SCTPhantom

This five-file standalone C repository contains two Linux SCTP kernel vulnerability PoCs, plus a Makefile, README, and gitignore. The default Makefile target builds poc.c. The primary PoC creates an unprivileged user and network namespace, configures loopback and SCTP ASCONF sysctls, creates a local SCTP association, captures SCTP state needed for a valid forged packet, and injects a CRC32c-valid ASCONF sequence that adds and then removes the same peer address. The intended effect is a stale asoc->new_transport dereference after the transport has been removed, evidenced by a HEARTBEAT to the removed address. It is a trigger/UAF demonstration, not a privilege-escalation exploit. The separate acklock.c program builds a malformed ASCONF-ACK whose inconsistent parameter length handling causes SCTP response processing to repeatedly consume a zero length, resulting in a softirq CPU-denial-of-service condition. The README includes kernel-structure offsets and speculative post-UAF weaponization discussion, but the included code does not implement heap grooming, an information leak, indirect-call control, or an execution payload. Some serial-number guidance differs between README prose and poc.c comments, but both programs are clearly designed as local lab PoCs that forge raw SCTP traffic.

This repository is a small standalone local privilege escalation PoC centered on a single C source file, CVE-2026-64564.c, plus a README and license. It is not part of a larger exploit framework. The code targets CVE-2026-64564, a Linux kernel SCTP ASCONF DEL-IP use-after-free, and is explicitly tuned for Debian 13 with kernel 6.12.95+deb13-amd64 using hardcoded structure offsets. Repository structure: one main exploit source file (CVE-2026-64564.c), README.md with build/run guidance, LICENSE, and .gitignore. The README mentions an auxiliary server.c, but that file is not present in the repository, so the actual analyzed codebase contains only the exploit implementation. Exploit purpose and flow: the PoC creates local SCTP associations over loopback, triggers the vulnerable ASCONF DEL-IP path to free a transport object while leaving a dangling reference, then performs heap grooming/reclaim. It uses AF_PACKET sockets with PACKET_TX_RING to reclaim kmalloc-1024 allocations and also uses SCTP auth-key spraying to place attacker-controlled data into kernel heap objects. The code includes hardcoded offsets for SCTP transport/address-family/association structures and comments indicating Debian-specific BTF-derived offsets. The exploit then leaks kernel pointers to defeat KASLR, builds arbitrary read/write primitives or equivalent object corruption, and modifies credentials to gain root. Capabilities observed in code: local kernel UAF trigger, heap spraying/reclaim, kernel address leakage, KASLR bypass, credential corruption/privilege escalation, root verification by reading /etc/shadow, marker-file creation in /root, optional interactive root shell via /bin/sh, and a fallback /bin/sleep execution to preserve process state after exploitation. Diagnostic behavior is controlled through environment variables such as DIAGSZ, DIAG_SLEEP, SEND, and SHELL_. Attack surface: primarily local, but it abuses the kernel networking stack and SCTP protocol handling. The exploit uses loopback addresses 127.0.0.1 and 127.0.0.9 and SCTP-related socket options/constants including SCTP_AUTH_KEY and ASCONF/DEL-IP parameters. No external C2 or remote infrastructure is present. Overall, this is an operational standalone Linux kernel LPE exploit PoC with a real post-exploitation payload path (root shell / marker file), but it is highly version-specific rather than broadly weaponized.

Repository is a small standalone local privilege escalation PoC for CVE-2026-64564 ("SCTPhantom"), containing one C source file, a README, and a license. The README states the exploit targets a Linux kernel SCTP ASCONF DEL-IP use-after-free caused by mismatched validation and object selection during address deletion, and that this copy is a mirror of an upstream community PoC. The code is tailored to Debian 13 running kernel 6.12.95, with hardcoded structure offsets verified against that build. The main exploit file, lpe_debian.6.12.95.c, is a native C program implementing a full local kernel exploitation chain rather than mere detection. It uses SCTP sockets on loopback addresses and crafted ASCONF/DEL-IP behavior to trigger a use-after-free in SCTP transport handling. It then performs heap shaping and reclamation using AF_PACKET PACKET_TX_RING allocations and SCTP authentication-key allocations to reclaim freed kernel objects with attacker-controlled data. The README indicates the chain includes direct-map leakage, repeated 4-byte kernel reads, KASLR recovery via fixed IDT mapping, a second UAF reclamation with controlled SCTP auth-key objects, and a data-only path to commit_creds() for privilege escalation. Notable exploit capabilities visible in the code and README include: enabling/disabling /proc/sys/net/sctp/auth_enable to facilitate spraying, creating AF_PACKET packet sockets with PACKET_TX_RING for controlled page-backed allocations, creating SCTP sockets and setting SCTP_AUTH_KEY options for kmalloc-1024 object spraying, checking for successful root by reading /etc/shadow, writing a success marker to /root/SCTP_LPE_SUCCESS, and optionally spawning /bin/sh. The exploit is operational but environment-specific: it depends on a vulnerable Linux kernel with SCTP support and likely requires adaptation for kernels other than Debian 13 6.12.95 due to hardcoded offsets.

This repository is a compact local privilege escalation proof-of-concept for Debian 13 on kernel 6.12.95 targeting an SCTP ASCONF DEL-IP use-after-free in the Linux kernel. The repository contains only a README with build/run instructions and a single substantial C source file implementing the exploit. The exploit is not a remote exploit in the usual sense; it is a local kernel exploit that abuses networking subsystems. Its core capability is to obtain root privileges from an unprivileged local context by corrupting kernel memory associated with SCTP transport/address-family structures. The code uses AF_PACKET PACKET_TX_RING allocations as a heap-spray/reclamation primitive and SCTP authentication key allocations as another controlled kmalloc-1024 spray mechanism. It defines numerous hardcoded structure offsets for Debian 6.12.95, indicating the exploit is tightly version-specific and tuned to that kernel layout. Operationally, the exploit appears to: create SCTP sockets and associations on loopback-style addresses/ports; trigger the SCTP ASCONF DEL-IP bug to free a target object; reclaim freed memory with crafted packet ring pages and/or SCTP auth-key objects; forge or pivot kernel pointers/fields; and then use arbitrary read/write-style primitives or forged transport state to achieve credential-impacting behavior leading to root. The truncated code still clearly shows post-exploitation validation logic: it checks whether /etc/shadow can be read, writes /root/SCTP_LPE_SUCCESS, optionally spawns /bin/sh, and otherwise execs /bin/sleep 120. Repository structure: - README.md: minimal usage instructions (compile statically with gcc and run ./lpe). - lpe_debian.6.12.95.c: full exploit implementation, including heap spraying, SCTP socket manipulation, diagnostic environment-variable controls, exploitation logic, and post-exploitation actions. - .gitignore: standard C/build artifact exclusions. Notable indicators and behaviors include direct writes to /proc/sys/net/sctp/auth_enable, use of AF_PACKET and SCTP socket options such as PACKET_TX_RING and SCTP_AUTH_KEY, loopback endpoints 127.0.0.1:20000 and 127.0.0.9:20001, and privileged file access/creation used to confirm successful escalation. Overall, this is a real, version-targeted, operational local kernel LPE PoC rather than a scanner or detection script.