Alibabacloud Ecs Sec Kernel

# 从 skill 根目录执行：

# 需要 root 权限（sudo）

# 全量检测与 PoC 验证（默认对所有 enabled 的 CVE 执行 PoC）
sudo python3 -m scripts --verbose

# 单 CVE 验证
sudo python3 -m scripts --cve-id CVE-2026-31431 -v

# 列出所有检测器（无需 root）
python3 -m scripts --list-detectors

# 自动编译缺失的 PoC 二进制
sudo python3 -m scripts --compile-poc -v

# 输出 JSON 格式报告
sudo python3 -m scripts --format json -v

==============================================================
  sec-kernel v1.4.1 - Linux Kernel CVE Detection
==============================================================
  Kernel: 5.15.0-91-generic (x86_64)
  Mode: host (Linux Server)
==============================================================

==============================================================
  Detection Summary
==============================================================
  Total CVEs checked:     88
  Vulnerable:             3
  Not Vulnerable:         80
  Uncertain:              2
  PoC Exploitable:        2
  Execution time:         45.32s
==============================================================

================================================================
  sec-kernel PoC Execution Statistics
================================================================
  Total Detectors:     88    (with PoC capability)
  PoC Executed:        83
  ------------------------------------------------------------
  SUCCESS (ran correctly):     78
    +- EXPLOITABLE:            2   (vulnerability confirmed)
    +- NOT_EXPLOITABLE:        76  (kernel patched/mitigated)
  ------------------------------------------------------------
  FAILED (execution error):    5
    +- TIMEOUT:                2
    +- CRASH:                  1
    +- MISSING_BIN:            0
    +- PARSE_ERROR:            2
    +- PERMISSION:             0
  ------------------------------------------------------------
  SKIPPED:                     2
    +- NO_MODULE:              2
  ------------------------------------------------------------
  Execution Time:         45.32s
================================================================

⚠️  SECURITY DISCLAIMER / 安全声明
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
本工具仅限在已授权的隔离测试环境中使用。
严禁用于生产环境或未授权系统。违规使用需承担全部法律责任。
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

[Phase 1: Prepare] (root)
  ✓ Loaded kernel module: algif_aead
  ✓ Created target file: /tmp/sec-kernel-poc-XXXX/poc_target (root:root 0644)
  ✓ Initial content: writeme_a3f8b2c1

[Phase 2: Run] (nobody, uid=65534)
  CTF_READ_BEFORE:writeme_a3f8b2c1
  CTF_WRITE:ctf{164d74cd804f9361} (attempting...)
  CTF_READ_AFTER:ctf{164d74cd804f9361}
  CTF_FLAG:ctf{164d74cd804f9361}
  POC_RESULT:EXPLOITABLE

[Phase 3: Post] (root)
  ✓ File content verified: ctf{164d74cd804f9361} ✓ MATCH
  ✓ Cleanup completed
  ✓ System state restored

[RESULT] CVE-2026-31431: EXPLOITABLE (confidence=0.95)

[Phase 1: Prepare] (root)
  Created CTF target: /tmp/sec-kernel-poc-XXXX/poc_target_canary
  mode=write_root_file, uid=0, perm=644
  Initial content: writeme_f9de12afe0d6da5a

[Phase 2: Run] (nobody, uid=65534)
  CTF_WRITE:ctf{dddb28301f24e3db} (attempting...)
  CTF_FLAG:ctf{dddb28301f24e3db}
  POC_RESULT:EXPLOITABLE

[Phase 3: Post] (root)
  CTF write_root_file PASSED: inner value matches (dddb28301f24e3db)
  Rollback executed: target file removed
  System state restored

[RESULT] CVE-2026-31431: EXPLOITABLE (confidence=0.95)
  Kernel: 6.6.87.2-microsoft-standard-WSL2
  Exploit path: AF_ALG AEAD authencesn + splice() -> page cache corruption

[Phase 1: Prepare] (root)
  Created CTF target: /tmp/sec-kernel-poc-XXXX/poc_target_dirtyfrag
  mode=write_root_file, uid=0, perm=644, size=4096
  Module state snapshot: esp4=loaded

[Phase 2: Run] (nobody, uid=65534)
  CTF_WRITE:ctf{ab2084cd52cdad11} (attempting via rxrpc/rxkad...)
  RxRPC variant failed (EAFNOSUPPORT), trying ESP/xfrm fallback...
  CTF_WRITE:ctf{ab2084cd52cdad11} (attempting via esp/xfrm fallback...)
  CTF_FLAG:ctf{ab2084cd52cdad11}
  POC_RESULT:EXPLOITABLE

[Phase 3: Post] (root)
  CTF write_root_file PASSED: inner value matches (ab2084cd52cdad11)
  Rollback executed: target file removed
  System state restored

[RESULT] CVE-2026-PENDING-DIRTYFRAG: EXPLOITABLE (confidence=0.95)
  Kernel: 6.6.87.2-microsoft-standard-WSL2
  Exploit path: ESP/xfrm variant (RxRPC fallback) -> splice() page cache write
  Dual-variant: RxRPC (Ubuntu 24.04) / ESP (WSL2) automatic fallback

Phase 1 (root):   准备环境 — 加载模块、创建目标文件、记录初始状态
Phase 2 (nobody): 执行 PoC — 读原值 → 漏洞利用写入 → 读回验证
Phase 3 (root):   验证清理 — 独立确认写入结果、恢复系统状态