Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def shellcode_checks(self, t):
b = archr.arsenal.DataScoutBow(t)
with t.shellcode_context(asm_code=b.exit_shellcode(exit_code=123)) as p:
stdout,_ = p.communicate()
assert p.wait() == 123
with t.shellcode_context(asm_code=b.echo_shellcode("TESTING THIS THING!")) as p:
stdout,_ = p.communicate()
assert stdout == b"TESTING THIS THING!"
with t.shellcode_context(asm_code=b.echo_shellcode("TESTING THIS THING!") + b.exit_shellcode()) as p:
stdout,_ = p.communicate()
assert stdout == b"TESTING THIS THING!"
assert p.wait() == 42
with t.shellcode_context(asm_code=b.sendfile_shellcode("/proc/self/cmdline")) as p:
stdout,_ = p.communicate()
assert stdout == t.target_path.encode('utf-8') + b'\0'
def test_stacksmash(self):
with archr.targets.DockerImageTarget('archr-test:vuln_stacksmash', target_arch='i386').build().start() as t:
b = archr.arsenal.DataScoutBow(t)
argv, env, aux, maps = b.fire()
assert b"PWD=/" in env
assert maps['/lib/i386-linux-gnu/ld-2.27.so'] in struct.unpack("<%dI"%(len(aux)/4), aux)
assert '[stack-end]' in maps
assert '[heap]' in maps
assert '[vvar]' in maps
assert '[vdso]' in maps
def test_stack(self):
import angr
t = archr.targets.DockerImageTarget('archr-test:stackprinter64').build().start()
reference_str = t.run_command(aslr=False).stdout.read()
dsb = archr.arsenal.DataScoutBow(t)
apb = archr.arsenal.angrProjectBow(t, dsb)
asb = archr.arsenal.angrStateBow(t, apb)
project = apb.fire(use_sim_procedures=False)
state = asb.fire(add_options={angr.sim_options.STRICT_PAGE_ACCESS}) # for now
simgr = project.factory.simulation_manager(state)
simgr.run()
assert len(simgr.errored) == 0
assert len(simgr.deadended) == 1
assert len(sum(simgr.stashes.values(), [])) == 1
#assert simgr.deadended[0].posix.dumps(1) == reference_str
t.stop()
self.target = target # type: archr.targets.Target
self.constrained_addrs = [ ] if constrained_addrs is None else constrained_addrs
self.hooks = {} if hooks is None else hooks
self.explore_steps = explore_steps
self.use_crash_input = use_crash_input
self.input_type = input_type
self.target_port = port
self.crash = crash
self.tracer_bow = tracer_bow if tracer_bow is not None else archr.arsenal.QEMUTracerBow(self.target)
if self.explore_steps > 10:
raise CannotExploit("Too many steps taken during crash exploration")
# Initialize an angr Project
dsb = archr.arsenal.DataScoutBow(self.target)
self.angr_project_bow = archr.arsenal.angrProjectBow(self.target, dsb)
self.project = self.angr_project_bow.fire()
self.binary = self.target.resolve_local_path(self.target.target_path)
# Add custom hooks
for addr, proc in self.hooks.items():
self.project.hook(addr, proc)
l.debug("Hooking %#x -> %s...", addr, proc.display_name)
# ROP-related stuff
if use_rop:
if angrop_object is not None:
self.rop = angrop_object
else:
if not rop_cache_path:
# we search for ROP gadgets now to avoid the memory exhaustion bug in pypy
def _initialize(self, rop_obj, rop_cache_path, checkpoint_path, crash_state, prev_state):
"""
Initialization steps.
- Create a new angr project.
- Load or collect ROP gadgets.
- Restore states from a previous checkpoint if available.
:return: None
"""
# Initialize an angr Project
dsb = archr.arsenal.DataScoutBow(self.target)
self.angr_project_bow = archr.arsenal.angrProjectBow(self.target, dsb)
self.project = self.angr_project_bow.fire()
self.binary = self.target.resolve_local_path(self.target.target_path)
# Add custom hooks
for addr, proc in self.hooks.items():
self.project.hook(addr, proc)
l.debug("Hooking %#x -> %s...", addr, proc.display_name)
# ROP-related stuff
if self._use_rop:
if rop_obj is not None:
self.rop = rop_obj
else:
if not rop_cache_path:
# we search for ROP gadgets now to avoid the memory exhaustion bug in pypy
def run(self, inst):
self._progress_callback(5)
with self.target.build().start() as t:
self._progress_callback(10)
dsb = archr.arsenal.DataScoutBow(t)
apb = archr.arsenal.angrProjectBow(t, dsb)
partial_ld = apb.fire(return_loader=True, perform_relocations=False, load_debug_info=False)
self._progress_callback(50)
# is it smart to do this from the worker thread? who knows
load_options, cfg_args = gui_thread_schedule(LoadBinary.run, (partial_ld,))
partial_ld.close()
if cfg_args is None:
return
# Create the project, load it, then record the image name on success
proj = apb.fire(use_sim_procedures=True, load_options=load_options)
self._progress_callback(95)
inst.set_project(proj, cfg_args=cfg_args)