---
description: Walkthrough room for CVE-2021-3560
---

# Polkit: CVE-2021-3560

{% embed url="https://tryhackme.com/room/polkit" %}
[https://tryhackme.com/room/polkit](https://tryhackme.com/room/polkit)
{% endembed %}

| Room Attributes       | Value                                                                   |
| --------------------- | ----------------------------------------------------------------------- |
| Subscription Required |  <mark style="color:green;background-color:green;">False</mark> \[Free] |
| Type                  | Walkthrough                                                             |
| Difficulty            |  <mark style="color:blue;background-color:blue;">Info</mark>            |
| Tags                  | Polkit, Ubuntu 20.04, CVE-2021-3560, Walkthrough                        |

## Task 1 - <mark style="color:green;background-color:green;">Info</mark> Deploy!

### Click the green "Start Machine" button to deploy the machine!

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 2 - <mark style="color:green;background-color:green;">Info</mark> <mark style="color:red;background-color:red;">Important!</mark> About Dynamic Flags

### Read the information in the task. What is the URL of the website you should submit dynamic flags to?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`https://flag.muir.land/`

</details>

## Task 3 - <mark style="color:purple;background-color:purple;">Tutorial</mark> Background

### In what version of Ubuntu's policykit-1 is CVE-2021-3560 patched?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`0.105-26ubuntu1.1`

</details>

### What program can we use to run commands as other users via polkit?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`pkexec`

</details>

## Task 4 - <mark style="color:purple;background-color:purple;">Tutorial</mark> Exploitation Process

### Read the information above

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 5 - <mark style="color:orange;background-color:orange;">Practical</mark> Do it for yourself!

### Root Flag

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`THM{N2I0MTgzZTE4ZWQ0OGY0NjdiNTQ0NTZi}`

</details>

