Linux Kernel Netfilter nft_payload_copy_vlan Integer Overflow

Repository is a C-based local privilege escalation PoC for CVE-2023-0179 in Linux nf_tables/netfilter. Structure/purpose: - needle.c: main entry point. Pins process to CPU0, re-execs itself under `/usr/bin/unshare -Urn` to obtain a fresh user+network namespace environment, runs `setup.sh`, then uses libmnl/libnftnl over NETLINK_NETFILTER to create a netdev nftables table, base chain (ingress hook), exploit chain, and a set. It first installs leak rules, sends a crafted UDP packet via `send_packet()`, then runs `nft list map ... | ./run.sh > reg.log` to extract leaked kernel addresses (regs pointer and an instruction address in nft_do_chain) and compute KASLR slide. If user selects option 2, it calls `pwn()` with the leaked addresses. - exploit.c / exploit.h: exploit logic. Builds a crafted “jumpstack” layout in nft registers, triggers an overflow via a payload expression to overwrite a jump stack, then pivots the kernel stack to controlled data and executes a hardcoded ROP chain (kernel-build dependent) to overwrite `modprobe_path` with `/tmp/windprobe`. After returning to userland, `privesc()` drops `/tmp/windprobe` which appends a UID 0 user to `/etc/passwd`, then triggers modprobe by executing `/tmp/dummy` containing 0xffffffff bytes. - helpers.c / helpers.h: nftables/netlink helper routines to build tables/chains/rules/sets and send batched netlink requests; also contains `send_packet()` which binds to interface `vlan.10` and sends a UDP packet to 192.168.123.123:1337 to trigger rule evaluation. - setup.sh: configures veth pair and stacked VLAN interfaces (host-enp3s0, vlan.5, vlan.10) and assigns IPs; brings interfaces up. - run.sh: parses nft output to reconstruct leaked kernel addresses and writes them to stdout (captured into reg.log). - Makefile: builds `needle` binary linking against libmnl and libnftnl. Exploit capabilities: - Kernel address leak stage (leaks a kernel TEXT address and a regs/stack-related address via nft set/map output parsing). - KASLR slide calculation using leaked instruction address vs hardcoded INSTR_BASE. - Kernel ROP execution via nftables rule manipulation/overflow to overwrite modprobe_path. - Privilege escalation to root and persistence by adding a root user (needle) to /etc/passwd. Notable constraints: - Hardcoded gadget addresses and INSTR_BASE indicate the ROP chain is tuned to a specific kernel build; portability requires adjusting offsets/gadgets. - Requires nftables/netfilter netdev hook availability and the ability to create netdev tables/chains (CAP_NET_ADMIN in namespace).

