{"uuid": "bfa3fc8f-b00f-4e89-87fa-0a25c5a0b7e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34918", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/110402", "content": "Black Hat Ethical Hacking\nFake PoC Exploit Targets Cybersecurity Researchers with Linux Malware\n\nFake PoC Exploit Targets Cybersecurity Researchers with Linux MalwarePost Views: 1,504 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a recent development, cybersecurity researchers and threat actors have become targets of a fake proof of concept (PoC) exploit, known as CVE-2023-35829, which installs a Linux password-stealing malware. This malicious PoC was discovered by Uptycs analysts during routine scans when anomalies such as unauthorized system access attempts, unexpected network connections, and unusual data transfers were flagged by detection systems.\n\nThe malicious PoC exploit was found in three repositories, with two already removed from GitHub while one still remains active. Uptycs reports that this fake PoC has been widely shared among members of the security research community, suggesting that numerous computers might have already been infected.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/github-repo.jpg A malicious GitHub repository pushing the malware (BleepingComputer) PoC DetailsThe deceptive PoC claims to be an exploit for CVE-2023-35829, a high-severity use-after-free vulnerability affecting the Linux kernel before version 6.3.2. However, upon closer inspection, it is revealed that the PoC is actually a copy of an old legitimate exploit targeting another Linux kernel vulnerability, CVE-2022-34918.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/poc-copy.png Code comparison between the two PoCs (Uptycs)\n\nThe malicious code takes advantage of Linux namespaces, a feature that partitions kernel resources, to create the illusion of a root shell while operating within the limitations of the user namespace. This tactic aims to deceive victims into believing that the exploit is genuine and functioning as expected, granting the attackers more time to freely navigate the compromised system.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Scams/3/fake-shell.png Code part for creating a fake shell (Uptycs)\n\nUpon execution, the PoC creates a \u2018kworker\u2019 file and adds its path to the \u2018/etc/bashrc\u2019 file for persistence. It then establishes communication with the attacker\u2019s command-and-control (C2) server to download and execute a Linux bash script from an external URL. This downloaded script gains unauthorized access to the system by modifying the \u2018/etc/passwd\u2019 file, granting the attacker remote access through unauthorized modifications to the \u2018~/.ssh/authorized_keys\u2019 file. The stolen data includes the victim\u2019s username, hostname, and contents of their home directory, which are exfiltrated using \u2018transfer.sh\u2019 via the curl command.\n\nTo evade detection, the bash script camouflages its operations as kernel-level processes, leveraging the trust placed in such entries by system administrators. This allows the attackers to navigate the compromised system undetected.\n\nUptycs advises researchers who have downloaded and utilized the fake PoC to take specific actions, including removing any unauthorized SSH keys, deleting the \u2018kworker\u2019 file, eliminating the \u2018kworker\u2019 path from the bashrc file, and checking \u2018/tmp/.iCE-unix.pid\u2019 for potential threats.\nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Recon Tool: Logsensor Extra caution when using downloaded PoCsIt is essential for researchers to exercise caution when using PoCs downloaded from the internet, preferably testing them in isolated environments like virtual machines and [...]", "creation_timestamp": "2026-09-04T11:00:04.801856Z"}