pwnfunction/cve-2021-4034

Proof of concept for pwnkit vulnerability

cve-2021-4034's Issues

Doesn't work

Hi @PwnFunction,

I noticed that this code doesn't actually work. When I try to run it in Ubuntu, It outputs this:

GLib: Cannot convert message: Could not open converter from “UTF-8” to “BRUH” pkexec must be setuid root

Super weird linker error

I've never seen a compiler do this before.

rm -rf 'GCONV_PATH=.' pwn pwnkit
mkdir 'GCONV_PATH=.'
touch GCONV_PATH=.\/pwn
chmod +x GCONV_PATH=.\/pwn
mkdir pwn
echo 'module  UTF-8//    BRUH//    conversion-mod   1' > pwn/gconv-modules
clang-15 -shared -fPIC -o pwn/conversion-mod.so conversion-mod.c
clang-15 -o pwnkit pwnkit.c
/usr/bin/ld: cannot find /tmp/pwnkit-fb42a6.o: Invalid argument
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make: *** [Makefile:14: pwnkit] Error 1

This happens with gcc 11.2 as well as clang 15. Compiling other programs (including entire game engines) works fine. Changing it so that it compiles with -c to a local object file makes no difference - file pwnkit.o doesn't even pick it up as an ELF or COFF or whatever file either, just as a normal file.

I've never seen this before, it's super weird. Further, after a few executions, trying to remove the .o file causes a Permission Denied error, even when run as root - ownership shows as the current user/group with adequate permissions. I've inspected the code and there doesn't appear to be anything out of the ordinary. Trying to rm it causes it to zero it out - the file isn't removed.

I don't have Docker available (this is WSL) so I can't test it there, but this is the weirdest behavior I've ever seen coming from compilers. Is this (ab)using something strange in C somehow that I'm missing?

Not sure whether exploit has been patched

Very interesting video explanation. Thank you! I tried running this on my local Debian system and got this:

$ ./pwnkit
pkexec --version |
       --help |
       --disable-internal-agent |
       [--user username] PROGRAM [ARGUMENTS...]

See the pkexec manual page for more details.
$

So apparently it did not escalate me to root. But I don't think I updated recently enough to be protected. If this is of interest, I can provide more info.