Skip to content

Commit 0c769bd

Browse files
ArusekkArusekk
committed
Add cat2 to shellcraft (#1995)
* Introduce shellcraft.linux.cat2 to avoid sendfile Fixes #1871 * Switch CAT_PROC_MAPS_EXIT to shellcraft.linux.cat2
1 parent e80a697 commit 0c769bd

File tree

14 files changed

+150
-15
lines changed

14 files changed

+150
-15
lines changed

‎pwnlib/elf/elf.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -767,7 +767,7 @@ def _patch_elf_and_read_maps(self):
767767
>>> for arch in CAT_PROC_MAPS_EXIT:
768768
... context.clear()
769769
... with context.local(arch=arch):
770-
... sc = shellcraft.cat("/proc/self/maps")
770+
... sc = shellcraft.cat2("/proc/self/maps")
771771
... sc += shellcraft.exit()
772772
... sc = asm(sc)
773773
... sc = enhex(sc)

‎pwnlib/elf/maps.py

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,25 +3,25 @@
33
# Pre-assembled shellcode for each architecture.
44
#
55
# This is literally the output of:
6-
# shellcraft $ARCH.linux.cat /proc/self/maps
6+
# shellcraft $ARCH.linux.cat2 /proc/self/maps
77
# shellcraft $ARCH.linux.syscalls.exit 0
88
CAT_PROC_MAPS_EXIT = {
99
'i386':
10-
'680101010181342460717201686c662f6d68632f7365682f70726f89e331c931d26a0558cd806a015b89c131d268ffffff7f5e31c0b0bbcd80'
10+
'680101010181342460717201686c662f6d68632f7365682f70726f89e331c931d2b6406a0558cd8029d489c389e16a0358cd806a015b89e189c26a0458cd80'
1111
'31db6a0158cd80',
1212
'amd64':
13-
'48b801010101010101015048b86d672e6c607172014831042448b82f70726f632f7365506a02584889e731f6990f0541baffffff7f4889c66a28586a015f990f05'
13+
'48b801010101010101015048b86d672e6c607172014831042448b82f70726f632f7365506a02584889e731d2b64031f60f054829d44889c731c04889e60f054889c26a01586a015f4889e60f05'
1414
'31ff6a3c580f05',
1515
'arm':
16-
'617007e3737040e304702de56c7606e32f7d46e304702de5637f02e3737546e304702de52f7007e3727f46e304702de50d00a0e1011021e0022022e00570a0e3000000ef0010a0e10100a0e3022022e00231e0e3bb70a0e3000000ef'
16+
'617007e3737040e304702de56c7606e32f7d46e304702de5637f02e3737546e304702de52f7007e3727f46e304702de50d00a0e1011021e00129a0e30570a0e3000000ef02d04de00d10a0e10370a0e3000000ef0020a0e10100a0e30d10a0e10470a0e3000000ef'
1717
'000020e00170a0e3000000ef',
1818
'thumb':
19-
'004f01e0617073ff4fea07274fea172780b4dff8047001e06c662f6d80b4dff8047001e0632f736580b4dff8047001e02f70726f80b4684681ea010182ea02024ff0050741df05464ff00100294682ea02026ff000434ff0bb0741df'
19+
'004f01e0617073ff4fea07274fea172780b4dff8047001e06c662f6d80b4dff8047001e0632f736580b4dff8047001e02f70726f80b4684681ea01014ff480424ff0050741dfadeb020d69464ff0030741df02464ff0010069464ff0040741df'
2020
'80ea00004ff0010741df00bf',
2121
'mips':
22-
'726f093c2f702935f0ffa9af7365093c632f2935f4ffa9af2f6d093c6c662935f8ffa9af8cff193c9e8f393727482003fcffa9aff0ffbd272020a003ffff0528ffff0628a50f02340c010101feff192427202003fcffa2affcffa58fffff0628ff7f073cffffe7346f1002340c010101'
22+
'726f093c2f702935f0ffa9af7365093c632f2935f4ffa9af2f6d093c6c662935f8ffa9af8cff193c9e8f393727482003fcffa9aff0ffbd272020a003ffff0528ffbf192427302003a50f02340c01010122e8a603fcffa2affcffa48f2028a003a30f02340c010101feff1924272020032028a003fcffa2affcffa68fa40f02340c010101'
2323
'ffff0428a10f02340c010101',
2424
'aarch64':
25-
'ee058ed24eeeadf26eecc5f26eaeecf28fcd8cd2efa5adf22f0ccef26f0ee0f2ee3fbfa980f39fd2e0ffbff2e0ffdff2e0fffff2e1030091e2031faae3031faa080780d2010000d4e10300aa200080d2e2031faae3ff9fd2e3ffaff2e80880d2010000d4'
25+
'ee058ed24eeeadf26eecc5f26eaeecf28fcd8cd2efa5adf22f0ccef26f0ee0f2ee3fbfa980f39fd2e0ffbff2e0ffdff2e0fffff2e1030091e2031faa080780d2010000d4020088d2ff6322cbe1030091e80780d2010000d4e20300aa200080d2e1030091080880d2010000d4'
2626
'e0031faaa80b80d2010000d4',
2727
}

