pwnlib.shellcraft.aarch64
— Shellcode for AArch64
pwnlib.shellcraft.aarch64
- pwnlib.shellcraft.aarch64.breakpoint()[source]
Inserts a debugger breakpoint (raises SIGTRAP).
Example
>>> run_assembly(shellcraft.breakpoint()).poll(True) -5
- pwnlib.shellcraft.aarch64.crash()[source]
Crashes the process.
Example
>>> run_assembly(shellcraft.crash()).poll(True) -11
- pwnlib.shellcraft.aarch64.infloop()[source]
An infinite loop.
Example
>>> io = run_assembly(shellcraft.infloop()) >>> io.recvall(timeout=1) b'' >>> io.close()
- pwnlib.shellcraft.aarch64.memcpy(dest, src, n)[source]
Copies memory.
- Parameters
dest – Destination address
src – Source address
n – Number of bytes
- pwnlib.shellcraft.aarch64.mov(dst, src)[source]
Move src into dest.
Support for automatically avoiding newline and null bytes has to be done.
If src is a string that is not a register, then it will locally set context.arch to ‘arm’ and use
pwnlib.constants.eval()
to evaluate the string. Note that this means that this shellcode can change behavior depending on the value of context.os.Examples
>>> print(shellcraft.mov('x0','x1').rstrip()) mov x0, x1 >>> print(shellcraft.mov('x0','0').rstrip()) mov x0, xzr >>> print(shellcraft.mov('x0', 9).rstrip()) mov x0, #9 >>> print(shellcraft.mov('x0', 0x94532).rstrip()) /* Set x0 = 607538 = 0x94532 */ mov x0, #17714 movk x0, #9, lsl #16
- pwnlib.shellcraft.aarch64.push(value, register1='x14', register2='x15')[source]
Pushes a value onto the stack without using null bytes or newline characters.
If src is a string, then we try to evaluate using
pwnlib.constants.eval()
before determining how to push it.Note that this means that this shellcode can change behavior depending on the value of context.os.
Note
AArch64 requires that the stack remain 16-byte aligned at all times, so this alignment is preserved.
- Parameters
Example
>>> print(pwnlib.shellcraft.push(0).rstrip()) /* push 0 */ mov x14, xzr str x14, [sp, #-16]! >>> print(pwnlib.shellcraft.push(9).rstrip()) /* push 9 */ mov x14, #9 str x14, [sp, #-16]! >>> print(pwnlib.shellcraft.push(256).rstrip()) /* push 0x100 */ mov x14, #256 str x14, [sp, #-16]! >>> print(pwnlib.shellcraft.push('SYS_execve').rstrip()) /* push SYS_execve (0xdd) */ mov x14, #221 str x14, [sp, #-16]! >>> print(pwnlib.shellcraft.push('SYS_sendfile').rstrip()) /* push SYS_sendfile (0x47) */ mov x14, #71 str x14, [sp, #-16]! >>> with context.local(os = 'freebsd'): ... print(pwnlib.shellcraft.push('SYS_execve').rstrip()) ... /* push SYS_execve (0x3b) */ mov x14, #59 str x14, [sp, #-16]!
- pwnlib.shellcraft.aarch64.pushstr(string, append_null=True, register1='x14', register2='x15', pretty=None)[source]
Pushes a string onto the stack.
r12 is defined as the inter-procedural scratch register ($ip), so this should not interfere with most usage.
- Parameters
Examples
>>> string = "Hello, world!" >>> assembly = shellcraft.pushstr(string) >>> assembly += shellcraft.write(1, 'sp', len(string)) >>> assembly += shellcraft.exit() >>> ELF.from_assembly(assembly).process().recvall() b'Hello, world!'
>>> string = "Hello, world! This is a long string! Wow!" >>> assembly = shellcraft.pushstr(string) >>> assembly += shellcraft.write(1, 'sp', len(string)) >>> assembly += shellcraft.exit() >>> ELF.from_assembly(assembly).process().recvall() b'Hello, world! This is a long string! Wow!'
