nosferatuvjr/pwnkitProva de conceito para a vulnerabilidade Polkit Pkexec: CVE-2021-4034(Pkexec Local Privilege Escalation)
This repository contains an exploit I developed to understand how the Polkit Pkexec vulnerability works: CVE-2021-4034 (Pkexec Local Privilege Escalation). Polkit (formerly known as PolicyKit) is a component that controls privileges on Unix-like operating systems. It provides an organized way for unprivileged processes to communicate with privileged processes. The vulnerability allows any user, a regular system user without administrative privileges, to achieve maximum privileges on the system.
The vulnerability occurs when the main() function of pkexec processes command line arguments where the argument is 0. The function tries to access the argument list and ends up trying to access argv[0] (a command line argument controller), meaning it occurs when pkexec does not properly handle call parameters and ends up trying to execute environment variables as commands. The result is memory being read and written out of bounds, where an attacker can exploit this and inject an environment variable that can cause malicious code to be loaded.
It is simple to understand; the fact that these environment variables can be introduced makes the code vulnerable. The method I used to exploit the vulnerability was the same as that used by Qualys. The process is simple: just inject a GCONV_PATH environment variable into the pkexec workspace, i.e., any directory available to regular system users. This variable will execute a shared library as root. We must be clear that this technique is noisy and leaves many traces, as the injection of the variable creates a directory and it shares privileges with the root user.
If you see that your system is vulnerable, update as soon as possible. If you still believe it is vulnerable, you can remove the SUID bit from pkexec as a temporary mitigation, like so: # chmod 0755 /usr/bin/pkexec
More details on how the vulnerability works here.
The exploit will work instantly on vulnerable distributions based on Debian, Ubuntu, Fedora, and CentOS. It was created for study purposes on the vulnerability and to see how far I can currently go on my own with the C language :D. Don't use this for anything you shouldn't.
$ git clone https://github.com/Nosferatuvjr/PwnKit
$ cd PwnKit
$ chmod +x ./PwnKit.sh
$ ./PwnKit.sh
# id
Or
$ git clone https://github.com/Nosferatuvjr/PwnKit
$ cd PwnKit
$ chmod +x ./PwnKit
$ ./PwnKit
$ ./PwnKit id #interactive shell
gcc -shared PwnKit.c -o PwnKit -Wl,-e,entry -fPIC
