Post #1800939

2026-04-30 07:18 UTC

@sitharus@cloudisland.nz there’s also a few bytes to be saved in the embedded ELF you don’t really need exit() after execve() I’m not sure if the setuid call is necessary since it should already be executed with effective uid 0 the instructions that load constants into registers look like they could be using one byte less but I’m not enough of an assembly expert to say for sure And does it even make sense to count the payload as part of the exploit? In a real scenario that payload would likely be larger to do anything useful anyways That said, why are they even golfing the poc in the first place, it feels like they’re trying to create the impression that less bytes makes it better/scarier/easier to exploit

Replies (3)

@sitharus@cloudisland.nz 2026-04-30 08:40

@gwen@tech.lgbt I don't think a human wrote the Python at least, I haven't looked in to the ELF. It's clearly not machine minified, and if a human did that I'm very disappointed in them. Basic things like socket.recv doesn't throw since Python 3.5, so there's no need for the try. Even if you were targeting pre-3.5 you don't need it there. I agree that it's just trying to sound scary, but it doesn't need to be this obfuscated.

Open ##1800938
@gwen@tech.lgbt 2026-04-30 11:07

@sitharus@cloudisland.nz anyways here's a slightly shorter payload that does exactly the same 78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c16806010895951961f89f9fd5a3d79603c833fc96651d31939f553f29334fbf388301007f240dab or even shorter by taking advantage of linux zeroing registers despite this being AFAICT not required: 78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c168060108959519c1cfda6b0bd29a650d64ea2765e6e91767300000195c0a70

Open ##1805563
@diazona@techhub.social 2026-04-30 08:27

@gwen @sitharus "why are they even golfing the poc in the first place, it feels like they’re trying to create the impression that less bytes makes it better/scarier/easier to exploit" 😂 totally true though... I was also quite confused by their choice on that matter

Open ##1888681