- pwnlib.shellcraft.aarch64.pushstr_array(reg, array, register1='x14', register2='x15')[source]
Pushes an array/envp-style array of pointers onto the stack.
- Parameters
Example
>>> assembly = shellcraft.execve("/bin/sh", ["sh", "-c", "echo Hello string $WORLD"], {"WORLD": "World!"}) >>> ELF.from_assembly(assembly).process().recvall() b'Hello string World!\n'
- pwnlib.shellcraft.aarch64.setregs(reg_context, stack_allowed=True)[source]
Sets multiple registers, taking any register dependencies into account (i.e., given eax=1,ebx=eax, set ebx first).
- Parameters
Example
>>> print(shellcraft.setregs({'x0':9, 'x2':'x3'}).rstrip()) mov x0, #9 mov x2, x3 >>> print(shellcraft.setregs({'x0':'x1', 'x1':'x0', 'x2':'x3'}).rstrip()) mov x2, x3 eor x0, x0, x1 /* xchg x0, x1 */ eor x1, x0, x1 eor x0, x0, x1
- pwnlib.shellcraft.aarch64.trap()[source]
Inserts a debugger breakpoint (raises SIGTRAP).
Example
>>> run_assembly(shellcraft.breakpoint()).poll(True) -5
- pwnlib.shellcraft.aarch64.xor(key, address, count)[source]
XORs data a constant value.
- Parameters
Example
>>> sc = shellcraft.read(0, 'sp', 32) >>> sc += shellcraft.xor(0xdeadbeef, 'sp', 32) >>> sc += shellcraft.write(1, 'sp', 32) >>> io = run_assembly(sc) >>> io.send(cyclic(32)) >>> result = io.recvn(32) >>> expected = xor(cyclic(32), p32(0xdeadbeef)) >>> result == expected True
pwnlib.shellcraft.aarch64.linux
- pwnlib.shellcraft.aarch64.linux.cat(filename, fd=1)[source]
Opens a file and writes its contents to the specified file descriptor.
Example
>>> f = tempfile.mktemp() >>> write(f, 'This is the flag\n') >>> shellcode = shellcraft.cat(f) + shellcraft.exit(0) >>> run_assembly(shellcode).recvline() b'This is the flag\n'
- pwnlib.shellcraft.aarch64.linux.cat2(filename, fd=1, length=16384)[source]
Opens a file and writes its contents to the specified file descriptor. Uses an extra stack buffer and must know the length.
Example
>>> f = tempfile.mktemp() >>> write(f, 'This is the flag\n') >>> shellcode = shellcraft.cat2(f) + shellcraft.exit(0) >>> run_assembly(shellcode).recvline() b'This is the flag\n'
- pwnlib.shellcraft.aarch64.linux.connect(host, port, network='ipv4')[source]
Connects to the host on the specified port. Network is either ‘ipv4’ or ‘ipv6’. Leaves the connected socket in x12.
- pwnlib.shellcraft.aarch64.linux.dupio(sock='x12')[source]
Args: [sock (imm/reg) = x12] Duplicates sock to stdin, stdout and stderr
- pwnlib.shellcraft.aarch64.linux.dupsh(sock='x12')[source]
Args: [sock (imm/reg) = x12] Duplicates sock to stdin, stdout and stderr and spawns a shell.
- pwnlib.shellcraft.aarch64.linux.echo(string, sock='1')[source]
Writes a string to a file descriptor
Example
>>> run_assembly(shellcraft.echo('hello\n', 1)).recvline() b'hello\n'
- pwnlib.shellcraft.aarch64.linux.forkexit()[source]
Attempts to fork. If the fork is successful, the parent exits.
- pwnlib.shellcraft.aarch64.linux.kill(pid, sig) str [source]
Invokes the syscall kill.
See ‘man 2 kill’ for more information.
- Parameters
pid (pid_t) – pid
sig (int) – sig
- Returns
int
- pwnlib.shellcraft.aarch64.linux.killparent()[source]
Kills its parent process until whatever the parent is (probably init) cannot be killed any longer.
- pwnlib.shellcraft.aarch64.linux.loader(address)[source]
Loads a statically-linked ELF into memory and transfers control.