‎pwnlib/shellcraft/templates/aarch64/linux/cat2.asm

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<%
2+
from pwnlib import shellcraft
3+
%>
4+
<%page args="filename, fd=1, length=0x4000"/>
5+
<%docstring>
6+
Opens a file and writes its contents to the specified file descriptor.
7+
Uses an extra stack buffer and must know the length.
8+
9+
Example:
10+
11+
>>> f = tempfile.mktemp()
12+
>>> write(f, 'This is the flag\n')
13+
>>> shellcode = shellcraft.cat2(f) + shellcraft.exit(0)
14+
>>> run_assembly(shellcode).recvline()
15+
b'This is the flag\n'
16+
</%docstring>
17+
<%
18+
if fd == 'x0':
19+
raise Exception("File descriptor cannot be x0, it will be overwritten")
20+
%>
21+
${shellcraft.open(filename)}
22+
${shellcraft.mov('x2', length)}
23+
sub sp, sp, x2
24+
${shellcraft.read('x0', 'sp', 'x2')}
25+
${shellcraft.write(fd, 'sp', 'x0')}

‎pwnlib/shellcraft/templates/aarch64/linux/open.asm

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<%
22
from pwnlib import shellcraft
33
%>
4-
<%page args="filename, flags='O_RDONLY', mode=0"/>
4+
<%page args="filename, flags='O_RDONLY', mode='x3'"/>
55
<%docstring>
66
Opens a file
77
</%docstring>

‎pwnlib/shellcraft/templates/amd64/linux/cat.asm

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,5 +8,5 @@ Opens a file and writes its contents to the specified file descriptor.
88
</%docstring>
99

1010
${pushstr(filename)}
11-
${syscall('SYS_open', 'rsp', 'O_RDONLY', 0)}
12-
${syscall('SYS_sendfile', fd, 'rax', 0, 0x7fffffff)}
11+
${syscall('SYS_open', 'rsp', 'O_RDONLY', 'rdx')}
12+
${syscall('SYS_sendfile', fd, 'rax', 0, 0x7fffffff)}

‎pwnlib/shellcraft/templates/amd64/linux/cat2.asm

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<%
2+
from pwnlib.shellcraft.amd64 import syscall, pushstr
3+
from pwnlib.shellcraft import common
4+
%>
5+
<%page args="filename, fd=1, length=0x4000"/>
6+
<%docstring>
7+
Opens a file and writes its contents to the specified file descriptor.
8+
Uses an extra stack buffer and must know the length.
9+
</%docstring>
10+
11+
${pushstr(filename)}
12+
${syscall('SYS_open', 'rsp', 'O_RDONLY', length)}
13+
sub rsp, rdx
14+
${syscall('SYS_read', 'rax', 'rsp', 'rdx')}
15+
${syscall('SYS_write', fd, 'rsp', 'rax')}

‎pwnlib/shellcraft/templates/arm/linux/cat.asm

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,5 @@ Example:
1515

1616
</%docstring>
1717
${arm.pushstr(filename)}
18-
${arm.linux.open('sp', int(constants.O_RDONLY), 0)}
18+
${arm.linux.open('sp', int(constants.O_RDONLY), 'r2')}
1919
${arm.linux.sendfile(fd, 'r0', 0, 0x7fffffff)}

‎pwnlib/shellcraft/templates/arm/linux/cat2.asm

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<%
2+
from pwnlib import constants
3+
from pwnlib.shellcraft import arm
4+
%>
5+
<%page args="filename, fd=1, length=0x4000"/>
6+
<%docstring>
7+
Opens a file and writes its contents to the specified file descriptor.
8+
Uses an extra stack buffer and must know the length.
9+
10+
Example:
11+
12+
>>> f = tempfile.mktemp()
13+
>>> write(f, 'FLAG\n')
14+
>>> run_assembly(shellcraft.arm.linux.cat2(f)).recvline()
15+
b'FLAG\n'
16+
17+
</%docstring>
18+
${arm.pushstr(filename)}
19+
${arm.linux.open('sp', int(constants.O_RDONLY), length)}
20+
sub sp, r2
21+
${arm.linux.read('r0', 'sp', 'r2')}
22+
${arm.linux.write(fd, 'sp', 'r0')}

