-
Notifications
You must be signed in to change notification settings - Fork 3
Expand file tree
/
Copy pathshell.py
More file actions
executable file
·36 lines (27 loc) · 955 Bytes
/
shell.py
File metadata and controls
executable file
·36 lines (27 loc) · 955 Bytes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
from ctypes import *
import thread
libc = CDLL('libc.so.6')
# Some constants
PROT_READ = 1
PROT_WRITE = 2
PROT_EXEC = 4
def executable_code(buffer):
"""Return a pointer to a page-aligned executable buffer filled in with the data of the string provided.
The pointer should be freed with libc.free() when finished"""
buf = c_char_p(buffer)
size = len(buffer)
# Need to align to a page boundary, so use valloc
addr = libc.valloc(size)
addr = c_void_p(addr)
if 0 == addr:
raise Exception("Failed to allocate memory")
memmove(addr, buf, size)
if 0 != libc.mprotect(addr, len(buffer), PROT_READ | PROT_WRITE | PROT_EXEC):
raise Exception("Failed to set protection on buffer")
return addr
shellcode = "INSERT SHELLCODE HERE"
memorywithshell = executable_code(shellcode)
shell = cast(memorywithshell, CFUNCTYPE(c_void_p))
#shell()
#print 'starting thread'
thread.start_new_thread(shell(),())