CVE-2021-4034 PoC — polkit 缓冲区错误漏洞

Source

https://github.com/deoxykev/CVE-2021-4034-Rust

Associated Vulnerability

Title: polkit 缓冲区错误漏洞 (CVE-2021-4034)
Description:A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

Description

Linux LPE using polkit-1 written in Rust.

Readme

# CVE-2021-4034-Rust
Linux LPE using polkit-1 written in Rust. 

## Build instructions
[Install rust if you haven't already](https://rustup.rs/)
```
git clone https://github.com/deoxykev/CVE-2021-4034-Rust
cd CVE-2021-4034-Rust
rustup target add x86_64-unknown-linux-musl
cargo build --release
```

## Vuln Check
```
# check for pkexec
which pkexec || echo not vuln

# check suid permissions on pkexec
stat -c '%a' $(which pkexec) | grep -q 4755 || echo not vuln

# check patch date on pkexec
stat -c '%y' $(which pkexec)
# dates before 2022-01-12 may be unpatched & vulnerable
```

## Opsec considerations
- Writes exploit files to /dev/shm (ramdisk)
  - delete randomly generated directory afterwards
  - can be detected on file creation
  - shellcode is hardcoded, consider replacing with a polymorphic payload
    (ie: msfvenom output)
- syscall to pkexec with null args can be detected
- pkexec logs are visible in `/var/log/auth.log`
```
pkexec[121401]: user: The value for the SHELL variable was not found the /etc/shells file [USER=root] [TTY=/dev/pts/8] [CWD=/dev/shm/YWdQYnE3TSNlwNKMXEwYcGRVmdYipb] [COMMAND=GCONV_PATH=./tSq82ptZaDiyXWZz0BOybdH9fINqCG PATH=GCONV_PATH=. CHARSET=mgELtKAB9sXo0a9KJk00NNO0wa4x0J SHELL=mgELtKAB9sXo0a9KJk00NNO0wa4x0J]
```


## Sigma Rule Detection
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_cve_2021_4034.yml

# Credits
vuln disclosure - qualsys research team - https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034
shellcode - @johkrupp - https://saarsec.rocks/2020/05/14/golf.so.html

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →