Looney Tunables

Repository contains a compact exploit toolkit with 3 files: a large standalone Python script (wp2shell.py), a Nuclei exposure template (wp2shell-exposure.yaml), and a README documenting usage and attack flow. The Python script is the main artifact and implements several modes: non-destructive scanning, blind SQLi validation, blind SQL data extraction, authenticated RCE using recovered admin credentials, credential-less pre-auth RCE by forging an administrator and deploying a self-cleaning webshell/plugin, root-prerequisite diagnostics, and a full Linux LPE chain. The Nuclei template is limited to detection/fingerprinting and checks the homepage, RSS feed, and REST batch route for vulnerable WordPress versions and exposed /batch/v1 behavior. The exploit targets WordPress core vulnerabilities CVE-2026-60137 (pre-auth blind SQLi via REST batch route confusion / author__not_in path) and CVE-2026-63030 (unauthenticated RCE via admin forge + webshell upload). README and script also describe optional post-exploitation privilege escalation attempts against Linux using CVE-2023-2640/CVE-2023-32629, CVE-2023-4911, and CVE-2024-1086, plus SUID/sudo fallback. Overall, this is not just a detector: it is a multi-stage operational exploit chain with customizable command execution and optional interactive shell behavior.

Repository is a compact local privilege-escalation PoC for CVE-2023-4911 (Looney Tunables), targeting vulnerable GNU glibc on Linux. The repo contains a C exploit (exp.c), a Python helper (gen_libc.py), and Docker artifacts to build a reproducible lab. The exploit is not network-facing; it is a local attack against the glibc dynamic loader used when launching a SUID binary. Structure and purpose: exp.c is the main exploit. It prepares a malicious environment layout using multiple GLIBC_TUNABLES strings, crafts a large fake DT_RPATH area on the stack, and repeatedly execs /usr/bin/su via fork()+execve() to brute-force a favorable ASLR-dependent memory layout. Before the retry loop, it creates a directory named '"' and copies a forged libc.so.6 into it. gen_libc.py generates that forged libc by reading the host libc from /lib/x86_64-linux-gnu/libc.so.6, assembling pwntools shellcode, and patching bytes associated with __libc_start_main so the malicious library executes setuid(0), setgid(0), and /bin/sh when loaded. Exploit capability: The C code abuses the vulnerable GLIBC_TUNABLES parser with a malformed 'name=name=value' style string to trigger a heap buffer overflow in ld.so. It then attempts to corrupt link_map metadata, specifically l_info[DT_RPATH], so the loader resolves libraries from an attacker-controlled path. If successful, the SUID process loads the forged libc.so.6 from the attacker-created directory, resulting in root shell execution before normal authentication logic. The exploit includes stack limit adjustment and repeated child process execution to improve reliability. Dockerfile builds the C exploit in a builder stage, installs Python/pwntools in the runtime image, creates a non-root student user, runs gen_libc.py to prebuild the malicious libc, and drops the user into a shell for testing. docker-compose.yml simply launches this amd64 lab container. README.md documents the vulnerability, attack chain, affected versions, and lab usage. Overall, this is a real operational PoC for local root escalation, not merely a detector or write-up.

This repository is a compact local privilege-escalation exploit project for CVE-2023-4911 (Looney Tunables). It contains only three files: LICENSE, README.md, and a single monolithic C source file, main.c, which serves as the exploit entry point. The README describes an optimized implementation that folds libc patching, environment preparation, timing calibration, and brute-force orchestration into one binary. The exploit is not a scanner or detector only; it includes active exploitation logic. main.c first performs a fail-fast vulnerability check by executing /usr/bin/su with a crafted GLIBC_TUNABLES environment and a large auxiliary buffer, then determines vulnerability based on whether the child crashes. The code also includes a custom ELF parser that mmaps the target libc and resolves symbol offsets dynamically from .dynsym/.dynstr rather than relying on hardcoded addresses. This indicates the exploit adapts itself to the local libc layout. Operationally, the exploit uses a multi-process brute-force model: it calibrates timing, forks worker processes across available CPU cores, and repeatedly launches child processes via execve() with crafted argv/envp. Shared state tracks attempts, crashes, and success. The parent process prints real-time statistics, while workers infer success when a spawned process remains alive beyond expected crash timing, then report that a shell is running. The README explicitly mentions custom shellcode using setreuid/setresuid, suggesting the end goal is a root shell. There are no network endpoints or remote C2 behaviors in the provided code; the attack vector is purely local. The most important fingerprintable artifacts are the use of /usr/bin/su, /dev/null, and the malicious GLIBC_TUNABLES-based environment strings. Overall, this is an operational local Linux exploit PoC with automation and optimization features beyond a minimal proof of concept.

