copyfail-go-lpe

Fail

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: HIGHPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONPERSISTENCE
Full Analysis
  • [PRIVILEGE_ESCALATION]: The skill's primary function is to exploit a Linux kernel logic flaw (CVE-2026-31431) for local privilege escalation. It specifically targets the patching of the /usr/bin/su setuid binary to gain root access.
  • [EXTERNAL_DOWNLOADS]: The instructions direct the user to download pre-compiled exploit binaries from an unverified third-party GitHub repository (badsectorlabs/copyfail-go).
  • [REMOTE_CODE_EXECUTION]: The skill facilitates remote code execution by instructing the user to download, mark as executable (chmod +x), and run a binary from an untrusted source.
  • [COMMAND_EXECUTION]: The skill provides commands to modify system-level binaries and manipulate file metadata, such as using touch -r to restore the original modification time of a binary to evade detection.
  • [DYNAMIC_EXECUTION]: The skill includes instructions for installing build tools and compiling assembly shellcode payloads and the main Go exploit binary at runtime using nasm and goreleaser.
  • [PERSISTENCE]: The skill provides a 'Restore Script' and specific instructions to revert changes to the system binary after the exploit has succeeded, which is a tactic used to maintain a stealthy presence and avoid system breakage that would alert administrators.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 14, 2026, 10:36 AM