit: exploit.c payload.o
 	$(CC) $(CFLAGS) $(LDFLAGS) -static -o $@ $^
 
+# /etc/passwd UID-flip variant. No payload needed; mutates four ASCII bytes
+# of /etc/passwd's page cache to flip the user's UID to "0000", then execs su.
+exploit-passwd: exploit-passwd.c
+	$(CC) $(CFLAGS) $(LDFLAGS) -static -o $@ $<
+
 info: payload payload.o
 	@echo "=== payload size ==="
 	@stat -c '%n: %s bytes' payload
@@ -131,4 +136,4 @@ info: payload payload.o
 	@readelf -S payload | grep -E 'Name|\.text|\.rodata|\.data|\.bss' | head -10
 
 clean:
-	rm -rf exploit payload payload.o payload-abi.o .musl-shim
+	rm -rf exploit exploit-passwd payload payload.o payload-abi.o .musl-shim

README.md

@@ -17,7 +17,8 @@ Discovery and original disclosure: Theori / Xint.
 
 ```
 copy-fail-c/
-├── exploit.c           the dropper (AF_ALG + splice page-cache mutation)
+├── exploit.c           the dropper (binary-mutation variant)
+├── exploit-passwd.c    the dropper (/etc/passwd UID-flip variant)
 ├── payload.c           the body that gets dropped (setgid+setuid+execve sh)
 ├── Makefile            build orchestration
 ├── nolibc/             vendored from torvalds/linux tools/include/nolibc
@@ -29,7 +30,8 @@ After `make`:
 ```
 ├── payload             tiny static ELF, embedded into the dropper as bytes
 ├── payload.o           payload wrapped as a relocatable .o by `ld -r -b binary`
-└── exploit             final dropper binary
+├── exploit             dropper, binary-mutation variant
+└── exploit-passwd      dropper, /etc/passwd UID-flip variant
 ```
 
 `exploit.c` opens the target binary read-only, then for each 4-byte window of
@@ -47,6 +49,11 @@ setuid root, so the kernel grants root credentials and runs the payload.
 ...)`. nolibc supplies the `_start`, the syscall machinery, and the per-arch
 register-juggling.
 
+A second variant, `exploit-passwd.c`, mutates four bytes of /etc/passwd's page
+cache instead of a setuid binary's image. It needs no embedded payload and
+works on systems where the binary-mutation route is blocked, but its cashout
+surface is much narrower.
+
 
 ## Build
 
@@ -112,20 +119,66 @@ _binary_payload_size     absolute symbol whose value is the size in bytes
 ```
 
 `exploit.c` declares the first two as `extern const unsigned char[]` and
-computes the size as `_binary_payload_end - _binary_payload_start`. There is
-no `xxd -i`-generated header file, no embedded array literal, no source
-regeneration step. The payload bytes pass through the build as a real
-linker artifact.
+computes the size as `_binary_payload_end - _binary_payload_start`.
 
 ### `-Wl,-N` plus tight `max-page-size`
 
 The payload is statically linked with `-Wl,-N -Wl,-z,max-page-size=0x10`,
 which collapses `.text`/`.rodata`/`.data` into a single LOAD segment with
 16-byte file-alignment instead of the kernel-page-aligned 4 KB-per-segment
 default. This produces an "RWX permissions" warning from `ld`, which is
-informational only - the payload's runtime memory protection doesn't matter
-to its single-purpose program. Without this flag, the same code links to ~13
-KB on x86_64 (mostly inter-segment zero padding); with it, ~1.7 KB.
+informational only - the payload's runtime memory protection doesn't matter to
+its single-purpose program. Without this flag, the same code links to ~13 KB
+on x86_64 (mostly inter-segment zero padding); with it, ~1.7 KB.
+
+
+## Variants and cashout viability
+
+This repository ships two exploit variants that share the AF_ALG/splice
+page-cache mutation primitive but cash out into root execution differently.
+Their reliability profiles are not equivalent, and the difference matters
+when reasoning about real-world threat models.
+
+### Binary-mutation variant (`exploit`)
+
+Mutates the page cache of a target setuid binary with the embedded payload
+bytes, then execs the binary. The kernel grants root credentials from the
+binary's untouched on-disk setuid bit, loads the corrupted in-memory image,
+and runs the payload.
+
+Works wherever the attacker can `open(target, O_RDONLY)` for any root-setuid
+binary on the system. More or less defeated by environments that gate setuid
+binaries behind restricted-read directories and by setuid-free system designs.
+
+### /etc/passwd UID-flip variant (`exploit-passwd`)
+
+Mutates four bytes of /etc/passwd's page cache to set the running user's UID
+field to "0000". /etc/passwd is world-readable on every standard Linux system,
+so the *mutation* is universal. Translating it into root execution depends on
+some root-side process resolving the user via getpwnam/getpwuid and acting on
+the resolved uid without cross-validation. Many such consumers exist; many of
+them defensively cross-check against the kernel's view of the calling uid or
+against on-disk file ownership, breaking the cashout.
+
+#### Cashout viability matrix
+
+| Cashout | Pre-root setup needed | Notes |
+|---|---|---|
+| WSL2 session spawn | No | WSL's per-session `setuid(getpwnam(default_user)->pw_uid)` does no validation. Works cleanly. |
+| util-linux `su` | No | Permissive caller-identity handling. |
+| shadow-utils `su` | Yes | `getpwuid(getuid())` caller-identity check fails because the mutation unmaps the real uid. |
+| sshd (default `StrictModes yes`) | Yes (disable StrictModes) | StrictModes requires the home dir to be owned by root or `pw->pw_uid`. Mutation makes pw_uid=0; on-disk owner stays at original uid; mismatch refuses auth. |
+| MTA local delivery (postfix, exim, etc.) | Variable | Depends on the MDA's home-perm validation. Test per MTA. |
+
+#### Pivoting after `su` fails
+
+`exploit-passwd` execs `su <user>` after mutating, as the simplest possible
+cashout. That works against util-linux `su` but fails against shadow-utils `su`
+with "Cannot determine your user name." The page cache mutation is still in
+place at that point, and pivoting to any other cashout (e.g. using a daemon
+resolving users via getpwnam without cross-checking) is possible at that point.
+Run `echo 3 > /proc/sys/vm/drop_caches` as root to clear the corrupted page
+cache when done testing.
 
 
 ## Affected kernels
@@ -154,26 +207,6 @@ disclosure. To verify whether a target kernel is in-window, check whether
 git log or the distro's changelog.
 
 
-## Verification
-
-Local cross-arch sanity check via qemu-user-static:
-
-```sh
-sudo apt install qemu-user-static gcc-aarch64-linux-gnu binfmt-support
-make clean
-make CC=aarch64-linux-gnu-gcc LD=aarch64-linux-gnu-ld
-file payload                         # ELF 64-bit LSB executable, ARM aarch64
-echo 'id; exit' | ./payload          # runs via binfmt_misc -> qemu-aarch64-static
-```
-
-This confirms the per-arch syscall asm in `nolibc/arch-arm64.h` dispatches
-correctly and that the build pipeline cross-compiles cleanly. It does not
-exercise the kernel-side AF_ALG/splice primitive on an aarch64 kernel,
-because qemu-user-static forwards syscalls to the host kernel. For full
-kernel-level verification on a foreign arch, use `qemu-system-aarch64` with
-a vulnerable cloud image, or a real aarch64 host.
-
-
 ## License and credits
 
 Discovery and original disclosure of CVE-2026-31431: Theori / Xint.