Technical Information
Malicious functions:
Gains root privileges
Compiles a program from source codes:
- gcc pwnkit/pwnkit.c -o pwnkit/pwnkit.so -shared -fPIC
Launches processes:
- mkdir -p GCONV_PATH=.
- touch GCONV_PATH=./pwnkit
- chmod a+x GCONV_PATH=./pwnkit
- mkdir -p pwnkit
- /usr/bin/pkexec (null
- rm -rf GCONV_PATH=. pwnkit
Performs operations with the file system:
Modifies file access rights:
- /root/GCONV_PATH=./pwnkit
- /root/pwnkit/pwnkit.so
Creates folders:
- /root/GCONV_PATH=.
- /root/pwnkit
Creates or modifies files:
- /root/GCONV_PATH=./pwnkit
- /root/pwnkit/gconv-modules
- /root/pwnkit/pwnkit.c
- /tmp/cckVImpk.s
- /tmp/cchlJTvt.o
- /tmp/ccgpCdLD.res
- /tmp/ccF7nqfs.c
- /tmp/ccp9DFUC.o
- /tmp/ccMMa6zN.ld
- /tmp/cclEdHfY.le
- /root/pwnkit/pwnkit.so
Deletes files:
- /tmp/ccMMa6zN.ld
- /tmp/cclEdHfY.le
- /tmp/ccF7nqfs.c
- /tmp/ccp9DFUC.o
- /tmp/ccgpCdLD.res
- /tmp/cchlJTvt.o
- /tmp/cckVImpk.s
- /root/pwnkit
Other:
Collects RAM information