Systemd Insecure PTY Handling Vulnerability

Author: hackerhouse-opensource

systemd-run-tty.txt

@@ -284,7 +284,11 @@ should be given to hardening PTY/TTY handling processes and protection against p
 regardless when privileged system operations take place. Attackers are less likely to use
 on-disk methods such as manipulation of .profile or .bashrc when they can simply hijack the 
 requested permissions at a later date without touching disk from implants or other malicious 
-code that has obtained execution in the contexts described above. 
+code that has obtained execution in the contexts described above. In relation to security 
+boundaries, the polkit authentication request sent by systemd-run is ONE-SHOT, as opposed to
+persitent. This means that every request to systemd-run for elevation should present the user
+with a password prompt, by exploiting this issue the elevation request behaves as persistent 
+for the lifecycle of the elevated program. 
 
 -- Hacker Fantastic 04/05/2024
 https://hacker.house