CIFSwitch: Linux SMB/CIFS Client cifs.spnego Provenance Validation Flaw

This repository is a standalone Go local privilege escalation exploit, not tied to a common exploit framework. It contains 6 files: README.md, go.mod, and three code files (main.go, nss.go, trigger.go). The code implements a Go port of the CIFSwitch technique abusing Linux kernel keyring handling for cifs.spnego together with cifs-utils' cifs.upcall behavior. Repository structure and purpose: main.go is the primary entry point and orchestration logic. It performs environment checks, determines the current username, verifies prerequisites (gcc, unshare, sudo, mount, /usr/sbin/cifs.upcall, active request-key rule, user namespaces, loaded CIFS module), compiles the malicious NSS library, writes a fake nsswitch.conf, launches the namespace-isolated trigger stage, checks evidence of successful code execution as root, and finally invokes sudo -n /bin/bash -p for a root shell. nss.go contains the embedded C source template for libnss_pwn.so.2 and the helper functions that compile it and generate the fake nsswitch.conf. The malicious NSS module uses a constructor that executes immediately on dlopen(), writes an evidence log, attempts to create a passwordless sudoers entry under /etc/sudoers.d/, and if that fails, creates a setuid-root copy of /bin/bash in /var/tmp. trigger.go handles the namespace setup and exploit trigger: it re-execs the binary inside a new user and mount namespace, makes mounts private, optionally triggers CIFS module autoload via a dummy mount, masks nscd cache directories, bind-mounts the fake nsswitch.conf over /etc/nsswitch.conf or /usr/etc/nsswitch.conf, overlays attacker-controlled NSS library directories over system NSS library paths, and finally issues a forged request_key syscall for key type cifs.spnego with upcall_target=app and pid=<self>. Main exploit capability: local root privilege escalation. The exploit abuses the fact that cifs.upcall, started as root by request-key, can be induced to switch into the attacker's mount namespace before NSS lookups and before dropping privileges. By controlling nsswitch.conf and the NSS library search path inside that namespace, the attacker causes root to load libnss_pwn.so.2, whose constructor performs privileged file writes. The intended result is a passwordless sudoers rule for the current user, followed by execution of a root bash shell. A fallback path creates a setuid-root shell if direct sudoers creation fails. This is clearly an operational exploit rather than a detector: it contains full exploitation logic, runtime payload generation, namespace manipulation, syscall wrappers for request_key and keyctl, and post-exploitation steps to obtain an interactive root shell.