- Parameters
address (int) – Address of the ELF as a register or integer.
- pwnlib.shellcraft.aarch64.linux.loader_append(data=None)[source]
Loads a statically-linked ELF into memory and transfers control.
Similar to loader.asm but loads an appended ELF.
- Parameters
data (str) – If a valid filename, the data is loaded from the named file. Otherwise, this is treated as raw ELF data to append. If
None
, it is ignored.
Example:
The following doctest is commented out because it doesn’t work on Travis for reasons I cannot diagnose. However, it should work just fine :-)
>>> payload = shellcraft.echo(b'Hello, world!\n') + shellcraft.exit(0) >>> payloadELF = ELF.from_assembly(payload) >>> loader = shellcraft.loader_append(payloadELF.data) >>> loaderELF = ELF.from_assembly(loader, vma=0, shared=True) >>> loaderELF.process().recvall() b'Hello, world!\n'
- pwnlib.shellcraft.aarch64.linux.readn(fd, buf, nbytes)[source]
Reads exactly nbytes bytes from file descriptor fd into the buffer buf.
- Parameters
fd (int) – fd
buf (void) – buf
nbytes (size_t) – nbytes
- pwnlib.shellcraft.aarch64.linux.setresuid(ruid=None, euid=None, suid=None)[source]
Args: [ruid = geteuid(), euid = ruid, suid = ruid] Sets real, effective and saved user ids to given values
- pwnlib.shellcraft.aarch64.linux.sh()[source]
Execute a different process.
>>> p = run_assembly(shellcraft.aarch64.linux.sh()) >>> p.sendline(b'echo Hello') >>> p.recv() b'Hello\n'
- pwnlib.shellcraft.aarch64.linux.sleep(seconds)[source]
Sleeps for the specified amount of seconds.
Uses SYS_nanosleep under the hood. Doesn’t check for interrupts and doesn’t retry with the remaining time.
- pwnlib.shellcraft.aarch64.linux.stage(fd=0, length=None)[source]
Migrates shellcode to a new buffer.
- Parameters
Example
>>> p = run_assembly(shellcraft.stage()) >>> sc = asm(shellcraft.echo("Hello\n", constants.STDOUT_FILENO)) >>> p.pack(len(sc)) >>> p.send(sc) >>> p.recvline() b'Hello\n'
- pwnlib.shellcraft.aarch64.linux.syscall(syscall=None, arg0=None, arg1=None, arg2=None, arg3=None, arg4=None, arg5=None, arg6=None)[source]
- Args: [syscall_number, *args]
Does a syscall
Any of the arguments can be expressions to be evaluated by
pwnlib.constants.eval()
.Example
>>> print(shellcraft.aarch64.linux.syscall(11, 9, 'sp', 8, 0).rstrip()) /* call syscall(0xb, 9, 'sp', 8, 0) */ mov x0, #9 add x1, sp, xzr mov x2, #8 mov x3, xzr mov x8, #11 svc 0 >>> print(shellcraft.aarch64.linux.syscall('SYS_exit', 0).rstrip()) /* call exit(0) */ mov x0, xzr mov x8, #SYS_exit svc 0 >>> print(pwnlib.shellcraft.openat(-2, '/home/pwn/flag').rstrip()) /* openat(fd=-2, file='/home/pwn/flag', oflag=0) */ /* push b'/home/pwn/flag\x00' */ /* Set x14 = 8606431000579237935 = 0x77702f656d6f682f */ mov x14, #26671 movk x14, #28015, lsl #16 movk x14, #12133, lsl #0x20 movk x14, #30576, lsl #0x30 /* Set x15 = 113668128124782 = 0x67616c662f6e */ mov x15, #12142 movk x15, #27750, lsl #16 movk x15, #26465, lsl #0x20 stp x14, x15, [sp, #-16]! add x1, sp, xzr /* Set x0 = -2 = -2 */ mov x0, #65534 movk x0, #65535, lsl #16 movk x0, #65535, lsl #0x20 movk x0, #65535, lsl #0x30 mov x2, xzr /* call openat() */ mov x8, #SYS_openat svc 0