This repository is a Dockerized local privilege escalation lab and exploit PoC for CVE-2023-4911 (Looney Tunables), targeting vulnerable glibc/ld.so tunables parsing in SUID execution context. It is not a remote exploit and has a clear local attack vector: the attacker supplies a crafted GLIBC_TUNABLES environment variable when launching a SUID binary. The repository contains both a basic crash-verification PoC and a partially parameterized LPE exploit path. Structure and purpose: - Dockerfile builds a reproducible Ubuntu Jammy analysis container, intentionally restoring vulnerable ld-linux-x86-64.so.2 and libc.so.6, installing debugging tools (gdb, gdbserver, strace, ltrace), downloading glibc 2.35 source, compiling test SUID binaries, and building the malicious shared library. - run.sh manages image build, interactive execution, analysis mode, and quick vulnerability testing. It exposes TCP port 1234 for gdbserver. - check_environment.sh validates that the container is vulnerable, confirms tools and source availability, and prints next-step instructions. - poc/exploit.py is a basic Python PoC that checks vulnerability by executing a SUID target with crafted GLIBC_TUNABLES and observing a crash/timeout. It can also generate a temporary GDB script at /tmp/gdb_script for crash analysis. - poc/exploit_lpe.py is the intended privilege-escalation exploit. It demonstrates the workflow: trigger crash, manually determine OVERFLOW_OFFSET and TARGET_ADDR via GDB, then execute the SUID target with a crafted payload intended to overwrite ld.so state and redirect library loading to /workspace/poc/evil_lib. - poc/evil_lib/evil.c builds evil.so, a malicious shared object whose constructor immediately calls setuid(0), setgid(0), prints a status message, and execve('/bin/bash', ['-p']). This is the actual privilege-escalation payload. - test_targets/test_suid.c and test_targets/test_heap.c are local helper binaries compiled SUID-root inside the container for testing and analysis. Exploit capabilities: 1. Vulnerability detection / crash verification: exploit.py and exploit_lpe.py can confirm the vulnerable code path by launching a SUID binary with malformed GLIBC_TUNABLES and checking for a crash. 2. Guided exploit development: the code and README provide a workflow for using GDB/gdbserver to determine the correct overwrite offset and target address. 3. Local privilege escalation payload delivery: once offsets are manually supplied, exploit_lpe.py attempts to execute the SUID target with a crafted environment so ld.so loads attacker-controlled evil.so. 4. Root shell spawning: evil.so’s constructor escalates privileges and launches /bin/bash -p. Operational assessment: - The repository is a real exploit lab, not just documentation. - The basic PoC is functional for detection/crash confirmation. - The full LPE exploit is not turnkey because OVERFLOW_OFFSET and TARGET_ADDR are placeholders that must be derived manually per environment. However, the payload stage and malicious library are implemented, so overall maturity is best classified as OPERATIONAL rather than mere POC. - No obvious destructive or fake behavior is present; the code aligns with the claimed vulnerability and exploit chain.

