Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def test_boolector_solving():
# Test boolector's ability to generate the correct values at pov runtime.
inp = b"A" * 64 * 4
path = os.path.join(bin_location, "tests/cgc/add_payload")
with archr.targets.LocalTarget([path], target_os='cgc') as target:
crash = rex.Crash(target, inp, fast_mode=True, rop_cache_path=os.path.join(cache_location, 'add_payload'))
arsenal = crash.exploit(blacklist_techniques={'rop_leak_memory'})
crash.project.loader.close()
nose.tools.assert_true(len(arsenal.register_setters) >= 3)
nose.tools.assert_true(len(arsenal.leakers) >= 1)
for reg_setter in arsenal.register_setters:
nose.tools.assert_true(_do_pov_test(reg_setter))
for leaker in arsenal.leakers:
nose.tools.assert_true(_do_pov_test(leaker))
def test_netcat_network_local():
with archr.targets.LocalTarget("socat tcp-l:1337,reuseaddr exec:cat".split(), tcp_ports=[1337]).build().start() as t:
netcat_checks(t)
def test_chall_resp_rand():
inp = b" (((" \
b"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
b"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
b"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n"
path = bin_location + "/tests/cgc/overflow_after_chall_resp_rand"
with archr.targets.LocalTarget([path], target_os='cgc') as target:
crash = rex.Crash(target, crash=inp, rop_cache_path=os.path.join(cache_location, "overflow_after_chall_resp_rand"))
exploit_f = crash.exploit()
crash.project.loader.close()
for e in exploit_f.register_setters:
nose.tools.assert_true(_do_pov_test(e))
for e in exploit_f.leakers:
nose.tools.assert_true(_do_pov_test(e))
def test_local_cat(self):
with archr.targets.LocalTarget(["/bin/cat"]).build().start() as t:
p = t.run_command()
p.stdin.write(b"Hello!\n")
assert p.stdout.read(7) == b"Hello!\n"
def test_datascout_local(self):
# copy to a writable location
tf = tempfile.mktemp()
shutil.copy("/usr/bin/env", tf)
with archr.targets.LocalTarget([tf], target_env=["ARCHR=YES"]).build().start() as t:
_,_,_,maps = self.datascout_checks(t)
local_ref = {
'/lib/x86_64-linux-gnu/libc-2.27.so': 0x7ffff79e4000,
'/lib/x86_64-linux-gnu/ld-2.27.so': 0x7ffff7dd5000,
'[stack-end]': 0x7ffffffff000,
'[heap]': 0x55555575d000,
'[vvar]': 0x7ffff7ff8000,
'[vdso]': 0x7ffff7ffb000,
'[vsyscall]': 0xffffffffff600000
}
assert all(maps[x] == local_ref[x] for x in local_ref)
os.unlink(tf)
def test_env_injection(self):
with archr.targets.DockerImageTarget('archr-test:entrypoint-env').build().start() as t:
t.inject_path("/etc/passwd", "/poo")
rf = t.retrieve_contents("/poo")
with open("/etc/passwd", "rb") as lf:
assert lf.read() == rf
t.inject_paths({"/poobin": "/bin", "/poolib": "/lib64"})
rf = t.retrieve_contents("/poobin/true")
with open("/bin/true", "rb") as lf:
assert lf.read() == rf
def test_ltrace_proc_docker(self):
with archr.targets.DockerImageTarget('archr-test:cat', target_args=['/bin/cat', '/etc/passwd']).build().start() as t:
self.check_ltrace_proc(t)
def check_strace_attach(self, t, **kwargs):
target = t.run_command() # start target
b = archr.arsenal.STraceAttachBow(t)
pid = target.pid if isinstance(t, archr.targets.LocalTarget) else t.get_proc_pid('socat')
with b.fire_context(pid=pid, trace_args=STRACE_ARGS, **kwargs) as flight:
sleep(2)
nc = flight.open_channel('tcp:0') # misuse of flight
nc.send(b'ahoi!')
assert nc.readuntil(b'ahoi!', timeout=5) == b'ahoi!'
nc.close()
target.terminate()
trace = flight.result.splitlines()
assert any(b'read' in t and b'ahoi' in t for t in trace)
assert any(b'write' in t and b'ahoi' in t for t in trace)
def test_cat_ldd():
with archr.targets.DockerImageTarget('archr-test:cat').build() as t:
b = archr.arsenal.MemoryMapBow(t)
s = b.fire()
assert s == {
'linux-vdso.so.1': 0x7ffff7ffa000,
'/lib/x86_64-linux-gnu/libc.so.6': 0x7ffff77c4000,
'/lib64/ld-linux-x86-64.so.2': 0x7ffff7dd5000,
'[stack-end]': 0x7ffffffff000,
'[heap]': 0x55555575d000,
'[vvar]': 0x7ffff7ff7000,
'[vdso]': 0x7ffff7ffa000,
'[vsyscall]': 0xffffffffff600000
}