Arinerron/CVE-2022-0847-DirtyPipe-Exploit
FreeA root exploit for CVE-2022-0847 (Dirty Pipe)
FreeFree tier
About Arinerron/CVE-2022-0847-DirtyPipe-Exploit
Arinerron's modification of Max Kellermann's proof of concept for CVE-2022-0847 (Dirty Pipe), a Linux kernel vulnerability that allows overwriting data in arbitrary read-only files. This exploit specifically overwrites the root password field in /etc/passwd to grant a root shell, then restores the original passwd file. It is intended for educational and authorized security testing purposes.
Key Features
Exploits CVE-2022-0847 (Dirty Pipe) Linux kernel vulnerability
Overwrites root password field in /etc/passwd to spawn a root shell
Automatically restores original /etc/passwd after exploitation
Simple compilation with provided compile.sh script
Requires only GCC and a terminal
Pros & Cons
Pros
- Simple one-command exploitation after compilation
- Automatically restores the original /etc/passwd, minimizing system changes
- Based on a well-documented vulnerability with a public proof of concept
- Lightweight and easy to modify for other exploit scenarios
Cons
- Only works on Linux systems vulnerable to CVE-2022-0847 (patched since kernel 5.10.102, 5.15.25, 5.16.11)
- Requires GCC to compile the exploit on the target (or precompiled binary)
- Must be run from a terminal (ssh or local access)
- Potential for system instability if not used carefully (restoration step required)
- Intended for legal, authorized use only; misuse may be illegal
Best For
Penetration testing and security assessments on vulnerable Linux systemsCapture The Flag (CTF) challenges requiring privilege escalationDemonstrating the impact of the Dirty Pipe vulnerability in controlled environmentsEducational purposes to understand kernel exploitation techniques
FAQ
How do I compile and run this exploit?
Compile using `./compile.sh` (assumes GCC is installed), then run `./exploit` to spawn a root shell.
What does the exploit do?
It overwrites the root password field in /etc/passwd to a known value ('aaron'), allowing you to log in as root with that password. After obtaining a root shell, it restores the original /etc/passwd from a backup.
What if I get 'su: must be run from a terminal'?
If you receive that error, log in as root with password 'aaron', then restore /etc/passwd by running `mv /tmp/passwd.bak /etc/passwd`.
Is the original vulnerability author credited?
Yes. The creator states they do not claim credit for finding the vulnerability or writing the original PoC; it is a modification of Max Kellermann's proof of concept.