CVE-2021-4034 PoC — polkit 缓冲区错误漏洞

Source

https://github.com/mebeim/CVE-2021-4034

Associated Vulnerability

Title:polkit 缓冲区错误漏洞 (CVE-2021-4034)
Description:polkit是一个在类 Unix操作系统中控制系统范围权限的组件。通过定义和审核权限规则，实现不同优先级进程间的通讯。 polkit 的 pkexec application存在缓冲区错误漏洞，攻击者可利用该漏洞通过精心设计环境变量诱导pkexec执行任意代码。成功执行攻击后，如果目标计算机上没有权限的用户拥有管理权限，攻击可能会导致本地权限升级。

Description

CVE-2021-4034: Local Privilege Escalation in polkit's pkexec proof of concept

Readme

CVE-2021-4034 Proof of Concept
==============================

Qualys researches found a pretty cool local privilege escalation vulnerability
in Polkit's `pkexec`: [writeup][qualys-wup], [tweet][qualys-tweet]. This vuln
has been around and exploitable on major Linux distros for quite a long time.
Security patches have been published, so I decided to write a very simple PoC to
show how trivial it is to exploit this. The code in this repo should be really
self-explanatory after reading the linked write-up. Also thanks to
[@Drago1729][drago-twitter] for the idea and [the help][drago-tweet].

How to:

1. Get a vulnerable version of `pkexec` e.g. from `policykit-1 <= 0.105-31` in
   the [Debian repos][polkit-debian] or even built [from source][polkit-source].
   You can  have it locally installed or just copy the `pkexec` executable alone
   directly in this directory (make sure it's executable and setuid root).
2. Ensure you have GCC installed in order to compile the two C helpers in this
   repo.
3. Run `./expl.sh` and enjoy.

**NOTE**: `expl.sh` will first look for `pkexec` in the current working directory,
then fall-back to `$PATH`. Since `pkexec` is usually a setuid-root executable,
maybe run this in a VM and not on your machine, y'know...

Demo:

![result](terminal.gif)

Cheers, @mebeim :)


[qualys-wup]:    https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
[qualys-tweet]:  https://mobile.twitter.com/qualys/status/1486034484323569664
[polkit-debian]: http://ftp.us.debian.org/debian/pool/main/p/policykit-1/
[polkit-source]: https://salsa.debian.org/utopia-team/polkit/-/commits/master/
[drago-twitter]: https://twitter.com/Drago1729/
[drago-tweet]:   https://twitter.com/Drago1729/status/1486145716544319494

File Snapshot


 [4.0K]  /data/pocs/432dceeb6c72db38e5568b82d2574fb3ebf59522
├── [ 513]  expl.sh
├── [ 576]  fake_module.c
├── [1.0K]  helper.c
├── [1.2K]  LICENSE
├── [1.7K]  README.md
└── [ 50K]  terminal.gif

0 directories, 6 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!