Does linpeas still detect CVE-2021-3560?

Question

Does linpeas still detect CVE-2021-3560?

LevitatingBusinessMan opened this issue a year ago · comments

I was doing the HackTheBox box "Paper", which uses the polkit CVE-2021-3560 for privilege escalation.

In the walkthrough for this box, linpeas suggests the CVE in the CVEs Check section with a red on yellow background. But on the latest release of linpeas the CVE is not even suggested.

Rein Fernhout · Answer 1 · Fri Mar 03 2023 08:56:31 GMT+0800 (China Standard Time)

I just saw it falsely detect it on another box (investigation).

Jordy · Answer 2 · Mon Mar 06 2023 07:53:04 GMT+0800 (China Standard Time)

Can confirm the same is occurring in my case as well while working on Paper. I see this has been previously reported 2 times as well at least(#332 and #269)?

Trying to see what may be behind this.

Jordy · Answer 3 · Mon Mar 06 2023 08:17:49 GMT+0800 (China Standard Time)

If you run this command,

yum list installed | grep polkit

Then Polkit does not even appear to show up as an installed package if I understand this correctly (it's a CentOS server).

Welcome any correction to my understanding; thanks! the suggestion in #332 does appear to work though (at least the raw command appears to meet the condition.

Rein Fernhout · Answer 4 · Mon Mar 06 2023 20:59:53 GMT+0800 (China Standard Time)

Ah, sorry for the duplicate. These issues should probably be merged.

The walkthrough of paper says that it should detect it, so something must've changed. Diving into the commits changing that code might give some clarity. Might do that later.

SirBroccoli · Answer 5 · Wed Mar 29 2023 23:26:34 GMT+0800 (China Standard Time)

hi guys! did you figure this out?

Rein Fernhout · Answer 6 · Thu Mar 30 2023 03:34:29 GMT+0800 (China Standard Time)

My only guess is that the changes in 999fcff broke the detection. I will investigate further.

Rein Fernhout · Answer 7 · Thu Mar 30 2023 04:24:59 GMT+0800 (China Standard Time)

So there's two issues with that commit that breaks detection on the paper box. The first issue is the polkit package is searched with yum installed of rpm.

yum list installed does not show any polkit packages on paper.

In this box the package was most likely manually installed with rpm which is why it doesn't show up in yum.

The new query also only searches for version 0.117-2. The CVE was patched in 0.119 so it's missing out on a lot of vulnerable versions.

It used to also check 0.115-6 which is installed on the box.

I am also not sure why it would search for those exact pkgrel versions.

I also think searching for packages via rpm should always be preferred.

There's currently also an entirely unused variable polkitVersion which gets the version from systemctl.