CVE-2021-4034 (PwnKit) PoC

DISCLAIMER: This material is provided for educational purposes only. Using the exploit without the written consent of the target system's owner is unethical and may be prosecuted by law.

Installation and Launch

1. Clone the repository onto the target machine.
2. Grant execute permissions to the build script: chmod +x build.sh.
3. Run the build: ./build.sh.
4. Execute the exploit: ./mls_envp. You will gain root access.

The Essence of the Vulnerability

In the vulnerable version of polkit (0.105), the author, David Zeuthen, assumed that pkexec would always be invoked from a console. He assumed that argc (the number of arguments) is always greater than 1, since argv[0] is the name of the program itself. However, pkexec can be invoked via the execve system call by passing an empty argument array. This breaks the program's logic.

1. Out-of-Bounds Array Access

The pkexec code hard-codes the expectation that argv contains at least one element. When argc is 0, the program still tries to access argv[1]. This results in an out-of-bounds access of the argv array and reading the first element of the envp array (environment variables). In our case, that element holds the string "exp_exe".

2. Bypassing the PATH Check

pkexec tries to locate the program exp_exe using the g_find_program_in_path function. It uses the PATH variable for the search. We replace PATH with GCONV_PATH=.. As a result, pkexec finds the dummy file exp_exe in our local folder and returns the path GCONV_PATH=./exp_exe. Due to the argc bug, this path is written back into envp[0], "legitimizing" the GCONV_PATH variable.

3. Loading a Malicious Library

Before launching the program, pkexec checks the environment variables (including SHELL). We pass a non-existent shell (SHELL=xyz) to trigger an error. When the error is output, log_message is called, which uses glibc mechanisms. Glibc looks at the CHARSET=bohemcavanna variable and, failing to find a standard converter, accesses the directory from GCONV_PATH (which we supplied). There it reads the gconv-modules file, loads our exploit.so library, and executes the code inside it with root privileges.