{"id":13296937,"url":"https://github.com/luijait/PwnKit-Exploit","last_synced_at":"2025-03-10T09:32:49.707Z","repository":{"id":41433801,"uuid":"452384014","full_name":"luijait/PwnKit-Exploit","owner":"luijait","description":"Proof of Concept (PoC) CVE-2021-4034 ","archived":false,"fork":false,"pushed_at":"2022-02-07T15:42:00.000Z","size":138,"stargazers_count":66,"open_issues_count":0,"forks_count":12,"subscribers_count":2,"default_branch":"main","last_synced_at":"2023-03-09T08:41:50.962Z","etag":null,"topics":["base64","c","cve","cve-2021-4034","exploit","hacking","linux","offensive-security","offsec","pentesting","poc","polkit","proof-of-concept","pwnkit","security"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"lgpl-2.1","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/luijait.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-01-26T18:01:26.000Z","updated_at":"2023-03-03T01:41:36.000Z","dependencies_parsed_at":"2022-08-27T04:22:33.485Z","dependency_job_id":null,"html_url":"https://github.com/luijait/PwnKit-Exploit","commit_stats":null,"previous_names":[],"tags_count":null,"template":null,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/luijait%2FPwnKit-Exploit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/luijait%2FPwnKit-Exploit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/luijait%2FPwnKit-Exploit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/luijait%2FPwnKit-Exploit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/luijait","download_url":"https://codeload.github.com/luijait/PwnKit-Exploit/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":221164309,"owners_count":16767305,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["base64","c","cve","cve-2021-4034","exploit","hacking","linux","offensive-security","offsec","pentesting","poc","polkit","proof-of-concept","pwnkit","security"],"created_at":"2024-07-29T17:21:18.270Z","updated_at":"2024-10-23T06:30:47.865Z","avatar_url":"https://github.com/luijait.png","language":"C","readme":"# PwnKit-Exploit \nCVE-2021-4034\n\u003cdiv id=\"image\" align=\"center\"\u003e\n \u003cimg src=\"https://user-images.githubusercontent.com/60628803/151507343-b49df170-c853-47c9-aac1-740302e435f9.png\" height=\"300\" width=\"300\"\u003e\n                                                                                                                   \n  \u003cimg src=\"https://linuxiac.b-cdn.net/wp-content/uploads/2022/01/polkit-bug.png\" alt=\"PolKit\" height=\"300\"\u003e\n\u003c/div\u003e\n\n---\n\n\u003cdiv id=\"badges\" align=\"center\"\u003e\n  \u003cimg src=\"https://img.shields.io/badge/CVE-%20%20CVE--2021--4034%20-critical\"\u003e\n  \u003cimg src=\"https://img.shields.io/badge/%40author-luijait.es-informational\"\u003e\n  \u003cimg src=\"https://img.shields.io/github/repo-size/luijait/PwnKit-Exploit?label=Size\"\u003e\n  \u003cimg src=\"https://img.shields.io/github/languages/top/luijait/PwnKit-Exploit?label=C\"\u003e\n\u003c/div\u003e\n@c0br40x help to make this section in README!!\n\n### Proof of Concept\n\n\n![Proof of Concept](https://j.gifs.com/XQpL88.gif)\n\n\n```\ndebian@debian:~/PwnKit-Exploit$ make\ncc -Wall    exploit.c   -o exploit\ndebian@debian:~/PwnKit-Exploit$ whoami\ndebian\ndebian@debian:~/PwnKit-Exploit$ ./exploit\nCurrent User before execute exploit\nhacker@victim$whoami: debian\nExploit written by @luijait (0x6c75696a616974)\n[+] Enjoy your root if exploit was completed succesfully\nroot@debian:/home/debian/PwnKit-Exploit# whoami\nroot\nroot@debian:/home/debian/PwnKit-Exploit# \n```\n### Fix\n| Command | Use |\n| ------- | ----------- |\n| `sudo chmod 0755 pkexec` | Fix CVE 2021-4034 |\n\n\n\n### Installation \u0026 Use\n`git clone https://github.com/luijait/PwnKit-Exploit`\n\n`cd PwnKit-Exploit` \n\n\n`make` \n\n\n`./exploit` \n\n\n`whoami`\n| Command | Utility |\n| ------- | ------------- |\n|`make clean` | Clean build to test code modified |\n### Explanation \nBased blog.qualys.com\n\n\nThe beginning of pkexec’s main() function processes the command-line arguments (lines 534-568), and searches for the program to be executed, if its path is not absolute, in the directories of the PATH environment variable (lines 610-640):\n```C\n\n435 main (int argc, char *argv[])\n436 {\n...