Shellcraft Syscall Madness

[zachriggle]

The 3.0 release added a bunch of syscall wrappers, but it did two things wrong:

1. i386 syscalls which should call via socketcall do not (listen, socket, etc.)
2. Syscalls are inter-mingled with the other templates
   • This makes shellcode hard to navigate
   • In particular, it's hard to find the ez-mode stuff among a sea of options

The syscalls should be migrated into their own syscalls sub-directory, e.g. pwnlib/shellcraft/templates/i386/linux/syscalls/execve.asm.

The fall-through logic of the shellcraft module will make these accessible as top-level attributes on the shellcraft object.

This introduces some ambiguity with current ez-mode wrappers which are named after syscalls. These will either need to be renamed, or we accept the ambiguity in these few cases.

[kristoff3r]

I have been working on this, I'll add a pull request with some commits later tonight.

[kokjo]

It would also be nice if the shellcraft CLI ignored all the syscalls and only listed the 'useful' shellcodes...

[kristoff3r]

It would also be nice if the shellcraft CLI ignored all the syscalls and only listed the 'useful' shellcodes...

It already does that, you need to pass the flag --syscalls for it to list syscalls. I have improved the UX for the shellcraft CLI by making it print only the help/usage when using it without arguments, and adding a -l/--list which lists every shellcode, and takes an optional argument to narrow down the list (e.g. -l i386.linux).

[zachriggle]

Doesn't it already have a --list option?

Would you mind adding your PR so I can follow progress?
On Wed, Aug 31, 2016 at 3:23 PM Kristoffer Søholm [email protected]
wrote:

It would also be nice if the shellcraft CLI ignored all the syscalls and
only listed the 'useful' shellcodes...

It already does that, you need to pass the flag --syscalls for it to list
syscalls. I have improved the UX for the shellcraft CLI by making it print
only the help/usage when using it without arguments, and adding a -l/--list
which lists every shellcode, and takes an optional argument to narrow down
the list (e.g. -l i386.linux).

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
#685 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAG0GCtqhrakXfA0t3TzE48yxkTLw5ISks5qlf7ngaJpZM4JqZqN
.

[kristoff3r]

Doesn't it already have a --list option?

It does, because you added it a week ago and I hadn't pulled. Wouldn't it be even better if shellcraft with no arguments just prints what shellcraft -h does now?

Would you mind adding your PR so I can follow progress?

Added.

[zachriggle]

Since we have a --list I'm cool with dumping the --help output as default.

[RobertLarsen]

How is this going?
I'll be adding some shellcode after this is done.

[kristoff3r]

I'll try to get a mergeable version of this pushed tomorrow, thanks for reminding me.

[RobertLarsen]

@kristoff3r If you need help with this just push up your branch

[zachriggle]

++agree

[RobertLarsen]

@kristoff3r Ping

[RobertLarsen]

@kristoff3r Ping

[RobertLarsen]

@kristoff3r Ping

[zachriggle]

Ping on both my and @krisoff3r's pull requests.

I think his does a great job solving this particular PR, and mine solves the generic case of all syscalls, and the ability to generate them on the fly (and a few things are made easier, like passing strings to open() and having it "just work").