ptrace_traceme: working CVE-2019-13272 exploit — lands real root (x86_64)

The bundled sequence had the mechanism backwards (it PTRACE_ATTACHed the
now-root parent) and never rooted anything. Replaced it with the proven Jann
Horn (Project Zero #1903) / bcoles technique:

  - a "middle" process execs setuid pkexec (euid 0 for a window);
  - its child spins until it sees middle is euid 0, calls PTRACE_TRACEME
    (recording middle's ROOT creds as ptracer_cred — the bug), then execs
    pkexec itself. The traced setuid exec is NOT degraded because ptracer_cred
    is root, so the child becomes real root, still traced;
  - staged execveat() self-re-exec injects the payload as root.

The staged self-re-exec needs the exploit to exist as its own binary with an
argv[0] stage dispatcher, so the proven PoC is embedded verbatim
(ptrace_helper_src.h — only spawn_shell() changed, to plant a root-owned proof
+ setuid bash instead of only an interactive shell), compiled on the target at
runtime with unique -DSK_PROOF/-DSK_ROOTBASH paths, run, and verified by
stat()'ing the root-owned artifacts (never self-report).

Verified out-of-band on Ubuntu 18.04.0 / 4.15.0-50: `skeletonkey --exploit
ptrace_traceme` as uid 1000 -> EXPLOIT_OK + a -rwsr-xr-x root:root bash.
Real-world precondition, honestly reported: pkexec must authorize an
auto-discovered implicit-active=yes helper, which needs an active local session
(desktop) or a permissive polkit policy; over inactive ssh it returns "Not
authorized" and the module reports EXPLOIT_FAIL with that diagnosis. Gated on a
C compiler + pkexec; x86_64 only (register-level injection). cleanup() removes
the artifacts. Unit harness green (33 + 115).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y

docs/EXPLOITED.md

@@ -29,6 +29,7 @@ tamper check).
 | `sudo_runas_neg1` | CVE-2019-14287 | Ubuntu 18.04.2 / sudo 1.8.21p2 + sudoers `(ALL,!root)` | `sudo -u#-1` → uid 0 |
 | `sudoedit_editor` | CVE-2023-22809 | Ubuntu 22.04.0 / sudo 1.9.9 + sudoers `sudoedit` grant | **after 2 fixes** — `chdir("/")` + helper basename match; `su skel` → uid 0 |
 | `sudo_host` | CVE-2025-32462 | Ubuntu 22.04.0 / sudo 1.9.9 + host-restricted sudoers rule | works as shipped; `sudo -h <host>` → uid 0 (needs a host-scoped rule + resolvable host) |
+| `ptrace_traceme` | CVE-2019-13272 | Ubuntu 18.04.0 / 4.15.0-50 + pkexec + active-session polkit | **after a full rewrite** — `skeletonkey --exploit ptrace_traceme` (uid 1000) → root-owned setuid bash. See below |
 
 ## Fixed this session
 
@@ -36,12 +37,27 @@ tamper check).
   open converter … to PWNKIT"). Root cause: missing the `GCONV_PATH=.`
   re-injection directory + `chdir(workdir)`. Fixed → now lands real root on a
   vulnerable host. (commit `24b839e`)
-- **`ptrace_traceme`** — reported `EXPLOIT_OK` but did **not** root; the bundled
-  ptrace sequence is a non-working placeholder (it `PTRACE_ATTACH`es to the
-  tracer, which by then has reparented to init → `EPERM`). Made **honest**
-  (verifies `euid==0`, otherwise `EXPLOIT_FAIL`); a faithful CVE-2019-13272 port
-  (Jann Horn / bcoles: `PTRACE_TRACEME` + setuid execve + registered polkit
-  agent) is still required to land root. (commit `59cc2be`)
+- **`ptrace_traceme`** (CVE-2019-13272) — first made **honest** (it had reported a
+  false `EXPLOIT_OK` with a placeholder that had the mechanism *backwards* —
+  attaching to the parent), then **rewritten and now lands real root** (uid=0
+  witnessed out-of-band on Ubuntu 18.04.0 / 4.15.0-50). The correct mechanism is
+  the reverse of the old placeholder: a *middle* process execs setuid `pkexec`
+  (euid 0 for a window); its *child* spins until it sees that euid-0, calls
+  `PTRACE_TRACEME` (recording the parent's **root** creds as its ptracer_cred —
+  the bug), then execs `pkexec` itself — the traced setuid exec is **not
+  degraded** because ptracer_cred is root, so the child becomes real root, and a
+  staged `execveat()` self-re-exec injects the payload. Ported the proven Jann
+  Horn / bcoles PoC verbatim (only `spawn_shell()` changed, to plant a root-owned
+  proof + setuid bash), embedded as `ptrace_helper_src.h`, compiled on the target
+  at runtime with unique `-DSK_PROOF/-DSK_ROOTBASH` paths, run, and verified by
+  `stat()`-ing the root-owned artifacts. **Real-world precondition** (honestly
+  reported): pkexec must *authorize* an auto-discovered `implicit-active=yes`
+  helper, which needs an **active local session** (desktop) or an equivalently
+  permissive polkit policy; over a bare *inactive* ssh session pkexec returns
+  "Not authorized" and the module reports `EXPLOIT_FAIL` with that diagnosis. On
+  the headless VM this was isolated with a permissive `pkla` for the backlight
+  helper action — the kernel bug and the whole technique are confirmed; the gate
+  is polkit, not the exploit.
 - **`overlayfs_setuid`** (CVE-2023-0386) — **rewritten and now lands real root**
   (uid=0 witnessed out-of-band on Ubuntu 22.04.0 / 5.15.0-25). The shipped
   module used a bogus `chown`-the-merged-view technique that never worked. The
@@ -78,7 +94,6 @@ tamper check).
 
 | module | CVE | target tested | what's wrong |
 |---|---|---|---|
-| `ptrace_traceme` | CVE-2019-13272 | Ubuntu 18.04.2 / 4.15.0-50 | placeholder technique (now honest); needs the real cred-transfer PoC (polkit agent) — substantial port |
 | `overlayfs_setuid` | CVE-2023-0386 | Ubuntu 22.04.0 / 5.15.0-25.25 | **Kernel confirmed vulnerable empirically** — the upstream PoC (xkaneiki, libfuse) pops root here (`uid=0(root)`, root-owned witness). The working technique: mount a FUSE fs exporting `/file` (st_uid=0, mode 04777) in the **init ns** via the setuid `fusermount3` helper, then overlay-in-userns with that FUSE lowerdir + copy-up. My module's non-FUSE `chown` variant yields `upper/file` uid=1000 (no escalation); mounting FUSE **inside** the userns → overlay `ENOSYS`. Attempted a self-contained **raw `/dev/fuse`** port: got the `fusermount` fd-passing handshake (`SCM_RIGHTS`) + mount working, but the server hits `EINVAL` on `read()` after `FUSE_INIT` (non-blocking fd → needs `poll()`), and even with poll/buffer fixes the raw server serving was flaky and repeatedly **wedged/rebooted the VM** — i.e. the raw protocol reimplementation is fragile and can destabilise the target, which is *worse* for the corpus than a lib dependency. **Conclusion: use libfuse** (proven, robust; matches the `pack2theroot` conditional-lib precedent). Port is scoped and ready; needs a clean session to implement + verify. |
 | `sudo_samedit` | CVE-2021-3156 | Ubuntu 18.04.2 + 20.04.0 | honest `EXPLOIT_FAIL`; Baron Samedit is heap/libc-version-specific, needs a per-target tuned PoC. Hardest. |