PwnKit

Theory

CVE-2021-4034 (pwnkit) was discovered by researchers at Qualys. The vulnerability has existed in every version of the "Policy Toolkit" (or, Polkit) package since it was first released in 2009 and allows any unprivileged attacker to easily obtain full administrative access over any Linux machine with the Polkit package installed. Polkit is installed by default on most distributions of Linux, making this vulnerability extremely widespread. The Pwnkit vulnerability exists in the pkexec utility. The pkexec command is used by authorized users to execute commands at elevated privileges (like using sudo).

Pkexec attempts to parse any command-line arguments that we pass it using a for-loop, starting at the index 1 to offset the name of the program and obtain the first real argument. The name of the program is irrelevant to argument parsing, so the indexing is simply offset to ignore it. But if we don't provide any arguments, the index is permanently set to 1. This becomes a problem later when pkexec attempts to write to the value of the argument at index n. As there are no command-line arguments, there is no argument at index n — instead the program overwrites the next thing in memory, which just so happens to be the first value in the list of environment variables when the program is called using a C function called execve(). In other words, by passing pkexec a null list of arguments, we can force it to overwrite an environment variable instead! - TryHackMe

Practice

$ find / -type f -name *pkexec* -perm -4000 2>/dev/null
/usr/bin/pkexec

#Debian/Ubuntu
apt list --installed | grep -i polkit

#RHEL/CentOs/Fedora
rpm -qa | grep -i polkit

#SUE
zypper search -i polkit

#Oracle Linux
pkginfo | grep -i polkit

Ressource

Pwnkit Exploitation Guide: Unveiling CVE-20\u2026ine.com

CVE-2021-4034: How PwnKit Exploits Polkit\u2019s pkexec | Qualysblog.qualys.com