mirror of
https://github.com/BishopFox/asminject.git
synced 2026-11-07 09:35:57 -10:00
72 lines
2.7 KiB
Markdown
72 lines
2.7 KiB
Markdown
# asminject.py examples - Basic examples
|
|
|
|
<a href="../README.md">[ Back to the main README.md ]</a>
|
|
|
|
* [Create a world-readable copy of a file using only Linux syscalls](#create-a-world-readable-copy-of-a-file-using-only-linux-syscalls)
|
|
* [Create a copy of a file using buffered read/write libc calls](#create-a-copy-of-a-file-using-buffered-readwrite-libc-calls)
|
|
* [Print text to standard output](#print-text-to-standard-output)
|
|
|
|
## Create a world-readable copy of a file using only Linux syscalls
|
|
|
|
The `copy_file_using_syscalls.s` payload requires no relative offset information, because it's all done using Linux syscalls. It may also help avoid some methods of forensic detection versus using the `cp`, `cat`, or other shell commands.
|
|
|
|
In one terminal window, launch one of the practice targets, e.g.:
|
|
|
|
```
|
|
$ python3 practice/python_loop.py
|
|
|
|
2022-05-12T19:41:23.109251 - Loop count 0
|
|
2022-05-12T19:41:28.115898 - Loop count 1
|
|
2022-05-12T19:41:33.119542 - Loop count 2
|
|
```
|
|
|
|
In a second terminal window, find the process ID of the target and run `asminject.py` (as `root`) against it.
|
|
|
|
This payload requires two variables: `sourcefile` and `destfile`.
|
|
|
|
```
|
|
# ps auxww | grep python3 | grep -v grep
|
|
|
|
root 2036577 [...] python3 practice/python_loop.py
|
|
|
|
# python3 ./asminject.py 2036577 copy_file_using_syscalls.s \
|
|
--relative-offsets-from-binaries \
|
|
--var sourcefile "/etc/passwd" \
|
|
--var destfile "/tmp/bishopfox.txt"
|
|
|
|
...omitted for brevity...
|
|
|
|
# cat /tmp/bishopfox.txt
|
|
|
|
root:x:0:0:root:/root:/usr/bin/zsh
|
|
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
|
|
bin:x:2:2:bin:/bin:/usr/sbin/nologin
|
|
sys:x:3:3:sys:/dev:/usr/sbin/nologin
|
|
...omitted for brevity...
|
|
```
|
|
|
|
## Create a copy of a file using buffered read/write libc calls
|
|
|
|
The `copy_file_using_libc.s` payload uses code that (like the previous example) creates a copy of a file, but by using libc's `fopen()`, `fread()`, `fwrite()`, and `fclose()` instead of syscalls, can easily use a buffered approach that's more efficient.
|
|
|
|
This payload requires relative offsets for the `libc` shared library used by the target process.
|
|
|
|
```
|
|
# python3 ./asminject.py 1876570 copy_file_using_libc.s \
|
|
--relative-offsets-from-binaries \
|
|
--var sourcefile "/etc/passwd" \
|
|
--var destfile "/tmp/bishopfox.txt"
|
|
```
|
|
|
|
## Print text to standard output
|
|
|
|
The `printf.s` payload can be useful for debugging injecting into a particular target. It passes a format string and one parameter to the `libc` `printf` function.
|
|
|
|
This payload requires relative offsets for the `libc` shared library used by the target process.
|
|
|
|
```
|
|
python3 ./asminject.py 2258 printf.s \
|
|
--relative-offsets-from-binaries \
|
|
--var formatstring "DEBUG: '%s'" \
|
|
--var message "12345"
|
|
``` |