Privilege Escalation via Insecure RPATH in HP Glance xglance-bin

This repository contains a single Metasploit module (modules/exploits/linux/local/hp_xglance_priv_esc.rb) that exploits a local privilege escalation vulnerability (CVE-2014-2630) in HP's Glance (Performance Monitoring) software for Linux. The exploit targets the xglance-bin binary, which is setuid root and was compiled with an insecure RPATH that includes a user-controllable relative path (-L/lib64/). By creating a malicious shared object (libXm.so.3) in a specially crafted directory (e.g., /tmp/-L/lib64/), the attacker can trick xglance-bin into loading this library and executing arbitrary code as root. The module uploads and compiles the malicious shared object and a payload executable (such as a root shell), sets up the necessary directory structure, and launches xglance-bin to trigger the exploit. The exploit is weaponized, allowing the attacker to gain root privileges on vulnerable systems. The only file in the repository is the Metasploit module itself, written in Ruby, and it leverages standard Metasploit libraries for file operations, payload generation, and session management.