devianntsec/CVE-2021-4034

GitHubRepository PoCExploit

PoC files

13 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based exploit for CVE-2021-4034 (PwnKit) that automates the creation, compilation, and execution of a local privilege escalation chain against polkit's pkexec. It includes multiple payloads (shell, backdoor, reverse shell, etc.) and a detailed technical writeup.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README, an exploitation chain analysis document, and a Python exploit script for CVE-2021-4034 (PwnKit). All code and documentation describe legitimate local privilege escalation exploit behavior against the stated target (polkit's pkexec). The Python script provides multiple payloads (shell, backdoor_suid, add_root_user, reverse_shell, custom) that are standard post-exploitation actions performed with the elevated privileges obtained from the exploit. No concealed, deceptive, or operator-directed harm unrelated to the exploit's stated purpose was observed. The artifact does not contain hidden credential theft, unrelated remote access, persistence mechanisms beyond those explicitly documented as post-exploitation options, or any other backdoor behavior.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPythonC
Target softwarepolkitpkexec
Attack typesLocal Privilege EscalationOut-of-bounds WriteShared Library Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script (exploit/pwnkit.py) that automates the full exploitation chain for CVE-2021-4034. It generates, compiles, and executes C code to trigger the vulnerability and run attacker-chosen payloads (e.g., root shell, backdoor). This is code intended to exercise a vulnerability, not merely detect it.

exploit/pwnkit.py:1-476README.md:31

Requirements

  • Linux system with vulnerable polkit (version 0.105 or earlier)README.md:70
  • GCC compiler installedREADME.md:71
  • Python 3.6+README.md:72
  • Standard user account (no root required)README.md:73

Observed behavior

  • Generates and compiles a malicious shared library (pwnkit.so) with a payload (e.g., spawning a root shell, creating a SUID backdoor, adding a root user, or initiating a reverse shell).exploit/pwnkit.py:85-281exploit/pwnkit.py:320-332
  • Generates and compiles a helper executable (cve-2021-4034) that triggers the out-of-bounds write in pkexec by calling execve with an empty argv.exploit/pwnkit.py:297-318exploit/pwnkit.py:329-332
  • Sets up the required GCONV_PATH directory structure and gconv-modules configuration file to enable shared library loading by pkexec.exploit/pwnkit.py:334-349
  • Executes the compiled helper binary, which triggers the vulnerability in pkexec, leading to the execution of the attacker's payload with root privileges.exploit/pwnkit.py:351-368
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Payloads
shell, id, whoami, backdoor_suid, add_root_user, reverse_shell, customThe Python script (exploit/pwnkit.py) offers multiple payloads that are standard post-exploitation actions executed with root privileges obtained via the CVE-2021-4034 exploit. These are explicitly documented and user-selectable.exploit/pwnkit.py:90-279README.md:100-108
Post Exploitation Actions
SUID backdoor creation, root user addition, reverse shellThe README and script document post-exploitation modules (SUID backdoor, root user creation, reverse shell) that are part of the exploit's multi-payload framework. These are not hidden; they are presented as features of the exploit.README.md:31-33exploit/pwnkit.py:150-262
Review boundaries

What the analysis did not establish

  • The evidence includes only three text files (README.md, exploitation chain analysis, and the Python exploit). The repository contains 10 other files (including 7 non-text media files and 3 unclassified files) that were not provided, so the analysis is based on a subset of the artifact.
  • The evidence was not executed; classification is based solely on static analysis of the provided source code and documentation.
  • 7 non-text media files (screenshots) were not analyzed; they are described as exploitation demonstrations in the README.
  • 3 text files (docs/analysis/01-root-cause.md, docs/analysis/03-timeline.md, LICENSE) were not included in the evidence packet.
  • 3 unclassified files (binary or other) were not analyzed.
  • The review is limited to the supplied evidence and does not verify the behavior of compiled binaries or the exploit at runtime.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1