CVE-2021-4034 Vulnerability

The PwnKit vulnerability is a classic case of improper input handling. The pkexec tool doesn't correctly process the number of command-line arguments it receives. By crafting a specific set of arguments, an attacker can trick pkexec into executing an arbitrary environment variable as a command. Because pkexec is a SUID-root binary, that command runs with root privileges. The exploit is reliable, architecture-independent, and works on default installations of most Linux distributions.

Tactics, Techniques & Procedures (TTPs)

An attacker first needs to gain initial access to a target machine as a low-privileged user. This could be through another exploit, a weak password, or a compromised web application. Once they have that foothold, they run the PwnKit exploit locally. It's a one-shot command. This immediately escalates their privileges to root, allowing them to disable security tools, install persistent backdoors, steal sensitive data, or pivot to other systems on the network.

Indicators of Compromise

Detection can be tricky since a successful exploit looks like a legitimate use of pkexec. However, logs may show pkexec being called with unusual or empty arguments. You might see entries in the system logs stating "The value for the SHELL variable was not found." A good EDR solution can flag the anomalous process execution chain. Running the pkexec --version command can also tell you if you're running a vulnerable version.

Known Proof-of-Concepts & Exploits

Proof-of-concept exploits for PwnKit became public almost immediately after disclosure. They are simple, highly reliable, and widely available. Malicious actors, including ransomware groups and APTs, quickly integrated PwnKit into their toolkits as a go-to method for privilege escalation on Linux systems.