pwntools 0.1.0 → 1.2.1

data/lib/pwnlib/shellcraft/generators/x86/linux/exit.rb

@@ -0,0 +1,34 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/x86/linux/linux'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module X86
+        module Linux
+          # Exit syscall.
+          #
+          # @param [Integer] status
+          #   Status code.
+          #
+          # @return [String]
+          #   Assembly for invoking exit syscall.
+          #
+          # @example
+          #   puts shellcraft.exit(1)
+          #   #   /* call exit(1) */
+          #   #   push 1 /* (SYS_exit) */
+          #   #   pop eax
+          #   #   push 1
+          #   #   pop ebx
+          #   #   int 0x80
+          def exit(status = 0)
+            cat Linux.syscall('SYS_exit', status)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/x86/linux/linux.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/helper'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module X86
+        # For os-related methods.
+        module Linux
+          extend ::Pwnlib::Shellcraft::Generators::Helper
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/x86/linux/ls.rb

@@ -0,0 +1,67 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/x86/common/pushstr'
+require 'pwnlib/shellcraft/generators/x86/linux/linux'
+require 'pwnlib/shellcraft/generators/x86/linux/syscall'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module X86
+        module Linux
+          # List files.
+          #
+          # @param [String] dir
+          #   The relative path to be listed.
+          #
+          # @example
+          #  context.arch = 'amd64'
+          #  puts shellcraft.ls
+          #  #   /* push ".\x00" */
+          #  #   push 0x2e
+          #  #   /* call open("rsp", 0, 0) */
+          #  #   push 2 /* (SYS_open) */
+          #  #   pop rax
+          #  #   mov rdi, rsp
+          #  #   xor esi, esi /* 0 */
+          #  #   cdq /* rdx=0 */
+          #  #   syscall
+          #  #   /* call getdents("rax", "rsp", 4096) */
+          #  #   mov rdi, rax
+          #  #   push 0x4e /* (SYS_getdents) */
+          #  #   pop rax
+          #  #   mov rsi, rsp
+          #  #   xor edx, edx
+          #  #   mov dh, 0x1000 >> 8
+          #  #   syscall
+          #  #   /* call write(1, "rsp", "rax") */
+          #  #   push 1
+          #  #   pop rdi
+          #  #   mov rsi, rsp
+          #  #   mov rdx, rax
+          #  #   push 1 /* (SYS_write) */
+          #  #   pop rax
+          #  #   syscall
+          #  #=> nil
+          #
+          # @note
+          #   This shellcode will output the binary data returned by syscall +getdents+.
+          #   Use {Pwnlib::Util::Getdents.parse} to parse the output.
+          def ls(dir = '.')
+            abi = ::Pwnlib::ABI::ABI.syscall
+            cat Common.pushstr(dir)
+            cat Linux.syscall('SYS_open', abi.stack_pointer, 0, 0)
+            # In x86, return value register is same as sysnr register.
+            ret = abi.register_arguments.first
+            # XXX(david942j): Will fixed size 0x1000 be an issue?
+            cat Linux.syscall('SYS_getdents', ret, abi.stack_pointer, 0x1000) # getdents(fd, buf, sz)
+
+            # Just write all the shits out
+            cat Linux.syscall('SYS_write', 1, abi.stack_pointer, ret)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/x86/linux/open.rb

@@ -0,0 +1,47 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/x86/linux/linux'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module X86
+        module Linux
+          # Push filename onto stack and perform open syscall.
+          #
+          # @param [String] filename
+          #   The file to be opened.
+          # @param [String, Integer] flags
+          #   Flags for opening a file.
+          # @param [Integer] mode
+          #   If +filename+ doesn't exist and 'O_CREAT' is specified in +flags+,
+          #   +mode+ will be used as the file permission for creating the file.
+          #
+          # @return [String]
+          #   Assembly for syscall open.
+          #
+          # @example
+          #   puts shellcraft.open('/etc/passwd', 'O_RDONLY')
+          #   #   /* push "/etc/passwd\x00" */
+          #   #   push 0x1010101
+          #   #   xor dword ptr [esp], 0x1657672 /* 0x1010101 ^ 0x647773 */
+          #   #   push 0x7361702f
+          #   #   push 0x6374652f
+          #   #   /* call open("esp", "O_RDONLY", 0) */
+          #   #   push 5 /* (SYS_open) */
+          #   #   pop eax
+          #   #   mov ebx, esp
+          #   #   xor ecx, ecx /* (O_RDONLY) */
+          #   #   cdq /* edx=0 */
+          #   #   int 0x80
+          def open(filename, flags = 'O_RDONLY', mode = 0)
+            abi = ::Pwnlib::ABI::ABI.syscall
+            cat Common.pushstr(filename)
+            cat Linux.syscall('SYS_open', abi.stack_pointer, flags, mode)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/x86/linux/sh.rb

