PwnKit (CVE-2021-4034 polkit)

./PwnKit

Exploits CVE-2021-4034 (PwnKit): a pkexec (polkit) flaw that escalates to root on any Linux distribution with pkexec present, without credentials and without interaction. The binary runs and drops you a root shell.

When the host has pkexec (almost all Linux with desktop or systemd) and the polkit package is unpatched (version <= 0.120). It's the most reliable exploit of recent years: works on Ubuntu, Debian, CentOS, Fedora, RHEL, and not macOS (Linux only), independent of kernel version. Run the binary and done.

If polkit is updated (>= 0.120 with the January 2022 patch), it won't work. Also not if pkexec is not installed (minimal containers, distros without polkit). On glibc >= 2.34 with certain mitigations, some PoCs fail: try a variant with controlled argv[0].