CVE-2021-4034 (PwnKit) - Analysis and Exploitation

This repository contains the source code to demonstrate the exploitation of the CVE-2021-4034 vulnerability, also known as PwnKit, discovered in pkexec (part of the Polkit package). This flaw allows local privilege escalation to root through the use of malicious environment variables.

⚠️ Warning

This code is provided solely for educational and research purposes. It should not be used on production systems or without explicit authorization. Misuse may be illegal and violates the author's terms of use.

🧠 Technical Description

The vulnerability occurs when pkexec is executed without arguments, i.e., argc == 0. In this case, pkexec attempts to access argv[1] without checking that argv[0] exists, causing it to read from envp[0]. This allows the attacker to:

• Read and overwrite environment variables such as GCONV_PATH.
• Force the loading of an arbitrary .so library to execute code as root.

The exploit takes advantage of this condition to load a malicious library that opens a shell as the root user.

📁 Repository Files

• cve-2021-4034.c: Source code of the exploit that invokes pkexec with argv[] = {NULL} and modified environment variables.
• pwnkit.c: Source code of the malicious library that opens a shell as root.

🛠️ Compilation

gcc -Wall -o cve-2021-4034 cve-2021-4034.c
gcc -Wall -shared -fPIC -o pwnkit.so pwnkit.c

🧪 Usage Instructions (Environment Preparation and Execution)

mkdir GCONV_PATH=.
echo 'module UTF-8// PWNKIT// pwnkit 1' > gconv-modules
cp $(which true) GCONV_PATH=./pwnkit.so:.

./cve-2021-4034