Repository contains a local Linux privilege-escalation exploit that targets glibc dynamic loader behavior via crafted GLIBC_TUNABLES environment variables while executing the SUID-root program /usr/bin/su. Structure: - exp.c: Main exploit. It (1) creates a directory named '"' and copies a forged ./libc.so.6 into '"/libc.so.6', (2) builds a large envp array with carefully positioned GLIBC_TUNABLES strings and marker entries, including a hard-coded pointer-like byte sequence intended to affect loader internals (commented as l_info[DT_RPATH]), (3) sets RLIMIT_STACK to infinity, then repeatedly forks/execves /usr/bin/su --help with the crafted environment until it appears to succeed (heuristic: child runs >1s without being signaled), suggesting a spawned shell. - gen)linc.py: Payload generator using pwntools. It loads the system libc (/lib/x86_64-linux-gnu/libc.so.6), assembles x86_64 shellcode (setuid(0), setgid(0), spawn /bin/sh), finds the byte sequence at __libc_start_main in the libc file, and overwrites it with the shellcode, writing the result to ./libc.so.6. - .vscode/tasks.json: Build task for compiling C with MinGW on Windows (likely just developer tooling; not part of exploitation logic). - /libc.so.6 (0 bytes): Placeholder in the repo archive; the real forged libc is intended to be generated by gen)linc.py. Capabilities: - Generates a trojaned libc containing embedded shellcode. - Attempts to coerce the dynamic loader into using the trojaned libc when launching a SUID binary, resulting in a root shell. - Brute-force style retry loop (fork/exec/wait timing) to improve reliability. No network I/O is present; all targeting is local via filesystem paths and environment-variable manipulation.

This repository is a proof-of-concept (PoC) exploit for CVE-2023-4911, also known as the Looney Tunables Linux Privilege Escalation vulnerability in glibc. The exploit targets glibc versions 2.35-0ubuntu3.3 and below on Linux systems. The repository contains C source code for the main exploit (exp.c), a patching utility (patch_libc.c) that injects shellcode into a local copy of libc.so.6, a Makefile for building the exploit, and a shell script (run.sh) to automate the patching and setup process. The exploit works by crafting environment variables and a forged libc.so.6 to exploit the vulnerability in /usr/bin/su, ultimately providing a root shell. The payload is a shellcode that sets UID and GID to 0 and executes /bin/sh. The attack vector is local privilege escalation, requiring the attacker to execute code on the target system. The repository is operational and provides a working exploit with a hardcoded payload.

This repository contains a proof-of-concept (PoC) exploit for CVE-2023-4911, also known as the 'Looney Tunables' vulnerability in GNU glibc. The exploit is implemented in a single Python script (poc.py) and is accompanied by a minimal README. The script targets Linux systems with a vulnerable glibc version and leverages the GLIBC_TUNABLES environment variable to inject shellcode into a patched libc.so.6 file. It then executes a SUID binary with a crafted environment to trigger the vulnerability, potentially resulting in a root shell. The exploit checks for ASLR status and adapts its approach accordingly. The main fingerprintable endpoints are the use of /proc/sys/kernel/randomize_va_space to check ASLR and the manipulation of libc.so.6. The repository is structured simply, with the exploit logic entirely contained in poc.py, and is intended for local privilege escalation testing on affected Linux systems.

This repository contains a proof-of-concept (POC) exploit for CVE-2023-4911, also known as 'Looney Tunables', a local privilege escalation vulnerability in the GNU C Library's dynamic loader (ld.so) on Linux systems. The vulnerability is triggered by a buffer overflow when processing the GLIBC_TUNABLES environment variable. The repository consists of three files: a LICENSE, a detailed README.md explaining the vulnerability and exploitation process, and poc.py, a Python script that implements the exploit. The exploit works by crafting a malicious environment (GLIBC_TUNABLES) and executing a SUID binary (such as /usr/bin/su) to trigger the buffer overflow in ld.so, allowing the injection and execution of shellcode that spawns a root shell. The Python script contains hardcoded shellcode for x86_64 Linux, logic to determine stack addresses, and routines to repeatedly attempt exploitation until successful. The README provides extensive background on the vulnerability, glibc tunables, and the exploitation process, including references to external resources and technical details. The exploit is a local privilege escalation (LPE) and does not require network access. It targets Linux systems with vulnerable versions of glibc and requires the presence of a SUID binary. The endpoints identified are file paths relevant to the dynamic loader and libraries involved in the exploitation process.

