Terminal Escape-Sequence Injection in util-linux wall

This repository contains a proof-of-concept trojan exploiting CVE-2024-28085, a vulnerability in GNU bash related to terminal escape codes. The main payload ('sleepall.cpp') is a C++ program that monitors running processes for 'sudo' invocations. When a user attempts to use 'sudo', the trojan injects a fake password prompt using terminal escape codes, tricking the user into entering their password into the terminal rather than the real sudo process. The captured password, along with recent bash history and the username, is then exfiltrated to a server (by default, 127.0.0.1:13031, but this can be changed). The server component ('server.c') is a simple TCP server that listens for incoming connections and prints received data, acting as the exfiltration endpoint. The exploit is operational and demonstrates real credential theft, but is not weaponized for mass deployment. The code is intended for educational and testing purposes, as stated in the README. The attack vector is local, requiring the trojan to be executed on the target system. The exploit is only effective in bash and may not work on all Linux distributions.

This repository provides a working exploit for CVE-2024-28085 (Wall-Escape), a vulnerability in the util-linux 'wall' command on Linux systems. The vulnerability allows unprivileged users to inject arbitrary escape sequences into other users' terminals by passing them as command line arguments to 'wall', which fails to sanitize these inputs. The exploit is operational and consists of three main C programs: - 'spy.c': Continuously monitors the /proc filesystem to log command line arguments of new processes, enabling the capture of sensitive data such as passwords entered at fake prompts. - 'throw.c': Crafts and sends a fake password prompt to the victim's terminal using the vulnerable 'wall' command, leveraging escape sequences to manipulate terminal output and hide user input. - 'watch.c': Waits for a specific command to be executed by the victim (e.g., 'sudo systemctl start apache2'), then triggers the attack sequence. The exploit is demonstrated on Ubuntu 22.04 with default configurations, but may work on other Linux distributions where 'wall' is setgid and 'mesg' is enabled. The attack can be used to harvest passwords (e.g., from sudo or SSH logins) or alter clipboard contents on terminals that support relevant escape sequences. The repository includes build scripts, detailed documentation, and a comprehensive report explaining the vulnerability and exploitation scenarios.