cerodah/cve-2021-4034Proof-of-concept exploit for CVE-2021-4034 (PwnKit), a local privilege escalation vulnerability in Polkit's pkexec utility affecting most Linux distributions.
Polkit PoC
Policy Toolkit (or Polkit) since its release in 2009 allows any attacker without root permissions to easily obtain administrative access over any Linux system with the Polkit package. Unfortunately (or not), it is installed by default in most Linux distributions, which has made this vulnerability widespread.
Fortunately (or not), this vulnerability cannot be exploited remotely, making it a local privilege escalation (LPE) vulnerability.
Polkit is part of most Linux authorization systems. When any action that requires administrative permission is performed, Polkit determines whether you have the necessary permissions to execute the action. It is integrated into systemd (replacement for init). In fact, systemd is known as "sudo of systemd", according to THM.
When interacting with polkit we can use pkexec (the program containing the Pwnkit vulnerability). For example, when we try to run useradd with pkexec in a GUI session, a window appears asking for credentials. In CLI we can get something similar to this:
user@user:~$ pkexec useradd test1
==== AUTHENTICATING FOR org.freedesktop.policykit.exec ===
Authentication is needed to run '/usr/sbin/useradd' as the super user
Authenticating as: user,,, (user)
Password:
Obviously, Canonical has already released patched versions of this package in the APT package manager. If some distributions have not released patched versions, simply remove the SUID bit from pkexec.
sudo chmod 0777 'which pkexec'