DirtyPipe (CVE-2022-0847)

./exploit /etc/passwd 1 'ootkit:$1$xxx$abc:0:0:root:/root:/bin/bash\n'

Exploits CVE-2022-0847 (DirtyPipe): a pipe vulnerability in kernels 5.8 to 5.16.x that allows overwriting the content of read-only files, including /etc/passwd, without write permissions. Result: a user entry with UID 0 in passwd.

When the host runs a vulnerable kernel (>= 5.8 and < 5.16.11, < 5.15.25 or < 5.10.102) and you lack configuration vectors. The exploit injects a new line into /etc/passwd with a hash you control: with it + 'su ootkit' you are already root. It is fast and requires no interaction.

If the kernel is patched or older than 5.8, it won't work. Also avoid it on systems with /etc/passwd on read-only filesystems mounted by the kernel (not overlayfs) or with SELinux enforcing that blocks writing: a failed exploit can leave passwd corrupted mid-way.