D-Bus Authentication Bypass

CVE-2021-3560

Theory

The vulnerability can be boiled down to these steps:

1. The attacker manually sends a dbus message to the accounts-daemon requesting the creation of a new account with sudo permissions (or latterly, a password to be set for the new user). This message gets given a unique ID by the dbus-daemon.

2. The attacker kills the message after polkit receives it, but before polkit has a chance to process the message. This effectively destroys the unique message ID.

3. Polkit asks the dbus-daemon for the user ID of the user who sent the message, referencing the (now deleted) message ID.

4. The dbus-daemon can't find the message ID because we killed it in step two. It handles the error by responding with an error code.

5. Polkit mishandles the error and substitutes in 0 for the user ID -- i.e. the root account of the machine.

6. Thinking that the root user requested the action, polkit allows the request to go through unchallenged.

In short, by destroying the message ID before the dbus-daemon has a chance to give polkit the correct ID, we exploit the poor error-handling in polkit to trick the utility into thinking that the request was made by the all-powerful root user. - TryHackMe

See the full vulnerability explain on the official Kevin Backhouse article.

Practice

Enumeration

Many of the most popular Linux distributions didn’t ship the vulnerable version until more recently. You may run Polkit exploit on the following targets:

• RHEL 8

• Fedora 21 (or later)

• Debian testing (“bullseye”)

• Ubuntu 20.04

• LTS ("Focal Fossa")

Others may also be vulnerables if you find that the installed polkit package is vulnerable. Affected versions are 0.113 (or later) for rhel,centos,fedora and 0.105-26 for Debian/Ubuntu

#Debian/Ubuntu
apt list --installed | grep policykit-1
dpkg -l | grep -i polkit|grep -i "0.105-26"

#RHEL/CentOs/Fedora
rpm -qa | grep -i polkit|grep -i '0.11[3-9]'

Additionally, This exploit works only on distributions that have installed accountsservice and gnome-control-center

#Debian/Ubuntu
dpkg -l  | grep -i 'accountsservice'
dpkg -l  | grep -i 'gnome-control-center'

#RHEL/CentOs/Fedora
rpm -qa  | grep -i 'accountsservice'
rpm -qa  | grep -i 'gnome-control-center'

Manual Exploit

Auto Exploit

Ressource

Privilege escalation with polkit: How to get root on Linux with a seven-year-old bugThe GitHub Blog

https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/polkit-privilege-escalation/#cve-2021-3560exploit-notes.hdks.org

Polkit: CVE-2021-3560TryHackMe