From f3495c48e920f2e445674984dbcba2f142ee48a3 Mon Sep 17 00:00:00 2001 From: Kevin Pham <37129444+deoxykev@users.noreply.github.com> Date: Wed, 2 Feb 2022 21:30:43 -0800 Subject: [PATCH 1/2] Update 1_system_information.sh More robust implementation of pkexec binary modification time check with integer comparison instead of date regex grep. 1642035600 == Thursday, January 13, 2022 1:00:00 AM Which is when it was first patched. We have to check this way because the polkit version number is the same, patched & unpatched. --- linPEAS/builder/linpeas_parts/1_system_information.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linPEAS/builder/linpeas_parts/1_system_information.sh b/linPEAS/builder/linpeas_parts/1_system_information.sh index 44ec430..7717f6b 100644 --- a/linPEAS/builder/linpeas_parts/1_system_information.sh +++ b/linPEAS/builder/linpeas_parts/1_system_information.sh @@ -22,7 +22,7 @@ fi echo "" #-- SY) CVE-2021-4024 -if [ `command -v pkexec` ] && stat -c '%a' $(which pkexec) | grep -q 4755 && (stat -c '%y' $(which pkexec) | grep -qvE "2[0-9][2-9][3-9]-|2022-[0-1][2-9]-0[0-9]|2022-01-[2-3][0-9]|2022-01-1[2-9]" ) ; then +if [ `command -v pkexec` ] && stat -c '%a' $(which pkexec) | grep -q 4755 && [ "$(stat -c '%Y' $(which pkexec))" -lt "1642035600" ]; then echo "Vulnerable to CVE-2021-4024 (polkit privesc)" | sed -${E} "s,.*,${SED_RED_YELLOW}," fi From 52c2a1e11b5e1a632174fdb6d484dca03b744a22 Mon Sep 17 00:00:00 2001 From: Kevin Pham <37129444+deoxykev@users.noreply.github.com> Date: Wed, 2 Feb 2022 21:32:43 -0800 Subject: [PATCH 2/2] fix typo fix typo --- linPEAS/builder/linpeas_parts/1_system_information.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/linPEAS/builder/linpeas_parts/1_system_information.sh b/linPEAS/builder/linpeas_parts/1_system_information.sh index 7717f6b..9f3ed6f 100644 --- a/linPEAS/builder/linpeas_parts/1_system_information.sh +++ b/linPEAS/builder/linpeas_parts/1_system_information.sh @@ -21,9 +21,9 @@ else echo_not_found "sudo" fi echo "" -#-- SY) CVE-2021-4024 +#-- SY) CVE-2021-4034 if [ `command -v pkexec` ] && stat -c '%a' $(which pkexec) | grep -q 4755 && [ "$(stat -c '%Y' $(which pkexec))" -lt "1642035600" ]; then - echo "Vulnerable to CVE-2021-4024 (polkit privesc)" | sed -${E} "s,.*,${SED_RED_YELLOW}," + echo "Vulnerable to CVE-2021-4034 (polkit privesc)" | sed -${E} "s,.*,${SED_RED_YELLOW}," fi #--SY) USBCreator