This repository is a proof-of-concept exploit for CVE-2023-4911 ("Looney Tunables"), a local privilege escalation vulnerability in glibc's dynamic loader (ld.so) via the GLIBC_TUNABLES environment variable. The exploit consists of: - 'exp.c': The main exploit code, which crafts a malicious environment and repeatedly executes '/usr/bin/su' with specially crafted GLIBC_TUNABLES values to trigger a buffer overflow in glibc's tunables parsing. It also copies a forged 'libc.so.6' to a directory named '"' to hijack the loader. - 'gen_libc.py': A Python script using pwntools to generate a forged 'libc.so.6' by injecting shellcode (setuid(0), setgid(0), execve('/bin/sh')) at the '__libc_start_main' symbol of the system's libc, then writing it as './libc.so.6'. - 'Makefile': Automates building the exploit and generating the forged libc. - 'README.md': Documents the exploit, its target environment (Ubuntu 22.04.3, glibc 2.35-0ubuntu3.3), and credits the original vulnerability discoverers. The exploit is operational and provides a local root shell if successful. It is not weaponized for broad use, as it is tailored to a specific glibc version and environment. The main attack vector is local, requiring the attacker to execute code on the target system. The exploit manipulates file paths and environment variables to hijack the dynamic loader and execute arbitrary code as root.

This repository is a proof-of-concept (PoC) exploit for CVE-2023-4911, also known as 'Looney Tunables', a local privilege escalation vulnerability in glibc's tunables processing. The exploit targets systems such as Ubuntu 22.10 with a vulnerable glibc version. The repository contains two main code files: 'main.c', which orchestrates the exploit, and 'suid_lib.c', which provides a malicious shared library payload. The exploit works by manipulating environment variables and directory structure to hijack the loading of PAM libraries by '/usr/bin/su', causing the system to load the attacker's 'suid_lib.so' instead. This library, when loaded, sets the process's UID and GID to 0 and spawns a root shell. The exploit requires multiple brute-force attempts due to ASLR and heap shaping challenges. The Makefile automates compilation of both the exploit and the shared library. The README provides usage instructions and context. No network endpoints are involved; the attack vector is purely local, requiring the attacker to execute code on the target system.

This repository is a proof-of-concept (PoC) exploit for CVE-2023-4911, also known as the Looney Tunables Linux privilege escalation vulnerability in glibc. The repository contains four files: a Makefile for building and running the exploit, a README.md with usage instructions and background, 'exp.c' (the main exploit code), and 'gen_libc.py' (a Python script to generate a forged libc.so.6 with injected shellcode). The exploit works by crafting a malicious environment and a forged libc.so.6 containing shellcode that spawns a root shell. The C code ('exp.c') sets up the environment variables and repeatedly executes '/usr/bin/su --help' with the crafted environment, exploiting the vulnerable glibc loader behavior. The Python script ('gen_libc.py') uses pwntools to inject shellcode into a copy of the system's libc, producing a malicious 'libc.so.6' used by the exploit. The attack vector is local privilege escalation: the attacker must have local access to the system and the ability to execute binaries. The exploit targets Linux systems running vulnerable versions of glibc (2.35-0ubuntu3.3 and below). The main fingerprintable endpoints are the use of '/usr/bin/su', manipulation of 'libc.so.6', and the GLIBC_TUNABLES environment variable. If successful, the exploit provides a root shell to the attacker.

This repository is a proof-of-concept exploit for CVE-2023-4911 (Looney Tunables), a local privilege escalation vulnerability in the GLIBC dynamic loader (ld.so) discovered by Qualys. The exploit targets Linux systems (tested on Ubuntu 22.04.2 LTS with GLIBC 2.35-0ubuntu3.1) and leverages the GLIBC_TUNABLES environment variable to corrupt internal structures and execute arbitrary code as root. The repository contains: - `xpl.c`: The main exploit code, which crafts environment variables and attempts to exploit the vulnerability by executing `/usr/bin/su` with a specially crafted environment. It supports brute-forcing for ASLR-enabled systems. - `create-libc.py`: A Python script using pwntools to generate a custom libc.so.6 with a payload that sets UID/GID to 0 and spawns a shell. This is used as part of the exploitation process. - `Makefile`: Automates building, testing (with and without ASLR), and cleaning up the exploit environment. - `gdb-script`: A GDB script for debugging the exploit. - `README.md`: Documentation and usage instructions. The exploit is operational, providing a working local privilege escalation to root shell if the target is vulnerable. The main attack vector is local, requiring the attacker to execute code on the target system. Several fingerprintable file paths are used, including the system libc, a custom libc, and the target binary `/usr/bin/su`.

