Vulnerable Sandbox 2.0

import socket,subprocess,string,random

class Handler(__import__('threading').Thread):
    def __init__(self, file_desc):
        super(Handler, self).__init__()
        self.file_desc = file_desc
    def run(self):
        subprocess.call(['/usr/bin/env', 'python', '/tmp/pyshell.py'],stdin=self.file_desc,stdout=self.file_desc,stderr=self.file_desc)

def main():
    data = 'x\xda\x9dUK\x8f\x9c8\x10\xbe\xf3+*\x9a\x03\xdd\xab\xd9\x16\xd0\x0f R\xe66\xab\x8dVJr\x88\x94C\x121\x85]\x0c\xa8\xc1n\xd9fz\xf8\xf7)\xa0\xa1\x93\xcdDD\xf1\x01\xd9\xf5\xf8\xaa\\\xf5\x95\xb9\xb9\x81\x7f\xdf\xbe\xfb\xf8\x1a\\IP\xa2-\xc9\x02\x1a\x02\x83J\xea\x06$:\xbc\x05\xa9Ai\x07g\xb4\x8e\xc0U\r\x810(\x8e\x95z\xec\xdd\x9aM\xff\xed\xe0\x91\x1c\x18:\xd5(\x18\xe3\\\xb9\x124\xcb\rX\xd7\x16\x05\xa0\xea\xce\xd8Y\xeff\nX\x15\xd0\xe9\x96\xb1\x95\xef\xe0\xa8\xf4\x19\xce%\xba!\x0f\xcc\xf5\x13gS)\x07\r\xa1\xb2\xb7,E\xe7[x4\x84n3\xf8\xd9R\xb7\xb5\xec}Kdc\x84\x93\xd1yM\x8dW\x18\xce;\xcb\x8a\xd6\xb5\x86\xb2\x0c\xaa\xe6\xa4\x8dc5\xc3\xb1T\tWi5Z\xd9\xceNj\xeb\xa4n\x1d\xa0\x05\x11\xec\xa8Hp+\xf6$\xf7\x01\x06"\n\xf3\x98"\x92a\x9e&"\x0c\xa7\x00y[\xd5\xaeR\xd7\x08\xf7\xef\xff\xb97F\x9b\x1e\x04E\xbaO\xe3b+\x92h\xb7O\x83\x980\x0e1Ie*\xb7\xa9\x0c\x12\xfa%\x88\xc1sV\xa9\xd3\x98J\x1eo\x0f\xd1AFa\x11&I\x9c&E\xbc\xdf\x8a]"P\x84i\x18\xc9\xe0\x97(\xffQ\x97k4\xf2\xadrdL{\x1a\xd0\x08\xd3t\x9b\xd2!a\xd74\xd8FQt\xd8\xc6\x8cTH<\xe0. o(\xd1\xca\xff\xdb\xff+\x0c\x82\xf5t\xfcD\xb5\xd0\xdcr\xa7\xa1\xe9\xe0C\xe7J\xad\xc02=r\xfd\xfc\n\xee\xfb\x08\xc0\x06\rK8c\xaa\xf5\xf9\x95?;\x7f\xa8\t-\xf5\xec\xa1\xa1\x87\xfc\xa9\xb8\xe6\x16N#\xce\x96y!\x87\x9e\xdbN9|\xeeU\x0f\xa3\xef\x17\xbf\xd0:G\xf3\xc5_?\x0cV\x0f=\x07\x07\x1d\\u\x0fp\r6%\xbe\xd4\xc1MQ\xb7\xb6\\\xad\xbd\x1c\x95"\to\xe0\xb3\x07\xbc\xfc\xb1z\xfe\xedx\xa2g\x12\xf3\xfe\t\xebi\x7f\xaa\xc4\xb1\xa6\xe9\xa4\xed\xb4\xb3m\xce\x1cd\xf2\xcf\x92#=U\\\xabV\x1cg\xd1\xd0\xdb\xe90\xc6\x9fN\xc2tl\xdb@\xa3\xcd\x8c\xce\x0c\x9d\xb6EN\x01\xc6\xf9\xbe\xa0(\xa6\x84\xb9%1\x0fw\x94\xeeEX\xc4\xa28\xcc0\x0b\xb7\x9f\xec\x96(:\'\xb9@\xc2\xb9D\x0b\xf4\xf2\xbd\xaf\x9eC\xc3\xaf\x84\xe5\x8a\xcf\xa4\xb5Y\xb6\xc92Y\t\xc7\x9b#u\x96\xfbr1\xdb\x18j\xf8!X\xf9\xf3P\xf8?\xeb\xa6\xa9{A\xf5\xd3\x14\xbc`3P\x87\xe5\x05\xcf-\xb3O\xc1\xc5\xe0\xf5p)I\xf5\xcb\x99~~\xfe\xea\xf5\xca\x8b\xb5w.\xab\x9a \x1c\xbd\x9c\xe9\xc6M\xbf.\xdc\xbc\xbb\xbb\xf3oI\xc97~O\xd8I\xf9\xdbL\x9d\x1c\x96H\xc0\x95]\xea\xd7j\xbd\xb1\xceT\'F\xbd\xc2\xf2\xed\x95\xee\xaf?R\xf2\x9a~\xbf\xf8\xa5Vz\xc3\x83Mf\xb5\xee\x8d\x96\xb2\x98l\x7f\x84\xf9\xae\x1a\xef4\xe4-)\xfd])\xfe\xb8$\xd3\xca\xf9\xdfp\x9c\xa5T[\xfa1|?\xce\x8b\x99{\xa3\xa5\xa0\xfe\xc9\\\x18\x90+\xfc5\xf4\xc5ui\x16\xfe\xe7\xfa\r\xd3{:\x12'
    data = __import__('zlib').decompress(data)
    data = data.replace('ac9597f3c8245907ea71a89d9d39d08e', ''.join( [random.choice(string.letters) for i in xrange(15)]))
    data = data.replace('b73626d21f188798f753c48cac1912d0', ''.join( [random.choice(string.letters) for i in xrange(15)]))
    data = data.replace('ea9939e6812d903222637c19fda6a40e', ''.join( [random.choice(string.letters) for i in xrange(15)]))
    data = data.replace('c04ef8a3c5ed50a0c21b7e2ed1b98c11', ''.join( [random.choice(string.letters) for i in xrange(15)]))
    data = data.replace('fbe0a7b5fe27e87f3dab14e95c1f7cf6', ''.join( [random.choice(string.letters) for i in xrange(15)]))
    file('/tmp/pyshell.py','w').write(data)
    try:
        s=socket.socket(2,1)
        s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        s.bind(('0.0.0.0',10000))
        s.listen(10000)
        while 1:
            con,addr=s.accept()
            print 'Got connection from: '+addr.__str__()
            thread_obj = Handler(con.fileno())
            thread_obj.start()
    except KeyboardInterrupt, EOFError:
        return
if __name__ == '__main__':
    main()