Implement DirtyFrag and DirtyPipe exploit modules

[halilkirazkaya]

---

Overview

This PR adds two new Privilege Escalation modules to Penelope's module system, following the same upload pattern as existing modules (e.g., ligolo, traitor, ghostpack).

---

New Modules

dirtyfrag — Universal Linux LPE

• CVE-2026-43284: xfrm-ESP Page-Cache Write
• CVE-2026-43500: RxRPC Page-Cache Write
• Source: https://github.com/v4bel/dirtyfrag
• Downloads the full repository as a dirtyfrag/ folder on the target.
• Deterministic logic bug — no race condition required, no kernel panic on failure. Chains two page-cache write primitives to cover each other's blind spots (e.g., Ubuntu with AppArmor + systems without rxrpc.ko), achieving reliable root on virtually all major Linux distributions (Ubuntu, RHEL, Fedora, openSUSE, CentOS Stream, AlmaLinux, etc.).

dirtypipe — Linux Pipe Privilege Escalation

• CVE-2022-0847
• Source: https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits
• Downloads the full repository as a dirtypipe/ folder on the target, including exploit-1.c, exploit-2.c, and compile.sh.

---

Usage

(Penelope)─(Session [1])> run dirtyfrag
(Penelope)─(Session [1])> run dirtypipe

After upload, compile on the target with:

# DirtyFrag
cd tmp/dirtyfrag && gcc -O0 -Wall -o exp exp.c -lutil && ./exp

# DirtyPipe
cd tmp/dirtypipe && gcc exploit-1.c -o exploit-1 && ./exploit-1

---

Testing

Both modules were tested against the TryHackMe — Dirty Pipe room, which provides a vulnerable Linux environment ideal for verifying CVE-2022-0847. Notably, the same machine is also susceptible to the DirtyFrag vulnerability chain, making it a convenient single target for testing both modules end-to-end.

---

[brightio]

Good job @halilkirazkaya !

[brightio]

@halilkirazkaya regarding https://github.com/v4bel/dirtyfrag I will modify the module to upload only the .c file. is there any problem with that?

[halilkirazkaya]

@halilkirazkaya regarding https://github.com/v4bel/dirtyfrag I will modify the module to upload only the .c file. is there any problem with that?

No, there is no problem with that; it might even be better.