CVE-2021-3560 PoC — polkit 代码问题漏洞

Source

Associated Vulnerability

Title:polkit 代码问题漏洞 (CVE-2021-3560)
Description:It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Description

CVE-2021-3560 Local PrivEsc Exploit

Readme

# polkadots
## CVE-2021-3560 Local PrivEsc Exploit

##### This exploit creates a new privileged user with which you can escalate to root.
\
Affected Distributions:
* RHEL 8
* Fedora 21
* Debian testing (Bullseye)
* Ubuntu 20.04

### Usage

    ./polkadots -a [Account] -n [Account name] -h [Password hash] -i [iterations]
		     Generate hashed passwords with: openssl passwd -6 password@123

    Defaults:
        -a boris
        -n Boris Ivanovich Grishenko
        -h $6$cGKhfu9znRnOQV1h$2j/3WKyqTcCaftP1PGhW8Pghj2qV5j8zwy1gHrt9eILUE6WKeWVCTa9QgkskIfwVXpjVI.TuX2D.rEkbwKubi/
        -i 20
  
#### Discovered By: Kevin Backhouse
#### Source: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!