关联漏洞
标题：
polkit 代码问题漏洞
(CVE-2021-3560)
描述：polkit是一个在类 Unix操作系统中控制系统范围权限的组件。通过定义和审核权限规则，实现不同优先级进程间的通讯。 polkit 存在代码问题漏洞，该漏洞源于当请求进程在调用polkit_system_bus_name_get_creds_sync之前断开与dbus-daemon的连接时，该进程无法获得进程的唯一uid和pid，也无法验证请求进程的特权。
描述
Exploitation Script for CVE-2021-3560
介绍
# CVE-2021-3560 Exploit Script
This script exploits CVE-2021-3560, a vulnerability in polkit that allows privilege escalation to root.
## Usage
After cloning the repository, grant execution permissions and run the script:
```bash
chmod +x exploit.sh
./exploit.sh
```
## Expected Outcome
After running the script, a new user will be created with root privileges. You can log in using the credentials specified in the script:
```
ROOT_USER="john"
ROOT_PASS="john@123"
```
### Example Login
```bash
su john
Password: john@123
sudo su
whoami
root
```
## Disclaimer
This exploit is provided for educational purposes only. Use it responsibly and only on systems you have explicit permission to test. Unauthorized access to systems is illegal and punishable under law.
## References
- [CVE-2021-3560 Details](https://nvd.nist.gov/vuln/detail/CVE-2021-3560)
- [Privilege escalation with polkit: How to get root on Linux with a seven-year-old bug](https://github.blog/security/vulnerability-research/privilege-escalation-polkit-root-on-linux-with-bug/)
文件快照
[4.0K] /data/pocs/7999ccd1140aa2657fb353582476c35de8c73f37
├── [3.0K] exploit.sh
└── [1.0K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。