Skip to content

Commit 477b8a8

Browse files
proleprole
committed
Merge branch 'master' of github.com:isislab/Shellcode
2 parents b648298 + 7ad13c0 commit 477b8a8

File tree

20 files changed

+631
-51
lines changed

20 files changed

+631
-51
lines changed

‎.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,5 @@ doxydoc/
1010
*.pro.*
1111
*.pyc
1212
Doxyfile
13+
*.pyc
14+
*.*~

‎lib_research/elf_notes

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
typedef struct {
2+
unsigned char e_ident[EI_NIDENT]; 0
3+
uint16_t e_type; 16
4+
uint16_t e_machine; 18
5+
uint32_t e_version; 20
6+
ElfN_Addr e_entry; 24
7+
ElfN_Off e_phoff; 28
8+
ElfN_Off e_shoff; 32
9+
uint32_t e_flags; 36
10+
uint16_t e_ehsize; 40
11+
uint16_t e_phentsize; 42
12+
uint16_t e_phnum; 44
13+
uint16_t e_shentsize; 46
14+
uint16_t e_shnum; 48
15+
uint16_t e_shstrndx; 50
16+
} ElfN_Ehdr;
17+
18+
19+
typedef struct {
20+
uint32_t p_type; 0
21+
Elf32_Off p_offset; 4
22+
Elf32_Addr p_vaddr; 8
23+
Elf32_Addr p_paddr; 12
24+
uint32_t p_filesz; 16
25+
uint32_t p_memsz; 20
26+
uint32_t p_flags; 24
27+
uint32_t p_align; 28
28+
} Elf32_Phdr;
29+
30+
typedef struct {
31+
uint32_t sh_name; 0
32+
uint32_t sh_type; 4
33+
uint32_t sh_flags; 8
34+
Elf32_Addr sh_addr; 12
35+
Elf32_Off sh_offset; 16
36+
uint32_t sh_size; 20
37+
uint32_t sh_link; 24
38+
uint32_t sh_info; 28
39+
uint32_t sh_addralign; 32
40+
uint32_t sh_entsize; 36
41+
} Elf32_Shdr;
42+
43+
typedef struct {
44+
uint32_t st_name; 0
45+
Elf32_Addr st_value; 4
46+
uint32_t st_size; 8
47+
unsigned char st_info; 12
48+
unsigned char st_other; 13
49+
uint16_t st_shndx; 14
50+
} Elf32_Sym;
51+

‎lib_research/gs.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,7 @@ void* getLibc(void);
66
void* gettextload(void);
77
void* getCode(void);
88
void* getpieload(void);
9+
void* getStringIndex(void);
10+
911

1012
#endif

‎lib_research/gs.s

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,28 @@
88
global getTLS
99
global getCode
1010
global getpieload
11+
global getStringIndex
12+
13+
%define EI_NIDENT 16
14+
15+
getStringIndex:
16+
push esi
17+
push edi
18+
call getLibc
19+
20+
xor edx,edx
21+
xor edi,edi
22+
mov di, WORD [eax + 50 ];e_shstrndx man elf line 237
23+
;; find section name string table
24+
mov esi, DWORD [eax + 32] ;e_shoff man elf line 192
25+
mov dx, WORD[eax + 46];e_shentsize man elf 227
26+
imul edi,edx
27+
lea esi,[esi+edi] ;should be pointing to the string index
28+
add eax,esi
29+
pop edi
30+
pop esi
31+
ret
32+
1133
1234
getTLS:
1335
mov eax,DWORD [gs:0]

‎lib_research/lib.c

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,13 @@
11
#include <stdio.h>
22
#include "gs.h"
33

4+
5+
#ifdef LIB
6+
extern void _start(void){
7+
main();
8+
}
9+
#endif
10+
411
extern void print_hello(void){
512
puts("hello");
613
return;
@@ -13,25 +20,32 @@ extern int main(){
1320
}
1421
*/
1522

23+
void brake(void){
24+
const char* b="\xcc\xc3";
25+
((void (*)(void))b)();
26+
return;
27+
}
28+
29+
1630
extern int main(){
1731

