bluedragonsecurity/CVE-2011-1485-pkexec-exploit

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A shell script that compiles and executes a race condition exploit against CVE-2011-1485 in PolicyKit 0.96. It creates a setuid helper, then uses a race between pkexec and a forked process monitoring /proc to change ownership and set the setuid bit on the helper, ultimately spawning a root shell.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a shell script (pkexec.sh) that compiles and executes a local privilege escalation exploit for CVE-2011-1485. The script creates two C programs (suid.c and makesuid.c), compiles them, and uses the race condition to set a SUID binary. All actions are consistent with the stated exploit purpose; no concealed backdoor, unrelated payload, or operator-directed harm is observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagesshellc
Target softwarePolicyKitpolkitpkexec
Attack typesrace conditionprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains executable code that compiles and runs a race condition to escalate privileges and spawn a root shell, which is the definition of an exploit.

pkexec.sh:103-162README.md:1-3

Requirements

  • Local access to a system running PolicyKit 0.96 with pkexec and polkitd.pkexec.sh:5-13
  • Compiler (gcc) and standard build tools available on the target.pkexec.sh:157-158

Observed behavior

  • Writes and compiles a setuid helper (suid.c) that executes arbitrary commands as root.pkexec.sh:103-122pkexec.sh:157
  • Writes and compiles a race condition launcher (makesuid.c) that forks a child to monitor /proc and a parent to execute pkexec.pkexec.sh:126-154pkexec.sh:158
  • Executes the race condition launcher to change ownership and set the setuid bit on the helper binary.pkexec.sh:159-160
  • Spawns a root shell via the now setuid helper.pkexec.sh:161-162
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The script compiles and runs a local privilege escalation exploit targeting polkit 0.96 via a race condition.The behavior matches the described CVE-2011-1485 exploit and does not include unrelated backdoor activity.pkexec.sh:103-162
Review boundaries

What the analysis did not establish

  • Evidence is limited to the source code; no runtime output or verification of successful exploitation is provided.
  • The exploit targets a specific old version (0.96) and kernel; effectiveness on other versions is not demonstrated.
  • Only the two text files (README.md and pkexec.sh) were reviewed; no binary files were present or analyzed.
  • The review does not assess whether the exploit works as claimed or is safe to execute.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1