‎pwnlib/shellcraft/templates/i386/linux/cat.asm

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ label = common.label("sendfile_loop")
1919
%>
2020

2121
${sc.pushstr(filename)}
22-
${sc.open('esp', 'O_RDONLY', 0)}
22+
${sc.open('esp', 'O_RDONLY', 'edx')}
2323
${sc.sendfile(fd, 'eax', 0, 0x7fffffff)}

‎pwnlib/shellcraft/templates/i386/linux/cat2.asm

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<%
2+
import pwnlib.shellcraft as sc
3+
from pwnlib.shellcraft import common
4+
%>
5+
<%page args="filename, fd=1, length=0x4000"/>
6+
<%docstring>
7+
Opens a file and writes its contents to the specified file descriptor.
8+
Uses an extra stack buffer and must know the length.
9+
10+
Example:
11+
12+
>>> f = tempfile.mktemp()
13+
>>> write(f, 'FLAG')
14+
>>> run_assembly(shellcraft.i386.linux.cat2(f)).recvall()
15+
b'FLAG'
16+
17+
</%docstring>
18+
19+
${sc.pushstr(filename)}
20+
${sc.open('esp', 'O_RDONLY', length)}
21+
sub esp, edx
22+
${sc.read('eax', 'esp', 'edx')}
23+
${sc.write(fd, 'esp', 'eax')}

‎pwnlib/shellcraft/templates/mips/linux/cat.asm

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,5 @@ label = common.label("sendfile_loop")
2222
%>
2323

2424
${mips.pushstr(filename)}
25-
${mips.open('$sp', int(constants.O_RDONLY), 0)}
25+
${mips.open('$sp', int(constants.O_RDONLY), '$a2')}
2626
${mips.sendfile(fd, '$v0', 0, 0x7fffffff)}

‎pwnlib/shellcraft/templates/mips/linux/cat2.asm

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<%
2+
from pwnlib import constants
3+
from pwnlib.shellcraft import mips
4+
from pwnlib.shellcraft import common
5+
%>
6+
<%page args="filename, fd=1, length=0x4000"/>
7+
<%docstring>
8+
Opens a file and writes its contents to the specified file descriptor.
9+
Uses an extra stack buffer and must know the length.
10+
11+
Example:
12+
13+
>>> f = tempfile.mktemp()
14+
>>> write(f, 'FLAG')
15+
>>> sc = shellcraft.mips.linux.cat2(f)
16+
>>> sc += shellcraft.mips.linux.exit(0)
17+
>>> run_assembly(sc).recvall()
18+
b'FLAG'
19+
20+
</%docstring>
21+
22+
${mips.pushstr(filename)}
23+
${mips.open('$sp', int(constants.O_RDONLY), length)}
24+
sub $sp, $a2
25+
${mips.read('$v0', '$sp', '$a2')}
26+
${mips.write(fd, '$sp', '$v0')}

‎pwnlib/shellcraft/templates/thumb/linux/cat.asm

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,6 @@ label = common.label("sendfile_loop")
2020
%>
2121

2222
${thumb.pushstr(filename)}
23-
${thumb.linux.open('sp', constants.O_RDONLY, 0)}
23+
${thumb.linux.open('sp', constants.O_RDONLY, 'r2')}
2424
${thumb.mov('r5', 'r0')}
2525
${thumb.linux.sendfile(fd, 'r5', 0, 0x7fffffff)}

‎pwnlib/shellcraft/templates/thumb/linux/cat2.asm

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<%
2+
from pwnlib import constants
3+
from pwnlib.shellcraft import thumb
4+
from pwnlib.shellcraft import common
5+
%>
6+
<%page args="filename, fd=1, length=0x4000"/>
7+
<%docstring>
8+
Opens a file and writes its contents to the specified file descriptor.
9+
Uses an extra stack buffer and must know the length.
10+
11+
Example:
12+
13+
>>> f = tempfile.mktemp()
14+
>>> write(f, 'FLAG\n')
15+
>>> run_assembly(shellcraft.arm.to_thumb()+shellcraft.thumb.linux.cat2(f)).recvline()
16+
b'FLAG\n'
17+
18+
</%docstring>
19+
20+
${thumb.pushstr(filename)}
21+
${thumb.linux.open('sp', constants.O_RDONLY, length)}
22+
sub sp, r2
23+
${thumb.linux.read('r0', 'sp', 'r2')}
24+
${thumb.linux.write(fd, 'sp', 'r0')}

0 commit comments

Comments
 (0)