CVE-2021-4024-Rust

Linux LPE using polkit-1 written in Rust.

Build instructions

Install rust if you haven't already

git clone https://github.com/deoxykev/CVE-2021-4024-Rust
cd CVE-2021-4024-Rust
rustup target add x86_64-unknown-linux-musl
cargo build --release

Vuln Check

# check for pkexec
which pkexec || echo not vuln

# check suid permissions on pkexec
stat -c '%a' $(which pkexec) | grep -q 4755 || echo not vuln

# check patch date on pkexec
stat -c '%y' $(which pkexec)
# dates before 2022-01-12 may be unpatched & vulnerable

Opsec considerations

Writes exploit files to /dev/shm (ramdisk)
- delete randomly generated directory afterwards
- can be detected on file creation
- shellcode is hardcoded, consider replacing with a polymorphic payload (ie: msfvenom output)
syscall to pkexec with null args can be detected
pkexec logs are visible in /var/log/auth.log

pkexec[121401]: user: The value for the SHELL variable was not found the /etc/shells file [USER=root] [TTY=/dev/pts/8] [CWD=/dev/shm/YWdQYnE3TSNlwNKMXEwYcGRVmdYipb] [COMMAND=GCONV_PATH=./tSq82ptZaDiyXWZz0BOybdH9fINqCG PATH=GCONV_PATH=. CHARSET=mgELtKAB9sXo0a9KJk00NNO0wa4x0J SHELL=mgELtKAB9sXo0a9KJk00NNO0wa4x0J]

Sigma Rule Detection

https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_cve_2021_4034.yml

Credits

vuln disclosure - qualsys research team - https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034 shellcode - @johkrupp - https://saarsec.rocks/2020/05/14/golf.so.html

You might also like...

A simple password manager written in Rust

ripasso A simple password manager written in Rust. The root crate ripasso is a library for accessing and decrypting passwords stored in pass format (G

548 Dec 26, 2022

A fast, simple, recursive content discovery tool written in Rust.

A simple, fast, recursive content discovery tool written in Rust 🦀 Releases ✨ Example Usage ✨ Contributing ✨ Documentation 🦀 😕 What the heck is a f

3.6k Dec 30, 2022

link is a command and control framework written in rust

link link is a command and control framework written in rust. Currently in alpha. Table of Contents Introduction Features Feedback Build Process Ackno

427 Dec 24, 2022

simple multi-threaded port scanner written in rust

knockson simple multi-threaded port scanner written in rust Install Using AUR https://aur.archlinux.org/packages/knockson-bin/ yay -Syu knockson-bin M

4 Oct 5, 2022

Multi-threaded Padding Oracle attacks against any service. Written in Rust.

rustpad is a multi-threaded successor to the classic padbuster, written in Rust. It abuses a Padding Oracle vulnerability to decrypt any cypher text or encrypt arbitrary plain text without knowing the encryption key!

76 Dec 16, 2022

OpenSK is an open-source implementation for security keys written in Rust that supports both FIDO U2F and FIDO2 standards.

OpenSK This repository contains a Rust implementation of a FIDO2 authenticator. We developed OpenSK as a Tock OS application. We intend to bring a ful