Local Privilege Escalation in ABRT abrt-hook-ccpp

This is a small standalone Python 3 local-privilege-escalation repository: one primary executable (CVE-2015-5287.py), README, license, and .gitignore. The Python script targets CVE-2015-5287 as an abrt/sosreport issue on RHEL 7.0/7.1. It implements a local race/path-manipulation technique: it creates sosreport log-file symlinks to /proc/sys/kernel/modprobe, replaces selected temporary files with references to /tmp/hax.sh, waits for sosreport processing to set the modprobe helper, and invokes a trigger routine once that setting contains the attacker path. The generated helper script is intended to execute with root privileges. Unlike a minimal PoC, the script includes argparse-based operational controls, timeout/check-only/verbosity modes, cleanup/error handling, and selectable payloads. The visible payload definitions include SUID /bin/sh and /bin/bash copies, an operator-configured Python TCP reverse shell, and a sudo-enabled backdoor account; help text additionally advertises root SSH-key, protection-disabling, and custom-command payloads. No hard-coded command-and-control host is present: reverse-shell destination is supplied at runtime. The README is partly generic and includes a separate external curl-and-execute recommendation unrelated to the local exploit; that URL should be treated as an independent supply-chain risk rather than an exploit prerequisite.

This repository contains a single Metasploit module (modules/exploits/linux/local/abrt_sosreport_priv_esc.rb) that exploits a local privilege escalation vulnerability (CVE-2015-5287) in the Automatic Bug Reporting Tool (ABRT) on Red Hat Enterprise Linux (RHEL) 7 systems. The exploit leverages an insecure temporary directory usage in the 'sosreport' tool, allowing a local attacker to perform a symlink attack and overwrite the kernel's modprobe path. This results in the execution of an attacker-controlled payload as root. The module checks for the presence of a vulnerable ABRT version, ensures the abrt-ccpp service is running, and requires Python to be installed on the target. The exploit is operational and allows the attacker to execute arbitrary code as root, depending on the payload selected. The main endpoints involved are system file paths related to ABRT and modprobe. The repository is structured as a standard Metasploit module and is intended for use within the Metasploit Framework.