{"uuid": "2d79cc97-5e3a-40f2-bd25-f741059beb2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4034", "type": "seen", "source": "https://t.me/hacking_Attack/40257", "content": "Black Hat Ethical Hacking\nLinux system service bug gives root on all major distros, exploit released\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Linux system service bug gives root on all major distros, exploit releasedPost Views: 482 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nA vulnerability in Polkit\u2019s pkexec component identified as CVE-2021-4034 (PwnKit) is present in the default configuration of all major Linux distributions and can be exploited to gain full root privileges on the system, researchers warn today. \nCVE-2021-4034 has been named PwnKit and its origin has been tracked to the initial commit of pkexec, more than 12 years ago, meaning that all Polkit versions are affected.\n\nPart of the Polkit open-source application framework that negotiates the interaction between privileged and unprivileged processes, pkexec allows an authorized user to execute commands as another user, doubling as an alternative to sudo. Easy to exploit, PoC expected soonResearchers at Qualys information security company found that the pkexec program could be used by local attackers to increase privileges to root on default installations of Ubuntu, Debian, Fedora, and CentOS.\n\nThey warn that PwnKit is likely exploitable on other Linux operating systems as well.\n\nBharat Jogi, Director of Vulnerability and Threat Research at Qualys explains\u00a0that PwnKit is \u201ca memory corruption vulnerability in Polkit\u2019s, which allows any unprivileged user to gain full root privileges on a vulnerable system using default polkit configuration,\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course The researcher notes that the issue has been hiding in plain sight since the first version of pkexec inn May 2009. The video below demonstrates the exploitability of the bug:\nExploiting the flaw is so easy, the researchers say, that proof-of-concept (PoC) exploit code is expected to become public in just a few days. The Qualys Research Team will not release a PoC for PwnKit.\n\nUpdate: An exploit has\u00a0already emerged in the public space, less than three hours after Qualys published the technical details for\u00a0PwnKit. BleepingComputer has compiled and tested the available exploit, which proved to be reliable as it gave us root privileges on the system on all attempts.\nhttps://www.bleepstatic.com/images/news/u/1100723/2022/PwnKitExploit.png \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:58.675039Z"}