0xdea/ttyinject-rs

ttyinject-rs is a Rust rewrite of an existing tool called ttyinject, created by the author as a learning exercise while porting it from its original language to Rust. It demonstrates a long-standing quirk in the Linux kernel involving a terminal control command called TIOCSTI, which can be used to inject keystrokes into another terminal session. The README explains the exact scenario it targets: on a Linux system, a non-privileged user can end up gaining root access if the root user switches into that non-privileged account using the command su minus user. This works because switching in that way does not create a new terminal for the session, which leaves an opening for the non-privileged user to inject commands into the root user's own shell prompt using the TIOCSTI mechanism. Those injected commands copy a shell program to a temporary location and mark it so it runs with elevated privileges, then the tool deletes itself after running once from the user's shell startup file. To use it, the tool is placed inside a specific configuration folder and referenced from the user's .bashrc startup file, either by downloading a prebuilt binary from the project's releases or by building it from source using Rust's Cargo tool. Once root switches into the affected user account, the previously placed program can be used to obtain a root shell. The author notes that cleanup afterward requires manually removing the modified .bashrc line and the temporary elevated file, since the tool only runs and deletes itself once. The README documents that this was tested on a specific version of Ubuntu Linux with a related kernel setting explicitly turned on, and notes that since a certain Linux kernel version, this technique may be blocked unless that setting is enabled or unless the user already has a specific elevated capability. Credit for the original technique and tool is given to its original creator, and the project lists a changelog and a planned future feature to support custom arguments.