pwnfunction / cve-2021-4034 Goto Github PK
View Code? Open in Web Editor NEWProof of concept for pwnkit vulnerability
Proof of concept for pwnkit vulnerability
Hi @PwnFunction,
I noticed that this code doesn't actually work. When I try to run it in Ubuntu, It outputs this:
GLib: Cannot convert message: Could not open converter from “UTF-8” to “BRUH” pkexec must be setuid root
Very interesting video explanation. Thank you! I tried running this on my local Debian system and got this:
$ ./pwnkit
pkexec --version |
--help |
--disable-internal-agent |
[--user username] PROGRAM [ARGUMENTS...]
See the pkexec manual page for more details.
$
So apparently it did not escalate me to root. But I don't think I updated recently enough to be protected. If this is of interest, I can provide more info.
I've never seen a compiler do this before.
rm -rf 'GCONV_PATH=.' pwn pwnkit
mkdir 'GCONV_PATH=.'
touch GCONV_PATH=.\/pwn
chmod +x GCONV_PATH=.\/pwn
mkdir pwn
echo 'module UTF-8// BRUH// conversion-mod 1' > pwn/gconv-modules
clang-15 -shared -fPIC -o pwn/conversion-mod.so conversion-mod.c
clang-15 -o pwnkit pwnkit.c
/usr/bin/ld: cannot find /tmp/pwnkit-fb42a6.o: Invalid argument
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make: *** [Makefile:14: pwnkit] Error 1
This happens with gcc 11.2 as well as clang 15. Compiling other programs (including entire game engines) works fine. Changing it so that it compiles with -c
to a local object file makes no difference - file pwnkit.o
doesn't even pick it up as an ELF or COFF or whatever file either, just as a normal file.
I've never seen this before, it's super weird. Further, after a few executions, trying to remove the .o
file causes a Permission Denied error, even when run as root - ownership shows as the current user/group with adequate permissions. I've inspected the code and there doesn't appear to be anything out of the ordinary. Trying to rm
it causes it to zero it out - the file isn't removed.
I don't have Docker available (this is WSL) so I can't test it there, but this is the weirdest behavior I've ever seen coming from compilers. Is this (ab)using something strange in C somehow that I'm missing?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.