CVE-2021-4034 PoC — polkit 缓冲区错误漏洞

Source

https://github.com/artemis-mike/cve-2021-4034

Associated Vulnerability

Title:polkit 缓冲区错误漏洞 (CVE-2021-4034)
Description:A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

Description

PoC for cve-2021-4034

Readme

# cve-2021-4034
PoC for cve-2021-4034

Based on the PoC by https://haxx.in: https://haxx.in/files/blasty-vs-pkexec.c. Probably he's https://github.com/blasty?! I don't know.

With a little help from https://github.com/daimoniac


# How to use?
## Compile cve-2021-4034.c
```
gcc -Wall cve-2021-4034.c -o cve-2021-4034-exploit
```

## Execute ansible playbook
**Change variable `hosts` in `asses_CVE-2021-4034.yml` to your usecase!**
```
ansible-playbook -i </path/to/inventory.yml> </path/to/playbooks/>asses_CVE-2021-4034.yml
```

The playbook copies the exploit to the host, executes it and evaluates `whoami` on multiple occasions and checks for "root" as return value of the exploit.

On hosts where the task `Check result of privilege escalation` fails a privilge escalation was successful. 
In the play recap hosts which don't have `failed=0` are vulnerable.

# What does it do?

Deep down? I have no idea. Weired memory mashups probably. 

What's essential for the operability of this anbible playbook is https://github.com/mike-artemis/cve-2021-4034/blob/main/cve-2021-4034.c#L50. The plain exploit by https://haxx.in/files/blasty-vs-pkexec.c only opens a root-shell and the ansible playbook is stuck in it. 
Changing the payload of the exploit to 
```
"  static char *a_argv[] = { \"bash\",  \"-c\",  \"whoami\", NULL };\n"
```
return the current user. The playbook checks the user for privilege escalation and fails the playbook if it happened.

File Snapshot


 [4.0K]  /data/pocs/5f9d3580cfe755ee6dfdfb3b28628053e6785c2f
├── [1.4K]  asses_CVE-2021-4034.yml
├── [2.3K]  cve-2021-4034.c
└── [1.4K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!