Repository is a C-based local privilege escalation PoC for CVE-2023-0179 targeting Linux netfilter/nftables. It programs nftables objects via NETLINK_NETFILTER (libmnl/libnftnl) to first leak kernel addresses (regs and a kernel text address for KASLR slide), then constructs a malicious rule set that triggers a memory corruption/overflow in nftables processing and pivots execution into a ROP chain. Structure/purpose: - needle.c: Main entry point. Pins to CPU0, re-execs itself under `/usr/bin/unshare -Urn` to run in a new user+network namespace, prompts user for leak-only vs exploit, runs `setup.sh`, creates nftables table/chains/set, installs leak rules, sends a trigger packet, parses leaked pointers via `nft ... | ./run.sh > reg.log`, and optionally calls `pwn()` with leaked addresses. - exploit.c / exploit.h: Exploitation logic. Builds the final chain/rule that overwrites a crafted “jumpstack” layout using immediate-data loads into NFT_REG32_00..15 and a payload expression to trigger overflow. Uses leaked instruction address to compute KASLR slide (INSTR_BASE constant) and hardcoded gadget offsets for kernel 6.1.6. After kernel control is gained, `privesc()` overwrites modprobe_path to point to `/tmp/windprobe` and triggers modprobe by executing `/tmp/dummy` containing 0xffffffff bytes. - helpers.c / helpers.h: nftables/netlink helper routines to build tables/chains/rules/sets and send batched netlink requests; also contains `send_packet()` which sends a UDP packet bound to interface `vlan.10` to trigger ingress processing, and `read_from_file()` to read leaked addresses from reg.log. - setup.sh: Creates a veth pair (eth0 <-> host-enp3s0), assigns IPs, and creates stacked VLAN interfaces (vlan.5 and vlan.10) used by the trigger packet path. - run.sh: Parses `nft list map ...` output to reconstruct two kernel addresses (regs-ish pointer and a kernel text pointer) and prints them; needle.c stores them in reg.log. - Makefile: Builds `needle` binary linking against libmnl and libnftnl. Exploit capabilities: - Local kernel exploitation via nftables netdev ingress rules and a crafted packet to trigger the vulnerable code path. - Kernel address leak (KASLR bypass) by reading nftables map/set output. - ROP chain to overwrite `modprobe_path` and execute a user-controlled script. - Privilege escalation/persistence by appending a UID 0 user (needle) to /etc/passwd. Notable assumptions/constraints: - Hardcoded INSTR_BASE and gadget addresses indicate tight coupling to a specific kernel build/config (README references Linux 6.1.6 and a provided .config). - Requires nft tooling and the ability to create netns/userns and configure veth/VLAN interfaces; trigger uses SO_BINDTODEVICE on `vlan.10` and sends UDP to 192.168.123.123:1337 (destination is arbitrary; the key is local ingress processing).

This repository contains a full local privilege escalation (LPE) exploit for CVE-2023-0179, a vulnerability in the Linux kernel's nftables subsystem (versions 5.5 to 6.2-rc3). The exploit is implemented in C and consists of several source files (exploit.c, helpers.c, needle.c, and their headers), along with supporting shell scripts (run.sh, setup.sh). The main entry point is 'needle.c', which sets up a network namespace and guides the user through leaking kernel addresses and then exploiting the vulnerability to gain root privileges. The exploit works in two stages: first, it leaks kernel addresses by manipulating nftables rules and parsing their output; second, it overwrites the kernel's modprobe_path variable to point to a crafted script (/tmp/windprobe) that adds a new root user to /etc/passwd. The exploit then triggers modprobe_path execution by running a dummy file, resulting in the script being executed as root. The exploit requires the ability to create user and network namespaces and is intended for local execution on a vulnerable Linux system. Notable endpoints include the payload script (/tmp/windprobe), the target file for privilege escalation (/etc/passwd), and temporary files used for leaking and parsing kernel addresses (reg.log). The exploit also sends crafted UDP packets to a local interface (192.168.123.123) to trigger the vulnerability. The repository is well-structured, with clear separation between exploit logic, helper functions, and setup scripts.

This repository provides a full exploit for CVE-2023-0179, a stack buffer overflow in the Linux kernel's nftables subsystem (versions 5.5 to 6.2-rc3). The exploit is implemented in C and consists of several components: 'needle.c' (main entry point), 'exploit.c' (core exploit logic), 'helpers.c' (utility functions for nftables manipulation and packet crafting), and associated headers. The Makefile builds the 'needle' binary, which orchestrates the exploit. The exploit works in two stages: first, it leaks kernel addresses by abusing nft_payload expressions and parsing nftables output; second, it performs local privilege escalation by overwriting the kernel's modprobe_path variable, causing the kernel to execute a crafted shell script that adds a new root user ('needle:needle') to /etc/passwd. The exploit sets up a network namespace and virtual interfaces, creates nftables tables/chains/rules, and sends a crafted UDP packet to trigger the vulnerability. Several endpoints are used, including temporary files (/tmp/windprobe, /tmp/dummy, reg.log), system files (/etc/passwd), and local IP addresses for network setup. The exploit is operational and provides a working local privilege escalation path on vulnerable Linux systems. It requires CAP_NET_ADMIN and the ability to run userland code. The code is not part of a framework and is a standalone, well-documented exploit with both infoleak and privilege escalation capabilities.