UNICORDev/exploit-CVE-2021-3560

GitHubRepository PoC

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2021-3560Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile builds an Ubuntu-based container that copies a Python exploit script for CVE-2021-3560 (Polkit local privilege escalation) into /opt/exploit-CVE-2021-3560 and sets bash as the entrypoint. The README describes the exploit, its usage, and a test environment.

Dockerfile:1-17README.md:1-64

Lab assessment

Vulnerability lab

The repository name, README, and included exploit script explicitly target CVE-2021-3560, a known Polkit vulnerability. The Dockerfile installs dependencies required by the exploit and copies the script, creating a self-contained environment for exercising the vulnerability.

README.md:1-3Dockerfile:1-17exploit-CVE-2021-3560.py:1-10
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

builds the lab environment

Uses azitech/ubuntu as base, installs accountsservice, gnome-control-center, sudo, and openssl, copies the entire build context into /opt/exploit-CVE-2021-3560, and sets bash as the entrypoint.

Dockerfile:1-17

exploit-CVE-2021-3560.py

local privilege escalation exploit for CVE-2021-3560

Python script that exploits a race condition in polkit's D-Bus interface to create a new user with sudo privileges. It uses dbus-send to call org.freedesktop.Accounts.CreateUser and SetPassword, timing the calls to bypass authentication.

exploit-CVE-2021-3560.py:1-198

README.md

documents the exploit and lab usage

Explains the vulnerability, exploit usage, requirements, tested environment, and credits. Warns about GUI pop-up issues and suggests SSH to avoid them.

README.md:1-64
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2021-3560

Supported by supplied evidence

The exploit script explicitly targets CVE-2021-3560, the README describes the vulnerability as polkit credential check bypass, and the Dockerfile installs the necessary dependencies to exercise it. All evidence aligns with the CVE description.

exploit-CVE-2021-3560.py:1-10README.md:1-3Dockerfile:10-11
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • A vulnerable version of polkit (0.0-0.118) must be present in the base image or installed.README.md:47-49exploit-CVE-2021-3560.py:7-8
  • The container must be run with sufficient privileges to allow dbus-send and user creation (likely requires --privileged or --cap-add).exploit-CVE-2021-3560.py:108-110
  • Python3 and the dependencies accountsservice, gnome-control-center, sudo, and openssl must be installed.Dockerfile:10-11README.md:37-42

Evidence-described exercise path

  1. Build the Docker image from the provided Dockerfile.Dockerfile:1-17
  2. Run a container from the image, likely with --privileged or appropriate capabilities.README.md:1-64
  3. Inside the container, execute the exploit script: python3 exploit-CVE-2021-3560.py [-u username -p password].exploit-CVE-2021-3560.py:1-198README.md:25-28
  4. If successful, a new sudo user is created; switch to that user and then to root via sudo su.README.md:22-23
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The exploit targets the local container's polkit service to create a new user with sudo privileges, which is the documented purpose of the lab. No evidence shows hidden behavior, host escape, external connectivity, persistence, credential theft, or destruction beyond the intended lab target.

exploit-CVE-2021-3560.py:1-198Dockerfile:1-17README.md:1-64
Review boundaries

What the analysis did not establish

  • The Dockerfile comment states 'This isn't working yet :( Haven't found a vulnerable Docker image', indicating the lab may not be functional as-is.
  • The base image 'azitech/ubuntu' is not a standard, well-known image; its contents and polkit version are unknown.
  • No docker-compose or runtime configuration is provided, so required privileges (e.g., --privileged) are not specified.
  • The exploit script's dependency check uses 'which' and expects the dependencies to be in PATH, but the Dockerfile does not set PATH or verify installation locations.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1