Privilege Escalation via User Namespace Mapping in Linux Kernel (CVE-2018-18955)

This repository contains a single Metasploit module (Ruby file) that exploits CVE-2018-18955, a local privilege escalation vulnerability in certain Linux kernel versions (4.15.0 to 4.18.18, 4.19.0 to 4.19.1). The exploit leverages broken uid/gid mappings in nested user namespaces to escalate privileges to root. The module checks for the presence and setuid bit of the 'newuidmap' and 'newgidmap' helpers, verifies kernel version and configuration, and then uploads and executes exploit binaries (either compiled on the target or pre-compiled). The exploit works by injecting a cron job into /etc/crontab to execute a payload as root, typically resulting in a root shell or meterpreter session. The module is weaponized, allowing for customizable payloads and automated cleanup. The only file in the repository is the Metasploit module itself, written in Ruby, and it is designed to be used within the Metasploit Framework.

This repository is a local privilege escalation exploit for CVE-2018-18955, targeting Linux kernel versions 4.15.x through 4.19.x before 4.19.2. The vulnerability lies in improper handling of nested user namespaces, allowing a user with CAP_SYS_ADMIN in a user namespace to escalate privileges and access resources outside the namespace. The repository provides multiple exploitation techniques, each implemented as a separate shell script: bash_completion, cron, dbus, ldpreload, and polkit. Each script compiles the necessary C payloads (subuid_shell.c, subshell.c, rootshell.c, libsubuid.c) and uses a different method to trigger the vulnerability and create a setuid root shell at /tmp/sh. The C files implement the core logic for namespace manipulation and payload execution. The exploit requires local access and specific system configurations (user namespaces, newuidmap/newgidmap utilities, and sometimes additional services like cron, dbus, or polkit). The repository is operational and provides a working local root exploit with multiple vectors for exploitation.