below-log-race-poc CVE-2025-27591 Exploit (Below privilege escalation)

Description

This repository contains a proof-of-concept exploit for CVE-2025-27591, a privilege escalation vulnerability in the below utility.
The issue arises because below mishandles log files under /var/log/below/, allowing attackers to replace logs with symlinks to sensitive files such as /etc/passwd.
By leveraging this, an unprivileged user can inject a new root user entry and escalate privileges.

Exploit Script

The exploit is implemented as a simple Bash script (exploit_CVE-2025-27591.sh) which:

1. Backs up the original /etc/passwd.
2. Creates a malicious symlink from /var/log/below/error_root.log to /etc/passwd.
3. Runs below in a loop until /etc/passwd becomes writable.
4. Injects a new root-level user (root2, password: 1).
5. Provides interactive root shell access with su - root2.

Usage

chmod +x exploit_CVE-2025-27591.sh
./exploit_CVE-2025-27591.sh
su - root2   # password: 1