1

I've managed to elevate privileges on a Linux machine (3.19) using pkexec, but I don't understand the mechanics. /usr/bin/pkexec has the SUID bit set (which is normal, I gather), and simply using it to invoke /bin/sh and authenticating with my low-priv user results in root privileges.

How this works and how to prevent it are unclear to me. I've read up on pkexec (and polkit), but I just don't get it. Any explanation would be helpful.

Improve this question
2
  • Could you please specify exactly what you've done so far? Pkexec runs a program as a different user. Are you exploiting a vulnerable version of the binary? How did you achieve elevated privilege?
    – Daisetsu
    Mar 25, 2019 at 6:09
  • I had simply run "/usr/bin/pkexec /bin/sh". This required authentication and resulted in a root shell. The user is in the sudo group but can't use sudo on the system. Anyone in this group, however, can apparently make use of pkexec to gain administrative capabilities.
    – user3347901
    Mar 25, 2019 at 8:08

1 Answer 1

Reset to default
3

Configuration, basically.

If you're on Ubuntu, have a look in /etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf:

 [Configuration]
 AdminIdentities=unix-group:sudo;unix-group:admin

Any member of the unix groups sudo or admin can use pkexec to gain administrative capabilities. The user created during installation of Ubuntu is a member of those groups, as it is the system administrator. If you create a new user that is not member of those groups, it cannot use pkexec.

man polkit gives you some information about how to configure policy kit.

Improve this answer
1
  • I hadn't managed to find that configuration file. I didn't realize that sudo membership was the key here. The user is a member of the sudo group but doesn't have sudo privileges on this machine, which of course doesn't make any sense. So the fix is simply is to edit the sudo group or edit the polkit config.
    – user3347901
    Mar 25, 2019 at 8:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .