Associated Vulnerability
Title:polkit 缓冲区错误漏洞 (CVE-2021-4034)Description:A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
Description
CVE-2021-4034, exploit para escalado de privilegios en SO Linux a root
Readme
# CVE-2021-4034
https://raw.githubusercontent.com/hackingyseguridad/CVE-2021-4034/main/binario
Copiar contenido RAW y pegar en la consola Bash shell:
Vulnerabilidad CVE-2021-4034 Gravedad 7.8 de fecha 18/11/2021, en el componente pkexec de Polkit https://gitlab.freedesktop.org/polkit/polkit/
Versiones vulnerables de polkit: 0.92, 0.93, 0.94, 0.95, 0.96, 0.97, 0.98, 0.99, 0.100, 0.101, 0.102, 0.103, 0.104, 0.105, 0.106, 0.107, 0.108, 0.109, 0.110, 0.111, 0.112, 0.113, 0.114, 0.115, 0.116, 0.117, 0.118, 0.119, 0.120
Error en el servicio del sistema "/usr/bin/pkexec" en todas las versiones desde Mayo de 2009, en los SO Linux permite elevar privilegios a root
https://linux.die.net/man/1/pkexec
liberado el exploit, publico en internet! https://github.com/hackingyseguridad/CVE-2021-4034/
Alcance: Todas las maquinas, con SO Linux, desde 2009
Impacto: Cualquier usuario no privilegiado ejecutando desde la consola Bash Shell se convierte en root! La vulnerabilidad pone en riesgo la confidencialidad e integridad de los datos, así como la disponibilidad del sistema.
<img style="float:left" alt="Escalado de privilegios" src="https://github.com/hackingyseguridad/CVE-2021-4034/blob/main/exploit.png">
www.hackingyseguridad.com
File Snapshot
[4.0K] /data/pocs/36e528dc85a5ec25544bfc9eb5948d8d65e023d6
├── [ 58K] binario
├── [1008] CVE-2021-4031_1.sh
├── [1.2K] CVE-2021-4034.sh
├── [ 42K] exploit.png
└── [1.2K] README.md
0 directories, 5 files
Remarks
1. It is advised to access via the original source first.
2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →