Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add code for injecting proc/self/maps shellcode into an ELF #1051

Merged
merged 10 commits into from
Nov 4, 2019

Conversation

zachriggle
Copy link
Member

Closes #925

@zachriggle
Copy link
Member Author

I need to add a check to see if there's enough room in .text to inject the code.


shellcode = {
'i386':
'680101010181342460717201686c662f6d68632f7365682f70726f89e331c931d26a0558cd806a015b89c131d268ffffff7f5e31c0b0bbcd80'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Huge magical constant without a comment. Really? ;)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shhh, just trust me 😉

@zachriggle
Copy link
Member Author

The doctests in pwnlib/elf/maps.py are not running, since they are not directly exposed in a .rst file :(

return {}

# Swap in the original ELF name
data = data.replace(path, elf.path)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you meant self.path

Suggested change
data = data.replace(path, elf.path)
data = data.replace(path, self.path)

"""Dictionary of {name: address} for every mapping in this ELF's address space."""
if self._maps is None:
self._populate_libraries()
return self._maps
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should not be cached, since it can change at runtime.

@Arusekk Arusekk merged commit d580c0c into Gallopsled:dev Nov 4, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants