Sploitus

Exploit for Incorrect Authorization in Polkit Project Polkit

CVE-2021-3560

githubexploit · 2021-06-14

Exploit Code

README73 lines
## https://sploitus.com/exploit?id=FEA13486-D1C3-5F54-9DB3-54F8FC08811A
# CVE-2021-3560_PoC
polkit exploit script

Automated script for escalating to root using polkit service

# Requirements
- SSH server (this is to avoid having authentication popups through GNOME)
- Vulnerable Linux distribution:

  
    
      Distribution
      Vulnerable?
    
    
      RHEL 7
      No
    
    
      RHEL 8
      
        Yes
      
    
    
      Fedora 20 (or earlier)
      No
    
    
      Fedora 21 (or later)
      
        Yes
      
    
    
      Debian 10 (“buster”)
      No
    
    
      Debian testing (“bullseye”)
      
        Yes
      
    
    
      Ubuntu 18.04
      No
    
    
      Ubuntu 20.04
      
        Yes
      
    
  


# Usage Guide
```bash
ssh localhost
git clone https://github.com/tyleraharrison/CVE-2021-3560_PoC.git
cd CVE-2021-3560_PoC
./polkitRoot.sh
```

# Known Issues
- Solution to needing to brute-force is poorly written recursion
- Line-endings may need to be changed with `dos2unix polkitRoot.sh` because GitHub changed them to CRLF and Bash does not like that

Tested in Ubuntu 20.04

Reference: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/