@@ -0,0 +1,53 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/x86/linux/execve'
+require 'pwnlib/shellcraft/generators/x86/linux/linux'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module X86
+        module Linux
+          # Get shell!
+          #
+          # @param [Boolean, Array<String>] argv
+          #   Arguments of +argv+ when calling +execve+.
+          #   If +true+ is given, use +['sh']+.
+          #   If +Array<String>+ is given, use it as arguments array.
+          #
+          # @example
+          #   context.arch = 'i386'
+          #   puts shellcraft.sh
+          #   # /* push "/bin///sh\x00" */
+          #   # push 0x68
+          #   # push 0x732f2f2f
+          #   # push 0x6e69622f
+          #   #
+          #   # /* call execve("esp", 0, 0) */
+          #   # push 0xb /* (SYS_execve) */
+          #   # pop eax
+          #   # mov ebx, esp
+          #   # xor ecx, ecx /* 0 */
+          #   # cdq /* edx=0 */
+          #   # int 0x80
+          #   #=> nil
+          #
+          # @note Null pointer is always used as +envp+.
+          #
+          # @diff
+          #   By default, this method calls +execve('/bin///sh', 0, 0)+, which is different from pwntools-python:
+          #   +execve('/bin///sh', ['sh'], 0)+.
+          def sh(argv: false)
+            argv = case argv
+                   when true then ['sh']
+                   when false then 0
+                   else argv
+                   end
+            cat Linux.execve('/bin///sh', argv, 0)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/x86/linux/sleep.rb

@@ -0,0 +1,52 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/x86/common/pushstr'
+require 'pwnlib/shellcraft/generators/x86/linux/linux'
+require 'pwnlib/shellcraft/generators/x86/linux/syscall'
+require 'pwnlib/util/packing'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module X86
+        module Linux
+          # Sleep for a specified number of seconds.
+          #
+          # @param [Float] seconds
+          #   The seconds to sleep.
+          #
+          # @example
+          #   context.arch = :amd64
+          #   puts shellcraft.sleep(1)
+          #   #  /* push "\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" */
+          #   #  push 1
+          #   #  dec byte ptr [rsp]
+          #   #  push 1
+          #   #  /* call nanosleep("rsp", 0) */
+          #   #  push 0x23 /* (SYS_nanosleep) */
+          #   #  pop rax
+          #   #  mov rdi, rsp
+          #   #  xor esi, esi /* 0 */
+          #   #  syscall
+          #   #  add rsp, 16 /* recover rsp */
+          #   #=> nil
+          #
+          # @note
+          #   Syscall +nanosleep+ accepts a data pointer as argument, the stack will be used for putting the data
+          #   needed. The generated assembly will use sizeof(struct timespec) = 16 bytes for putting data.
+          def sleep(seconds)
+            # pushes the data onto stack
+            tv_sec = seconds.to_i
+            tv_nsec = ((seconds - tv_sec) * 1e9).to_i
+            data = ::Pwnlib::Util::Packing.p64(tv_sec) + ::Pwnlib::Util::Packing.p64(tv_nsec)
+            cat Common.pushstr(data, append_null: false)
+            sp = ::Pwnlib::ABI::ABI.default.stack_pointer
+            cat Linux.syscall('SYS_nanosleep', sp, 0)
+            cat "add #{sp}, #{data.size} /* recover #{sp} */"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/x86/linux/syscall.rb

@@ -0,0 +1,52 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/x86/common/setregs'
+require 'pwnlib/shellcraft/generators/x86/linux/linux'
+require 'pwnlib/util/ruby'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module X86
+        module Linux
+          # Assembly of +syscall+.
+          #
+          # @example
+          #   context.arch = 'i386'
+          #   puts shellcraft.syscall('SYS_open', 'esp', 0, 0)
+          #   # /* call open("esp", 0, 0) */
+          #   # push 5 /* (SYS_open) */
+          #   # pop eax
+          #   # mov ebx, esp
+          #   # xor ecx, ecx /* 0 */
+          #   # cdq /* edx=0 */
+          #   # int 0x80
+          #   #=> nil
+          def syscall(*arguments)
+            abi = ::Pwnlib::ABI::ABI.syscall
+            registers = abi.register_arguments
+            reg_ctx = registers.zip(arguments).to_h
+            syscall = arguments.first
+            if syscall.to_s.start_with?('SYS_')
+              fmt = "#{syscall.to_s[4..-1]}(%s)"
+              args = []
+            else
+              fmt = 'syscall(%s)'
+              args = [syscall ? syscall.inspect : '?']
+            end
+            # arg0 to arg5
+            1.upto(6) do |i|
+              args.push(arguments[i] ? arguments[i].inspect : '?')
+            end
+            args.pop while args.last == '?'
+
+            cat "/* call #{format(fmt, args.join(', '))} */"
+            cat Common.setregs(reg_ctx) if arguments.any? { |v| !v.nil? }
+            cat abi.syscall_str
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/registers.rb

