copyfail-go-lpe
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: HIGHPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONPERSISTENCE
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill's primary function is to exploit a Linux kernel logic flaw (CVE-2026-31431) for local privilege escalation. It specifically targets the patching of the
/usr/bin/susetuid binary to gain root access. - [EXTERNAL_DOWNLOADS]: The instructions direct the user to download pre-compiled exploit binaries from an unverified third-party GitHub repository (
badsectorlabs/copyfail-go). - [REMOTE_CODE_EXECUTION]: The skill facilitates remote code execution by instructing the user to download, mark as executable (
chmod +x), and run a binary from an untrusted source. - [COMMAND_EXECUTION]: The skill provides commands to modify system-level binaries and manipulate file metadata, such as using
touch -rto restore the original modification time of a binary to evade detection. - [DYNAMIC_EXECUTION]: The skill includes instructions for installing build tools and compiling assembly shellcode payloads and the main Go exploit binary at runtime using
nasmandgoreleaser. - [PERSISTENCE]: The skill provides a 'Restore Script' and specific instructions to revert changes to the system binary after the exploit has succeeded, which is a tactic used to maintain a stealthy presence and avoid system breakage that would alert administrators.
Recommendations
- AI detected serious security threats
Audit Metadata