1832
printf("TLS : %p\n",getTLS());
1933
printf("libc : %p\n",getLibc());
2034
printf("code : %p\n",getCode());
35+
printf("strings: %p\n",getStringIndex());
36+
2137
void * pie_base=getpieload();
38+
2239
if(pie_base){
2340
printf("pie : %p\n",getpieload());
2441
}
2542
else{
2643
printf("base : %p\n",gettextload());
2744
}
45+
46+
47+
brake();
48+
2849
return 0;
2950
}
30-
/*
31-
extern void _start(){
32-
__asm__(
33-
"int3\n"
34-
);
35-
return 0;
36-
}
37-
*/
51+

‎lib_research/loader/elf_offsets.s

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
BITS 32
2+
;; elf header
3+
%define e_ident 0
4+
%define e_type 16
5+
%define e_machine 18
6+
%define e_version 20
7+
%define e_entry 24
8+
%define e_phoff 28
9+
%define e_shoff 32
10+
%define e_flags 36
11+
%define e_ehsize 40
12+
%define e_phentsize 42
13+
%define e_phnum 44
14+
%define e_shentsize 46
15+
%define e_shnum 48
16+
%define e_shstrndx 50
17+
18+
19+
20+
;; prgm header
21+
%define p_type 0
22+
%define p_offset 4
23+
%define p_vaddr 8
24+
%define p_paddr 12
25+
%define p_filesz 16
26+
%define p_memsz 20
27+
%define p_flags 24
28+
%define p_align 28
29+
30+
;; section header
31+
%define sh_name 0
32+
%define sh_type 4
33+
%define sh_flags 8
34+
%define sh_addr 12
35+
%define sh_offset 16
36+
%define sh_size 20
37+
%define sh_link 24
38+
%define sh_info 28
39+
%define sh_addralign 32
40+
%define sh_entsize 36
41+
42+
43+
;; Elf32_Sym
44+
%define st_name 0
45+
%define st_value 4
46+
%define st_size 8
47+
%define st_info 12
48+
%define st_other 13
49+
%define st_shndx 14

‎lib_research/loader/handler.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/bin/bash
2+
ulimit -c unlimited
3+
socat TCP-LISTEN:12345,reuseaddr,fork EXEC:"./testShellcode"
4+

‎lib_research/loader/loader.s

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
BITS 32
2+
global main
3+
;; http://en.wikipedia.org/wiki/Executable_and_Linkable_Format
4+
;; program header shows what is used at runtime
5+
%include "../../include/short32.s"
6+
%include "elf_offsets.s"
7+
8+
9+
%define inputFD 0
10+
%define READSIZE 0x10000 ;64k
11+
%define PT_LOAD 1
12+
13+
14+
get_entry:
15+
mov eax, DWORD [ebp + e_entry] ;entry point (RVA)
16+
mov ecx, DWORD [ebp + e_phoff] ;RVA of prgm header table
17+
add ecx, ebx ;addr of prgm header table
18+
xor edx, edx ;make sure high bits of edx are 0
19+
mov dx , WORD [ebp + e_phnum] ;number of entries in prgm header table
20+
xor ebx, ebx
21+
mov bx , WORD [ebp + e_phentsize] ;size of an entry in the prgm header table
22+
ret
23+
24+
25+
parse_sections:
26+
27+
28+
29+
main:
30+
sub esp, READSIZE
31+
mov eax, read
32+
mov ebx, inputFD
33+
mov ecx, esp
34+
mov edx, READSIZE
35+
int 0x80 ;read(inputFD,stack_buf,READSIZE);
36+
37+
mov ebp,esp ;get_entry takes the base of the module in ebp
38+
call get_entry
39+
int3
40+
call eax ;module's main()
41+
42+

‎lib_research/loader/makefile

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#Evan Jensen
2+
#Make template for testing shellcode
3+
shellcode = loader.s
4+
NFLAGS = elf
5+
CFLAGS = -m32
6+
7+
8+
all: assemble link
9+
assemble:
10+
nasm -f $(NFLAGS) $(shellcode) -o linkme.o
11+
nasm $(shellcode) -o shellcode
12+
link:
13+
gcc linkme.o -o testShellcode $(CFLAGS)
14+
15+
clean:
16+
rm -f linkme.o
17+
rm -f testShellcode
18+
rm -f shellcode

‎lib_research/loader/sendModule.py

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/usr/bin/env python
2+
from sys import argv
3+
from isis import *
4+
5+
assert(len(argv)>=2)
6+
7+
module_name=argv[1]
8+
module=file(module_name).read()
9+
10+
s=get_socket(('localhost',12345))
11+
12+
s.send(module)
13+
14+

0 commit comments

Comments
 (0)