CovertSwarm demonstrating a full remote ‘root’ attack chain – enabled by Log4Shell (CVE-2021-44228) + PwnKit (CVE-2021-4034)
Over the past months there were several releases of new CVE’s, two of which especially have a major impact on modern systems. Today we are showing how easy it can be to go from an unauthenticated user to system access with root privileges within minutes. This is done by exploiting log4j (CVE-2021-44228) along with Polkit’s pkexec binary (CVE-2021-4034).
Proof of Concept Exploit
The vulnerable setup can be found in this github
Description
Credit: Fastly
The log4j vulnerability is present in the X-Api-Header and will be exploited by supplying an attacker-controlled LDAP Server that will in turn redirect the victim to load a malicious Java class. When the victim parses the new component and executes the payload supplied by the attacker, this causes remote code execution in the context of the user that runs the vulnerable application.
Going further with this, on compromise of the underlying operation system, the attacker attempts to gain root privileges by exploiting the Policy Kit pkexec binary. Since the vulnerability was present on the operation system the attacker obtains root privileges within minutes of gaining the initial foothold on the operation system.
Remediation
Vendor patches have been released for both vulnerabilities and it is recommended to patch the vulnerable systems immediately. A temporary solution for the Policy Kit exploit is to change the permissions of the present pkexec binary
chmod 0755 /usr/bin/pkexec
If the binary is not present at this path you can try to locate it with the following command
find / - name *’pkexec’* 2>/dev/null
References
https://www.covertswarm.com/post/critical-0-day-security-vulnerability-log4shell-rce
https://www.covertswarm.com/post/critical-0-day-vulnerability-in-polkit-pkexec-component
What is patch management and what are the benefits?
Read our blog to find out what patch management is, why organizations need it, best practices & some commonly asked questions.
Digital Forensics and Incident Response (DFIR): the ultimate guide
Read our complete guide on Digital Forensics & Incident Response (DFIR) to find out what it is, why it’s important, how it works & more!
Denial of Service (DoS) attacks: a complete guide
Read our complete guide to find out what Denial Of Service (DoS) attacks are, how they work & how to identify, respond to & prevent them.