polkit-auto-exploit

polkit-auto-exploit Automatic Explotation PoC for Polkit CVE-2021-3560 Summary CVE-2021-3560 is an authentication bypass on polkit, which allows unprivileged user to call privileged methods using DBus, in this exploit we will call 2 privileged methods provided by accountsservice CreateUser and...

CVE-2021-3560

CVE-2021-3560 a reliable C based exploit for CVE-2021-3560. Summary: Yestreday i stumbled upon this blog post by Kevin Backhouse discovered this vulnerability, i tried the bash commands provided in the blogpost and to my surpise it worked on my Kali Linux box! CVE-2021-3560 is an authentication...

CVE-2021-3560-Polkit-Privilege-Esclation

CVE-2021-3560-Polkit-Privilege-Esclation PoC Original research by Kevin Backhouse This is just a Bash PoC script, that automates the exploitation steps mentioned in Kevin Backhouse's blog. Read his post on this vulnerability:...

Polkit-exploit

Polkit-exploit - CVE-2021-3560 Privilege escalation with polkit - CVE-2021-3560 Summary CVE-2021-3560 is an authentication bypass on polkit, which allows unprivileged user to call privileged methods using DBus, in this exploit we will call 2 privileged methods provided by accountsservice CreateUs...

CVE-2021-3560-PolkitPrivilegeEsclation

CVE-2021-3560-Polkit-权限提升 PoC 原始研究由 Kevin Backhouse 完成 这只是一个 Bash PoC 脚本，用于自动化 Kevin Backhouse 博客中提到的利用步骤。 阅读他关于此漏洞的博文：https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/ 使用方法 root@kitploit: 使用方法： ./poc.sh -h --help -u=输入自定义用户名（可选） -p=输入自定义密码（可选） -f=y，跳过漏洞检查并强制利用（可选...

CVE-2020-16125-Reproduction

CVE-2020-16125-Reproducción Este repositorio tiene como objetivo reproducir el ataque. Descripción: Su nombre original es "Ubuntu gdm3 escalada de privilegios" y fue encontrado por un investigador de seguridad de Github llamado Kevin Backhouse. Su puntuación CVSS es 4.6/10 media y el entorno...

CVE-2021-3560-Polkit-Privilege-Escalation

CVE-2021-3560-Polkit-权限提升 作者：Mark, Qingchen Yu 使用以下命令构建容器： root@kitploit: docker build -t . 运行容器： root@kitploit: docker run -it 1. 从 start.sh 开始 2. 测量执行时间： 注意 'real' 时间，并计算其一半。 root@kitploit: time dbus-send --system --dest=org.freedesktop.Accounts --type=methodcall --print-reply...

CVE-2026-61898

A flaw was found in accountsservice. A local attacker can exploit this by injecting arbitrary shell commands into the user-controlled LANGUAGE entry in the /.pamenvironment file. The Ubuntu-specific language helper scripts process this input unescaped, leading to arbitrary code execution with roo...

CVE-2026-61897

A flaw was found in AccountsService. An Ubuntu-specific patch for AccountsService did not fully drop root privileges when launching language helper scripts. This oversight allows a local user to exploit the incomplete privilege drop, potentially enabling them to reset their effective user ID to...

CVE-2026-61897

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 root. A shell spawned by a helper script inherits ruid=0 and may reset its...

CVE-2026-61898

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

CVE-2026-61898 accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

EUVD-2026-63380

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

CVE-2026-61898

CVE-2026-61898 is a shell injection in the Ubuntu-specific language helper scripts (save-to-pam-env , update-langlist ) shipped with accountsservice before version 23.13.9-8ubuntu7 . The user-controlled LANGUAGE entry in ~/.pam_environment is interpolated unescaped into a GNU sed replacement expr...

CVE-2026-61898

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

CVE-2026-61897

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 root. A shell spawned by a helper script inherits ruid=0 and may reset its...

EUVD-2026-63379

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 root. A shell spawned by a helper script inherits ruid=0 and may reset its...

CVE-2026-61897

An Ubuntu-specific AccountsService patch before 23.13.9-8ubuntu7 changes only the effective UID/GID to the target user while leaving the real UID as root (0). A shell spawned by a language helper script inherits ruid=0 and can reset its effective UID to root, enabling local privilege escalation t...

CVE-2026-61897 accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 root. A shell spawned by a helper script inherits ruid=0 and may reset its...

SUSE CVE-2026-16743

A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the...