Bash-CVE-2021-3560

POC Bash -- CVE-2021-3560 Polkit Local Privilege Escalation Exploit

This repository provides a ** bash exploit** for CVE-2021-3560, a local privilege escalation vulnerability in polkit affecting many modern Linux distributions. !!!!!! Under test may cause instability !!!!!

💥 Vulnerability Summary

Discovered by Kevin Backhouse, this vulnerability allows an unprivileged user to create accounts with administrative privileges via the dbus interface, by racing the polkit authorization check.

• Vulnerable package: polkit <= 0.119
• CVE ID: CVE-2021-3560
• Impact: Local Privilege Escalation (no authentication required)
• CVSS: 7.8 (High)

📰 Original write-up by Kevin Backhouse (GitHub)

🚀 Exploit Features

• Clean and readable bash script
• Configurable delay loop for race condition
• Stops after a defined number of failed attempts
• Silent execution (suppresses command spam)
• Automatically sets password for the new user

🔧 Usage

chmod +x exploit3560.sh
./exploit3560.sh