This repository provides a proof-of-concept (PoC) exploit for CVE-2023-4911, also known as 'Looney Tunables', a vulnerability in the glibc dynamic loader's handling of the GLIBC_TUNABLES environment variable. The repository contains three files: a README.md with usage instructions, exp.c (the main exploit code), and libc.py (a helper script to generate a forged libc.so.6 with injected shellcode). The exploit works by crafting specific environment variables and a malicious libc.so.6, then repeatedly executing /usr/bin/su with these parameters to trigger the vulnerability. If successful, the exploit achieves arbitrary code execution, typically spawning a shell as root. The attack vector is local, requiring the attacker to execute code on the target system. The exploit is operational, providing a working payload but requiring some manual setup (such as placing the forged libc in the correct location).

This repository contains a local privilege escalation exploit for CVE-2023-4911 (Looney Tunables), a buffer overflow in the GNU C Library's dynamic loader (glibc) when processing the GLIBC_TUNABLES environment variable. The exploit targets Linux systems (e.g., Ubuntu 22.04 with glibc 2.34+) and leverages a crafted environment and a forged libc.so.6 containing injected shellcode to gain root privileges via /usr/bin/su. The repository consists of three files: a detailed README.md with setup and exploitation instructions, exploit.c (the main exploit logic), and genlib.py (which injects shellcode into a copy of libc.so.6). The exploit is operational, requiring local access and specific system configuration, and results in a root shell if successful. Key fingerprintable endpoints include /usr/bin/su and the manipulated libc.so.6 files. The exploit demonstrates a practical attack path for local privilege escalation on vulnerable Linux systems.

This repository provides a proof-of-concept (PoC) local privilege escalation exploit for CVE-2023-4911, also known as the 'Looney Tunables' vulnerability in glibc. The main exploit logic resides in 'looneypwner.sh', a Bash script that checks the installed glibc version, determines if the system is vulnerable, and, if so, orchestrates the exploitation process. The script uses a Python snippet (with pwntools) to patch the system's libc binary by injecting shellcode that sets UID/GID to 0 and spawns a shell. It then generates and compiles a C program ('exp.c') that manipulates environment variables and memory to trigger the buffer overflow in glibc, targeting '/usr/bin/su' for privilege escalation. If successful, the exploit provides a root shell. The repository is structured with a README describing the vulnerability and usage, the main exploit script, and a license file. The exploit is operational and requires local access to a vulnerable Linux system with a susceptible glibc version.

This repository is a proof-of-concept (PoC) exploit for CVE-2023-4911 ('Looney Tunables'), a local privilege escalation vulnerability in glibc's dynamic loader (ld.so). The exploit targets Linux systems (specifically tested on Ubuntu 22.10) and consists of two main C source files: 'main.c' (the exploit orchestrator) and 'suid_lib.c' (the payload library). The Makefile builds both the exploit binary and a malicious shared library (suid_lib.so). The exploit works by manipulating environment variables and heap allocations to overwrite internal glibc structures, causing the dynamic loader to load the attacker's library in place of legitimate PAM libraries. When the system binary '/usr/bin/su' is executed with the crafted environment, the malicious library is loaded, which immediately escalates privileges and spawns a root shell. The exploit is not weaponized and requires many brute-force attempts due to address space layout randomization (ASLR). The repository is structured for research and demonstration purposes, with a README providing usage instructions and context.

This repository is a proof-of-concept (POC) exploit for CVE-2023-4911 (Looney Tunables), a local privilege escalation vulnerability in glibc's ld.so. The exploit targets Ubuntu 22.04 with glibc 2.35-0ubuntu3.1 and the 'su' binary from util-linux 2.37.2. The repository contains six files: a Dockerfile for building a test environment, a Python script (patch.py) that patches the system's libc.so.6 with shellcode to spawn a root shell, a C exploit (poc.c) that manipulates environment variables to trigger the vulnerability, a gdbscript for debugging, and a README with usage instructions. The exploit works by creating a custom environment and executing '/usr/bin/su' with a patched libc, leveraging the vulnerability to execute arbitrary code as root. The attack vector is local, requiring shell access to the target system. The repository is structured for ease of testing and debugging, with clear build and usage instructions.