-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
polkit_dbus_auth_bypass not working #17227
Comments
I haven't confirmed this particular issue, but I know I ran into an issue with the polkit_dbus_auth_bypass module on a different environment where I had to modify this line as the output of metasploit-framework/modules/exploits/linux/local/polkit_dbus_auth_bypass.rb Lines 129 to 131 in 455476c
I wouldn't have the cycles to confirm that it's the same issue here, but potentially the author @jheysel-r7 might be able to look. If not - pull requests are always welcome for module improvements and bug fixes 💯 |
That's not the error I receive, the user is created successfully, the other two steps fail (password change and user deletion). print_error("Attempted to set the password #{datastore['Iterations']} times, did not work.") print_warning("Unable to remove user: #{datastore['USERNAME']}, created during the running of this module") |
Hey @Signum21, thanks for bringing up this issue. I was able to follow your steps above to reproduce this using
Depending on I paused execution before
I'm not sure what about the session type I noticed that if your session is
I'm not sure if we could improve the exploit in order to work with shell sessions, or if we need to put a guard to ensure a meterpreter session is in use. @AlanFoster - just off the top of your head, does a reason why shell sessions wouldn't work here, come to mind? |
Whoops - forgot to reply to this at the time, the account ping was to |
Steps to reproduce
Open SSH session:
use auxiliary/scanner/ssh/ssh_login
set username tryhackme
set password TryHackMe123!
set rhosts TRYHACKME_MACHINE_IP
run
Run exploit:
use exploit/linux/local/polkit_dbus_auth_bypass
set iterations 100
set session 1
set lhost VPN_LOCAL_IP
run
Local machine informations:
Kali WSL-2
uname -a: Linux DESKTOP-NAME 5.10.102.1-microsoft-standard-WSL2 #1 SMP Wed Mar 2 00:30:59 UTC 2022 x86_64 GNU/Linux
Remote machine informations:
uname -a: Linux polkit 5.8.0-1035-aws #37~20.04.1-Ubuntu SMP Tue Jun 1 09:54:15 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
apt list --installed | grep policykit-1: policykit-1/focal,now 0.105-26ubuntu1 amd64 [installed,upgradable to: 0.105-26ubuntu1.1]
Were you following a specific guide/tutorial or reading documentation?
I'm doing this TryHackMe free room:
https://tryhackme.com/room/polkit
I completed the tutorial using the manual commands and can confirm that the machine is working and is vulnerable.
Expected behavior
The exploit should create an user, set a password for it and remove the user.
Current behavior
The user is created successfully but the next steps fail.
Metasploit version
Framework: 6.2.23-dev
Console : 6.2.23-dev
Additional Information
Module/Datastore
The following global/module datastore, and database setup was configured before the issue occurred:
Collapse
Database Configuration
The database contains the following information:
Collapse
History
The following commands were ran during the session and before this issue occurred:
Collapse
Framework Errors
The following framework errors occurred before the issue occurred:
Collapse
Web Service Errors
The following web service errors occurred before the issue occurred:
Collapse
Framework Logs
The following framework logs were recorded before the issue occurred:
Collapse
Web Service Logs
The following web service logs were recorded before the issue occurred:
Collapse
Version/Install
The versions and install method of your Metasploit setup:
Collapse
The text was updated successfully, but these errors were encountered: