allu-mette/cve-2021-4034PoC of CVE-2021-4034 (PwnKit) for personal training purposes.
This repository contains a Proof of Concept for CVE-2021-4034, also known as PwnKit. It was developed for personal training and educational purposes only. Use only in environments you own or are explicitly authorized to test.
To build the exploit you need:
pkexec is a utility from Polkit that allows an authorized user to execute programs as another user, typically with administrative privileges, similar to sudo. CVE-2021-4034 is a memory corruption vulnerability affecting this binary. The issue stems from improper argument handling when argc == 0. This results in an out-of-bounds write that allows an attacker to control the first environment variable pointer in memory. Under certain conditions, it allows an unprivileged local user to escalate privileges to root. More details are available here: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
The final exploit is fully self-contained and requires no external libraries or additional binaries.
Distribution: Ubuntu 20.04 LTS
Kernel version: 5.4.0-42-generic
Polkit version: 0.105-26ubuntu1 (unpatched)
The included shell (shell.asm) is written in x86_64 assembly for Linux. It is compiled into a shared object (.so) and embedded in the exploit.
Optionally, the shell can be implemented in C for more portability across distributions, but the ASM version is retained for learning purposes and to practice low-level assembly coding.
Note: This exploit and shell are only compatible with x86_64 Linux environments. Using a different architecture (e.g., ARM or i386) will not work.
Compile:
make
Run:
./exploit
Clean:
make clean
This vulnerability was patched in January 2022.
If you are running an unpatched version of policykit-1, your system may be vulnerable. As a temporary mitigation, you can remove the SUID bit from pkexec:
chmod -s /bin/pkexec