Privilege Escalation in ktsuss (CVE-2011-2921)

This repository contains a single Metasploit module (modules/exploits/linux/local/ktsuss_suid_priv_esc.rb) that exploits a local privilege escalation vulnerability (CVE-2011-2921) in ktsuss versions 1.4 and prior on Linux. The exploit leverages the fact that ktsuss, when setuid root, does not drop privileges before executing user-supplied commands, allowing arbitrary command execution as root. The module checks for the presence and setuid status of the ktsuss binary, uploads a Metasploit-generated payload to a writable directory (default: /tmp), and executes it via ktsuss to gain root privileges. The exploit is operational and weaponized, supporting multiple architectures and payload types. The only fingerprintable endpoints are the ktsuss binary path and the writable directory used for payload deployment. The module is intended for use in post-exploitation scenarios where the attacker already has a session on the target system.