\n534   for (n = 1; n \u003c (guint) argc; n++)\n535     {\n...\n568     }\n...\n610   path = g_strdup (argv[n]);\n...\n629   if (path[0] != '/')\n630     {\n...\n632       s = g_find_program_in_path (path);\n...\n639       argv[n] = path = s;\n640     }\n```\nunfortunately, if the number of command-line arguments argc is 0 – which means if the argument list argv that we pass to execve() is empty, i.e. {NULL} – then argv[0] is NULL. This is the argument list’s terminator. Therefore:\n\n at line 534, the integer n is permanently set to 1;\n at line 610, the pointer path is read out-of-bounds from argv[1];\n at line 639, the pointer s is written out-of-bounds to argv[1].\nBut what exactly is read from and written to this out-of-bounds argv[1]?\n\nTo answer this question, we must digress briefly. When we execve() a new program, the kernel copies our argument, environment strings, and pointers (argv and envp) to the end of the new program’s stack; for example:\n```\n|---------+---------+-----+------------|---------+---------+-----+------------| \n| argv[0] | argv[1] | ... | argv[argc] | envp[0] | envp[1] | ... | envp[envc] | \n|----|----+----|----+-----+-----|------|----|----+----|----+-----+-----|------| \nV         V                V           V         V                V \n\n\"program\" \"-option\"           NULL      \"value\" \"PATH=name\"          NULL \n```\nClearly, because the argv and envp pointers are contiguous in memory, if argc is 0, then the out-of-bounds argv[1] is actually envp[0], the pointer to our first environment variable, “value”. Consequently:\n\n At line 610, the path of the program to be executed is read out-of-bounds from argv[1] (i.e. envp[0]), and points to “value”;\n At line 632, this path “value” is passed to g_find_program_in_path()  (because “value” does not start with a slash, at line 629);\n Then, g_find_program_in_path() searches for an executable file named “value” in the directories of our PATH environment variable;\n If such an executable file is found, its full path is returned to pkexec’s main() function (at line 632);\n Finally, at line 639, this full path is written out-of-bounds to argv[1] (i.e. envp[0]), thus overwriting our first environment variable.\nSo, stated more precisely:\n\n If our PATH environment variable is “PATH=name”, and if the directory “name” exists (in the current working directory) and contains an  executable file named “value”, then a pointer to the string  “name/value” is written out-of-bounds to envp[0];\nOR\n\n If our PATH is “PATH=name=.”, and if the directory “name=.” exists and contains an executable file named “value”, then a pointer to the  string “name=./value” is written out-of-bounds to envp[0].\nIn other words, this out-of-bounds write allows us to re-introduce an “unsecure” environment variable (for example, LD_PRELOAD) into pkexec’s environment. These “unsecure” variables are normally removed (by ld.so) from the environment of SUID programs before the main() function is called. We will exploit this powerful primitive in the following section.\n\nLast-minute note: polkit also supports non-Linux operating systems such as Solaris and *BSD, but we have not investigated their exploitability. However, we note that OpenBSD is not exploitable, because its kernel refuses to execve() a program if argc is 0.\n\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fluijait%2FPwnKit-Exploit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fluijait%2FPwnKit-Exploit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fluijait%2FPwnKit-Exploit/lists"}