DirtyDecrypt / DirtyCBC local privilege escalation in Linux kernel RxRPC

This repository is a standalone Go local privilege escalation exploit for CVE-2026-31635 in the Linux kernel RxRPC rxgk decrypt path. It is not a framework module. The repo contains 8 files total: 4 Go source files (main.go, lpe.go, pty.go, rxgk.go), dependency metadata (go.mod, go.sum), a README, and .gitignore. Structure and purpose: - main.go is the orchestrator. It checks whether the process is already root, re-execs itself as a worker in fresh user and network namespaces, and after successful exploitation launches an interactive PTY-backed root session. - lpe.go implements the page-cache overwrite logic against /usr/bin/su. It mmaps the target file read-only, compares bytes against a hardcoded 192-byte ELF payload, and repeatedly calls fire() for each byte offset until the cached byte matches the desired payload byte. This is the exploit’s sliding-window probabilistic write primitive. - rxgk.go contains the vulnerability trigger path. It prepares RxRPC/rxgk authentication material using add_key("rxrpc", ...), sets up AF_RXRPC communication over loopback, and uses splice/vmsplice-style packet construction to cause the kernel to decrypt data in place into a page-cache-backed skb buffer. The included content is truncated, but the visible code and README clearly show the exploit chain: fake RxRPC challenge/response, malicious DATA packet construction, and recvmsg/Recvfrom to drive kernel processing. - pty.go provides post-exploitation interaction. It opens /dev/ptmx, creates a PTY pair, spawns su -, bridges terminal I/O, and auto-sends a blank password/newline if prompted. Main exploit capability: The exploit achieves local privilege escalation by abusing a missing skb_cow_data() call in rxgk_decrypt_skb(), causing in-place decryption into page-cache-backed memory. It targets /usr/bin/su and overwrites its cached first page with a tiny x86_64 ELF that sets UID/GID/groups to 0 and execs /bin/sh. Because the primitive is probabilistic, each targeted byte has roughly a 1/256 chance of becoming the desired value per trigger; the code retries up to 10,000 times per byte and advances sequentially so later writes repair collateral corruption from earlier 16-byte block writes. Notable implementation details: - Hardcoded target: /usr/bin/su. - Hardcoded payload length: 192 bytes. - Hardcoded entry offset: 0x78. - Uses namespace isolation (CLONE_NEWUSER | CLONE_NEWNET) to satisfy exploit setup constraints from Go safely. - Brings up loopback interface lo in the worker namespace. - Uses AF_RXRPC sockets and RxRPC security options, plus add_key/keyctl interactions for rxgk session material. - The exploit modifies only page cache, not the on-disk binary. Overall, this is a real, weaponized-enough standalone PoC/operational exploit for Linux local privilege escalation, with a built-in payload and interactive shell handling rather than mere vulnerability detection.

This repository is a standalone Go local privilege escalation exploit for CVE-2026-31635, a Linux kernel RxRPC/rxgk page-cache corruption bug in rxgk_decrypt_skb(). It is not a framework module. The repo contains 8 files: README.md, Go module metadata, and four substantive Go source files: main.go, lpe.go, pty.go, and rxgk.go. Structure and purpose: - main.go is the orchestrator. It checks whether the process is already root, re-execs itself as a worker in fresh user and network namespaces, invokes the LPE routine, and if successful launches an interactive PTY-backed root shell. - lpe.go contains the core page-cache overwrite logic. It mmaps /usr/bin/su, compares bytes against an embedded 192-byte x86_64 ELF payload, and repeatedly calls fire() for each offset until the desired byte appears. The exploit uses a sliding-window technique because each trigger corrupts a 16-byte block; once byte i matches, it advances to i+1 so later writes repair collateral damage without revisiting earlier bytes. - rxgk.go implements the trigger path. It builds an rxgk authentication token, installs it with add_key("rxrpc", ...), creates AF_RXRPC sockets, brings up loopback in the worker namespace, and uses a fake loopback UDP/RxRPC exchange plus splice/vmsplice mechanics to place file-backed page-cache data into the vulnerable decrypt path. The code comments and README indicate the vulnerable kernel decrypts in place before copy-on-write/HMAC verification, causing page-cache corruption. - pty.go creates a PTY bridge around su, forwarding terminal I/O and even auto-sending a newline if a password/passphrase prompt appears. Exploit capabilities: - Local privilege escalation from an unprivileged user to root. - Namespace-isolated worker execution using CLONE_NEWUSER and CLONE_NEWNET. - Automatic loopback setup and rxrpc module autoload attempt. - Repeated probabilistic corruption of the page cache for /usr/bin/su using random AES-128 rxgk session keys. - Verification of successful byte writes via mmap of the target file's cached page. - Launch of an interactive root shell after successful cache poisoning. The exploit is operational rather than a mere PoC because it includes a complete end-to-end chain and a working payload, but the payload is fixed/hardcoded rather than user-customizable. The repository does not appear fake or purely demonstrative; it contains concrete exploit logic, a hardcoded privilege-escalation payload, and terminal handling for post-exploitation interaction.