@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+
+require 'pwnlib/context'
+
+module Pwnlib
+  module Shellcraft
+    # Define register names and methods for shellcode generators.
+    module Registers
+      X86_BASEREGS = %w(ax cx dx bx sp bp si di ip).freeze
+
+      I386 = (X86_BASEREGS.map { |r| "e#{r}" } +
+             X86_BASEREGS +
+             %w(eflags cs ss ds es fs gs)).freeze
+
+      AMD64 = (X86_BASEREGS.map { |r| "r#{r}" } +
+               (8..15).map { |r| "r#{r}" } +
+               (8..15).map { |r| "r#{r}d" } +
+               I386).freeze
+
+      # x86 registers in decreasing size
+      X86_ORDERED = ([
+        %w(rax eax ax al),
+        %w(rbx ebx bx bl),
+        %w(rcx ecx cx cl),
+        %w(rdx edx dx dl),
+        %w(rdi edi di),
+        %w(rsi esi si),
+        %w(rbp ebp bp),
+        %w(rsp esp sp)
+      ] + (8..15).map { |r| ['', 'd', 'w', 'b'].map { |t| "r#{r}#{t}" } }).freeze
+
+      # class Register, currently only supports i386 and amd64.
+      class Register
+        # @return [String]
+        #   Register's name.
+        attr_reader :name
+        attr_reader :bigger, :smaller, :ff00, :is64bit, :native64, :native32, :xor, :size, :sizes
+
+        # Instantiate a {Register} object.
+        #
+        # Create a register by its name and size (in bits) for fetching other information. For example, for register
+        # 'ax', +#bigger+ contains 'rax' and 'eax'.
+        #
+        # Normally you don't need to create any {Register} object, use {.get_register} to get register by name.
+        #
+        # @param [String] name
+        #   Register's name.
+        # @param [Integer] size
+        #   Register size in bits.
+        #
+        # @example
+        #   Register.new('rax', 64)
+        #   Register.new('bx', 16)
+        def initialize(name, size)
+          @name = name
+          @size = size
+          X86_ORDERED.each do |row|
+            next unless row.include?(name)
+
+            @bigger = row[0, row.index(name)]
+            @smaller = row[(row.index(name) + 1)..-1]
+            @native64 = row[0]
+            @native32 = row[1]
+            @sizes = row.each_with_object({}).with_index { |(r, h), i| h[64 >> i] = r }
+            @xor = @sizes[[size, 32].min]
+            break
+          end
+          @ff00 = "#{name[1]}h" if @size >= 32 && @name.end_with?('x')
+          @is64bit = true if @name.start_with?('r')
+        end
+
+        def bits
+          size
+        end
+
+        def bytes
+          bits / 8
+        end
+
+        def fits(value)
+          size >= Registers.bits_required(value)
+        end
+
+        def to_s
+          name
+        end
+
+        def inspect
+          format('Register(%s)', name)
+        end
+      end
+
+      module_function
+
+      def registers
+        {
+          [32, 'i386', 'linux'] => ::Pwnlib::Shellcraft::Registers::I386,
+          [64, 'amd64', 'linux'] => ::Pwnlib::Shellcraft::Registers::AMD64
+        }[[context.bits, context.arch, context.os]]
+      end
+
+      INTEL = (X86_ORDERED.each_with_object({}) do |row, obj|
+        row.each_with_index do |reg, i|
+          obj[reg] = Register.new(reg, 64 >> i)
+        end
+      end).freeze
+
+      # Get a {Register} object by name.
+      #
+      # @param [String, Symbol, Register] name
+      #   The name of register.
+      #   If +name+ is already a {Register} object, +name+ itself will be returned.
+      #
+      # @return [Register?]
+      #   Get the register with name +name+.
+      #
+      # @example
+      #   Registers.get_register('eax')
+      #   #=> Register(eax)
+      #   Registers.get_register(:ebx)
+      #   #=> Register(ebx)
+      #   Registers.get_register('xdd')
+      #   #=> nil
+      def get_register(name)
+        return name if name.instance_of?(Register)
+        return INTEL[name.to_s] if name.instance_of?(String) || name.instance_of?(Symbol)
+
+        nil
+      end
+
+      def register?(obj)
+        !get_register(obj).nil?
+      end
+
+      def bits_required(value)
+        bits = 0
+        value = value.abs
+        while value.positive?
+          bits += 8
+          value >>= 8
+        end
+        bits
+      end
+
+      include ::Pwnlib::Context
+    end
+  end
+end