💀 PwnKit (CVE-2021-4034) & Reverse Shell Toolkit

⚠️ DISCLAIMER: This repository has been created solely for educational and security research purposes. The author is not responsible for the misuse of these tools. Use it only in controlled environments or where you have explicit permission.

---

📜 Description

This repository contains a compiled Proof of Concept (PoC) for the PwnKit vulnerability (CVE-2021-4034), a critical local privilege escalation flaw in the pkexec component of Polkit.

Additionally, a PHP Reverse Shell script is included, ready to be deployed after exploitation or as an initial access vector.

🎯 Goal

Achieve root access on vulnerable Linux systems and establish persistence or remote control via a reverse shell.

---

📂 Arsenal Contents

1. PwnKit (ELF Binary)

The compiled exploit for CVE-2021-4034.

• Function: Manipulates the environment variables of pkexec to load a malicious shared library and execute code as root.
• Architecture: x86_64 (Linux).
• Dependencies: Requires pkexec to be installed on the target.

2. reverseShell.php

A lightweight payload to establish a reverse connection.

• Current configuration:
  • IP: 192.168.1.8
  • Port: 4444
  • Shell: /bin/bash
• Usage: Can be executed via CLI (php reverseShell.php) or injected into a vulnerable web server.

---

🚀 Usage Guide

Phase 1: Privilege Escalation (PwnKit)

1. Transfer the PwnKit binary to the victim system.
2. Give it execution permissions:
   root@kitploit:~

   chmod +x PwnKit
   

3. Run the exploit:
   root@kitploit:~

   ./PwnKit
   

   If successful, you should get a shell with root privileges immediately.

Phase 2: Remote Connection (Reverse Shell)

1. On your attacker machine, start a listener with Netcat:
   root@kitploit:~

   nc -lvnp 4444
   

2. Edit reverseShell.php if your IP is different from the default configured one.
3. Execute the script on the victim (as a normal user or as root after using PwnKit):
   root@kitploit:~

   php reverseShell.php
   

---

🛠️ Technical Details (CVE-2021-4034)

This vulnerability lies in how pkexec handles command line arguments. By passing an empty argument list, pkexec attempts to access argv[1] out of bounds, allowing an attacker to overwrite environment variables in memory, specifically injecting a malicious GCONV_PATH variable to hijack the execution flow.

• Disclosure date: January 2022.
• Impact: Instant root access on most default Linux distributions (Ubuntu, Debian, Fedora, CentOS).

---

🛡️ Mitigation

To protect against this exploit:

1. Update Polkit: Install the security patches provided by your distribution.
2. Remove SUID bit (Temporary fix):
   root@kitploit:~

   chmod 0755 /usr/bin/pkexec
   

---

Happy Hacking! 🏴‍☠️