Repository contains a Linux local privilege escalation proof-of-concept for CVE-2026-31635 ('DirtyDecrypt'). The main exploit is exploit/dirtydecrypt.c, supported by a Makefile and a small x86_64 shellcode payload in exploit/shellcode/payload.asm; the rest of the repository is documentation explaining vulnerability mechanics, exploit development, affected kernels, and patch analysis. Core capability: the exploit abuses a missing skb_cow_data() check in the Linux kernel RxRPC/RxGK decryption path (rxgk_decrypt_skb()) to achieve an arbitrary in-memory overwrite of shared page-cache-backed file data. It generates an attacker-controlled RxRPC/RxGK key, encrypts shellcode with AES-CBC using OpenSSL, constructs a dual-fragment packet so that kernel decryption writes plaintext into a target page cache page belonging to a readable setuid-root binary, then executes that binary to obtain a root shell. Exploit flow visible from the code and docs: (1) locate a readable setuid-root target such as /bin/su or /usr/bin/sudo, (2) back it up under /tmp/.<name>_<pid>, (3) create/install an RxRPC key via add_key("rxrpc", ...), (4) use AF_RXRPC sockets and a local UDP/RxRPC handshake to obtain valid call metadata, (5) build a malformed dual-fragment SKB using splice/pipe mechanics so the first fragment maps to the target file page and the second carries ciphertext, (6) trigger kernel decryption so plaintext shellcode overwrites the target page cache, and (7) exec the modified setuid binary for privilege escalation. The exploit is not merely a detector: it contains a real payload and execution path. It is operational rather than weaponized because it includes a concrete hardcoded shell payload and target-selection logic, but is not part of a larger exploitation framework. Attack surface is primarily local, though it leverages kernel networking primitives (AF_RXRPC / UDP transport) internally to reach the vulnerable code path. Notable implementation details from dirtydecrypt.c: OpenSSL EVP AES-CBC encryption, direct keyring syscalls (SYS_add_key and SYS_keyctl), custom XDR token construction for RxGK, AF_RXRPC socket usage, namespace setup, backup/restore handling, and execution of the corrupted target binary. The shellcode payload is a minimal x86_64 execve('/bin/sh') stub. Repository structure: top-level README and docs provide vulnerability and patch context; exploit/ contains the buildable PoC. Total files: 13. Code-bearing files are primarily exploit/dirtydecrypt.c, exploit/shellcode/payload.asm, and exploit/Makefile.

This repository is a small standalone local privilege escalation exploit consisting of one C source file and a minimal README. The main file, CVE-2026-31635.c, claims to target CVE-2026-31635 ('DirtyDecrypt'), described as a Linux kernel flaw involving a missing COW guard in rxgk_decrypt_skb(). The exploit is not part of a larger framework. Structure and behavior: the program starts in main(), checks that it is not already running as root, prints the kernel version using 'uname -r', and warns that the target system must support CONFIG_RXGK=y. It then creates new user and network namespaces using clone(CLONE_NEWUSER|CLONE_NEWNET). Inside the child namespace it writes to /proc/self/uid_map and /proc/self/setgroups, then sets up an AF_RXRPC socket and adds an RXGK key with description 'rxgk:127.0.0.1'. The socket is bound to loopback (127.0.0.1) using a sockaddr_rxrpc structure. Exploit capability: after setup, it loads /etc/passwd into page cache, reads its current contents, checks whether a 'dirtyroot' account already exists, and then attempts to append the hardcoded payload 'dirtyroot::0:0:root:/root:/bin/bash\n' one byte at a time by repeatedly calling trigger_decrypt(), which sends crafted data through sendmsg() on the AF_RXRPC socket. If verification succeeds, it reports success and attempts privilege use in two ways: first by invoking 'su dirtyroot -c 'whoami && exec /bin/bash'', then by directly trying setuid(0)/setgid(0) and execing interactive shells from common paths. Overall purpose: this is an operational local kernel LPE proof-of-concept with a built-in post-exploitation payload. It does not merely detect vulnerability; it attempts actual privilege escalation by modifying /etc/passwd and obtaining an interactive root shell. There are no external C2 endpoints or remote network targets beyond local loopback and kernel interfaces used to trigger the vulnerability.