Following the recent disclosure of a , either the , and . Since Kali is based on Debian, and liblzma only depends on the libc, it’s Ok to install the Debian package in Kali, we shouldn’t run into any incompatibility issue.
A note for clarity: xz-utils is the name of the upstream repository, it provides the well-known command xz to compress and decompress files, but it also provides the library liblzma , which is the compromised library that everyone is talking about at the moment. We only need this library.
The upstream versions 5.6.0 and 5.6.1 are known to contain the backdoor, so let’s grab the Debian package 5.6.1-1.
Within the VM, let’s open a terminal and get it with:
kali@kali:~$ wget https://snapshot.debian.org/archive/debian/20240328T025657Z/pool/main/x/xz-utils/liblzma5_5.6.1-1_amd64.deb
And now let’s install the package:
A word of caution for those who are not paying attention: below, we are purposefully installing a package that contains a backdoor! Obviously you are running those steps in a Virtual Machine, and this Virtual Machine is not exposed to the Internet.
kali@kali:~$ sudo apt-get install --allow-downgrades --yes ./liblzma5_5.6.1-1_amd64.deb
Next step is to start (or restart) the SSH daemon:
kali@kali:~$ sudo systemctl restart ssh
What’s next? Let’s find out!
Confirm that liblzma is compromised
First, we can detect if the version of liblzma contains the backdoor, thanks to a script from Vegard Nossum, that was . All the credits (massive credits actually) go to Andres Freund for the fantastic work and detailed report, and Vegard Nossum for the detect.sh script.
SOCIAL SHARE CARD GENERATOR