arthepsy/CVE-2021-4034
FreePoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034)
FreeFree tier
About arthepsy/CVE-2021-4034
This repository contains a proof-of-concept (PoC) exploit for CVE-2021-4034, also known as PwnKit, a local privilege escalation vulnerability in polkit's pkexec. The exploit is implemented as a single C source file (cve-2021-4034-poc.c) that compiles with gcc on Linux systems. It has been verified to work on Debian 10 (Buster) and CentOS 7, where running the compiled binary as a regular user escalates privileges to root. The repository includes a README with compilation instructions and demonstration outputs, as well as links to the original disclosure and Qualys analysis.
Key Features
Proof-of-concept exploit for CVE-2021-4034 (PwnKit)
Single-file C source code
Compiles with gcc on Linux
Demonstrates privilege escalation from unprivileged user to root
Verified on Debian 10 (Buster) and CentOS 7
Open source and publicly available on GitHub
Pros & Cons
Pros
- Simple and lightweight C source, easy to compile and run
- Verified on multiple Linux distributions (Debian 10, CentOS 7)
- Clear demonstration of root privilege escalation with output logs
- Open source; code can be inspected and modified
Cons
- Requires local access to the target system
- May be flagged by antivirus or security software as malware
- Only a proof-of-concept; not a general-purpose exploit tool
- Verified only on specific OS versions; may not work on patched or different systems
Best For
Security research and vulnerability testingDemonstrating the impact of CVE-2021-4034Understanding local privilege escalation via polkit pkexecTesting system security and patch status
FAQ
What is CVE-2021-4034 (PwnKit)?
CVE-2021-4034 is a local privilege escalation vulnerability in polkit's pkexec utility. It allows an unprivileged user to gain root privileges by exploiting a memory corruption issue.
How do I compile and run this PoC?
Compile the C source file with gcc: 'gcc cve-2021-4034-poc.c -o cve-2021-4034-poc'. Then run the resulting binary as an unprivileged user. If the system is vulnerable, you will obtain a root shell.
Which Linux distributions are supported?
The PoC has been verified on Debian 10 (Buster) and CentOS 7. It may work on other distributions with an unpatched version of polkit, but this is not guaranteed.
Is this tool safe to run on production systems?
No. This is an exploit that escalates privileges to root. Running it on production systems could cause instability or security breaches. Use only in controlled, authorized environments for testing.