关联漏洞
标题：
polkit 缓冲区错误漏洞
(CVE-2021-4034)
描述：polkit是一个在类 Unix操作系统中控制系统范围权限的组件。通过定义和审核权限规则，实现不同优先级进程间的通讯。 polkit 的 pkexec application存在缓冲区错误漏洞，攻击者可利用该漏洞通过精心设计环境变量诱导pkexec执行任意代码。成功执行攻击后，如果目标计算机上没有权限的用户拥有管理权限，攻击可能会导致本地权限升级。
描述
CVE-2021-4034: Local Privilege Escalation in polkit's pkexec proof of concept
介绍
CVE-2021-4034 Proof of Concept
==============================
Qualys researches found a pretty cool local privilege escalation vulnerability
in Polkit's `pkexec`: [writeup][qualys-wup], [tweet][qualys-tweet]. This vuln
has been around and exploitable on major Linux distros for quite a long time.
Security patches have been published, so I decided to write a very simple PoC to
show how trivial it is to exploit this. The code in this repo should be really
self-explanatory after reading the linked write-up. Also thanks to
[@Drago1729][drago-twitter] for the idea and [the help][drago-tweet].
How to:
1. Get a vulnerable version of `pkexec` e.g. from `policykit-1 <= 0.105-31` in
the [Debian repos][polkit-debian] or even built [from source][polkit-source].
You can have it locally installed or just copy the `pkexec` executable alone
directly in this directory (make sure it's executable and setuid root).
2. Ensure you have GCC installed in order to compile the two C helpers in this
repo.
3. Run `./expl.sh` and enjoy.
**NOTE**: `expl.sh` will first look for `pkexec` in the current working directory,
then fall-back to `$PATH`. Since `pkexec` is usually a setuid-root executable,
maybe run this in a VM and not on your machine, y'know...
Demo:
Cheers, @mebeim :)
[qualys-wup]: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
[qualys-tweet]: https://mobile.twitter.com/qualys/status/1486034484323569664
[polkit-debian]: http://ftp.us.debian.org/debian/pool/main/p/policykit-1/
[polkit-source]: https://salsa.debian.org/utopia-team/polkit/-/commits/master/
[drago-twitter]: https://twitter.com/Drago1729/
[drago-tweet]: https://twitter.com/Drago1729/status/1486145716544319494
文件快照
[4.0K] /data/pocs/432dceeb6c72db38e5568b82d2574fb3ebf59522
├── [ 513] expl.sh
├── [ 576] fake_module.c
├── [1.0K] helper.c
├── [1.2K] LICENSE
├── [1.7K] README.md
└── [ 50K] terminal.gif
0 directories, 6 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。