Privilege Escalation in Pardus Update

This repository is a small standalone Python proof-of-concept exploit for CVE-2026-6508 / CVE-2026-6509 affecting the LiderAhenk/Ahenk management ecosystem. The repo contains only three files: a GPL license, a README describing the vulnerability and exploitation workflow, and a single executable script (main.py). The exploit is not part of a larger framework. The core capability is unauthorized remote code execution over the existing XMPP management channel. The script logs into the XMPP server using valid client credentials, disables TLS requirements, allows plaintext authentication, and sends a crafted XMPP 'normal' message containing JSON with type 'EXECUTE_SCRIPT' and an attacker-controlled command. The target is another agent JID. According to the README, the vulnerable Ahenk agent processes incoming messages based only on the JSON 'type' field and does not verify that the sender is the legitimate management server account. Because the agent service runs as root, the supplied command executes with root privileges, enabling lateral movement from one managed client to another. main.py is the only code file and the clear entry point. It reads runtime parameters from environment variables: AHENK_USER, AHENK_PASS, AHENK_HOST, AHENK_PORT, AHENK_TARGET, and AHENK_COMMAND. Defaults are populated with example credentials and infrastructure values from the README. The Sender class subclasses slixmpp.ClientXMPP, connects to the XMPP server, sends presence, fetches roster, builds the malicious JSON payload, sends it to the target JID, waits briefly, and disconnects. The default payload creates /tmp/ct2_to_ct1_poc on the victim as a benign proof of execution. The README provides important operational context: attackers first obtain XMPP connection details from /etc/ahenk/ahenk.conf on a compromised client, then customize the exploit to target another agent on the same XMPP infrastructure. It also cites the likely vulnerable code paths in messenger.py and execution_manager.py and proposes a sender-validation fix. Overall, this is a real operational PoC exploit for authenticated lateral movement and RCE in an XMPP-based endpoint management environment, not merely a detector or advisory.