Proof Of Concept for the 2021's pkexec vulnerability CVE-2021-4034# CVE-2021-4034 - Proof Of Concept
This *POC* exploits *GLib*'s `g_printerr` to leverage code execution through the injection of the `GCONV_PATH` environmental variable.
## Running the exploit
Make a tarball file of the exploit:
```bash
make tar
```
Then somehow transfer the generated tar to the target machine, compile, and run the vulnerability:
```bash
make
./poc
```
The exploit will try to execute a `/bin/sh` as root.
## Further reading
* [The blog post this exploit was based on](https://milot.io/dissecting-pkexec-cve-2021-4034-vulnerability/)
* [An article to better understand the theory behind the attack](https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034)
[4.0K] /data/pocs/23cef84578508bf73dfa5b5a3de2295bd30f6484
├── [4.0K] GCONV_PATH=.
│ └── [ 0] modules
├── [ 233] lib.c
├── [ 221] Makefile
├── [4.0K] modules
│ └── [ 38] gconv-modules
├── [ 234] poc.c
└── [ 786] README.md
2 directories, 6 files