CVE-2021-4034 PoC — polkit 缓冲区错误漏洞

Source

https://github.com/FancySauce/PwnKit-CVE-2021-4034

Associated Vulnerability

Title:polkit 缓冲区错误漏洞 (CVE-2021-4034)
Description:polkit是一个在类 Unix操作系统中控制系统范围权限的组件。通过定义和审核权限规则，实现不同优先级进程间的通讯。 polkit 的 pkexec application存在缓冲区错误漏洞，攻击者可利用该漏洞通过精心设计环境变量诱导pkexec执行任意代码。成功执行攻击后，如果目标计算机上没有权限的用户拥有管理权限，攻击可能会导致本地权限升级。

Readme

# Pwnkit Exploit Instructions

I did not write this.  This is only to document my exection/instruction of exploit use as there are some very intricate and complicated steps to follow.  

Files come from the following source:
https://packetstormsecurity.com/files/165739/PolicyKit-1-0.105-31-Privilege-Escalation.html

Additional assistance on execution found here:
https://ine.com/blog/exploiting-pwnkit-cve-20214034

This was tested/executed on OSCP's Blackgate Practice VM:
	Ubuntu 20.04
	Kernel 5.8.0-63-generic
	
	
How to know if vulnerable:

Check for available SUID and make sure `/usr/bin/pkexec` is a SUID binary:
 `find / -perm -4000 2>/dev/null`
 
Check permissions of the binary:
`ls -al /usr/bin/pkexec`

Check pkexec version:

`/usr/bin/pkexec --version`

Vulnerable version found on Blackgate: `pkexec version 0.105`

Make sure compiler is available on the victim machine.
`gcc version`
	
# Exploit Execution

Copy the files over to the vicitm machine (Makefile, evil-so.c, exploit.c)
And compile using 'make all' command.
Execute './exploit'

Check shell

# Compilation errors
if you get an error stating that `cc: error trying to exec 'cc1': execvp: No such file or directory`.  
use `locate cc1' command to find the binaries:

```
locate cc1
/lib/modules/4.15.0-20-generic/kernel/drivers/iio/adc/cc10001_adc.ko
/lib/modules/4.15.0-20-generic/vdso/.build-id/a0/297fe29f8038ef50a10a26c9fcf5249ccc1184.debug
/usr/lib/gcc/x86_64-linux-gnu/7/cc1
/usr/lib/gcc/x86_64-linux-gnu/7/libcc1.so
/usr/lib/gcc/x86_64-linux-gnu/7/plugin/libcc1plugin.so
/usr/lib/gcc/x86_64-linux-gnu/7/plugin/libcc1plugin.so.0
/usr/lib/gcc/x86_64-linux-gnu/7/plugin/libcc1plugin.so.0.0.0
/usr/lib/x86_64-linux-gnu/libcc1.so.0
/usr/lib/x86_64-linux-gnu/libcc1.so.0.0.0

# Then Export the location to Path for reference, try to build again
Jack@oscp:/home/Jack$ export PATH=$PATH:/usr/lib/gcc/x86_64-linux-gnu/7/cc1
```

File Snapshot


 [4.0K]  /data/pocs/100a34b65da9d07dd3f23168fec5979dbea03bde
├── [ 186]  evil-so.c
├── [ 626]  exploit.c
├── [ 147]  Makefile
└── [1.9K]  README.md

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!