Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Shellcode encoders seem broken #1472

Open
zachriggle opened this issue Apr 8, 2020 · 3 comments
Open

Shellcode encoders seem broken #1472

zachriggle opened this issue Apr 8, 2020 · 3 comments

Comments

@zachriggle
Copy link
Member

The encode() routine should not ever emit bytes in avoid.

>>> encode(asm(shellcraft.sh()), avoid='\x01')
b'jhh///sh/bin\x89\xe3h\x01\x01\x01\x01\x814$ri\x01\x011\xc9Qj\x04Y\x01\xe1Q\x89\xe11\xd2j\x0bX\xcd\x80'
@zachriggle
Copy link
Member Author

zachriggle commented Apr 8, 2020

It looks like this is a Python3-ism, and the general function is broken if you use the correct b prefix.

>>> encode(b'\x01', avoid=b'\x01')
---------------------------------------------------------------------------
TypeError                                 Traceback (most recent call last)
<ipython-input-2-f36d34f8cc24> in <module>
----> 1 encode(b'\x01', avoid=b'\x01')

~/github.com/pwntools/pwnlib/context/__init__.py in setter(*a, **kw)
   1440                 raise AttributeError("Invalid arch/endianness combination: %s/%s" % (arch, endian))
   1441
-> 1442             return function(*a, **kw)
   1443     return setter
   1444

~/github.com/pwntools/pwnlib/encoders/encoder.py in encode(raw_bytes, avoid, expr, force, pcreg)
     81
     82         try:
---> 83             v = encoder(raw_bytes, avoid, pcreg)
     84         except NotImplementedError:
     85             continue

~/github.com/pwntools/pwnlib/encoders/i386/xor.py in __call__(self, raw_bytes, avoid, pcreg)
     67     def __call__(self, raw_bytes, avoid, pcreg=''):
     68         while len(raw_bytes) % context.bytes:
---> 69             raw_bytes += '\x00'
     70
     71         a, b = xor_pair(raw_bytes, avoid)

TypeError: can't concat str to bytes
>>>

@heapcrash
Copy link
Collaborator

Yep, it's broken because set('foo') == {'f', 'o'} while set(b'foo') == {102, 111}.

This is a Python3-ism that needs to be worked around.

@heapcrash heapcrash changed the title encode() seems broken Shellcode encoders seem broken Jun 5, 2020
@Arusekk
Copy link
Member

Arusekk commented Jun 8, 2020

Encoders need more doctests.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants