pwnlib.shellcraft.amd64
— Shellcode for AMD64¶
pwnlib.shellcraft.amd64
¶
Shellcraft module containing generic Intel x86_64 shellcodes.
-
pwnlib.shellcraft.amd64.
crash
()[source]¶ Crash.
Example
>>> run_assembly(shellcraft.crash()).poll(True) -11
-
pwnlib.shellcraft.amd64.
itoa
(v, buffer='rsp', allocate_stack=True)[source]¶ Converts an integer into its string representation, and pushes it onto the stack.
Parameters: Example
>>> sc = shellcraft.amd64.mov('rax', 0xdeadbeef) >>> sc += shellcraft.amd64.itoa('rax') >>> sc += shellcraft.amd64.linux.write(1, 'rsp', 32) >>> run_assembly(sc).recvuntil(b'\x00') b'3735928559\x00'
-
pwnlib.shellcraft.amd64.
memcpy
(dest, src, n)[source]¶ Copies memory.
Parameters: - dest – Destination address
- src – Source address
- n – Number of bytes
-
pwnlib.shellcraft.amd64.
mov
(dest, src, stack_allowed=True)[source]¶ Move src into dest without newlines and null bytes.
If the src is a register smaller than the dest, then it will be zero-extended to fit inside the larger register.
If the src is a register larger than the dest, then only some of the bits will be used.
If src is a string that is not a register, then it will locally set context.arch to ‘amd64’ and use
pwnlib.constants.eval()
to evaluate the string. Note that this means that this shellcode can change behavior depending on the value of context.os.Example
>>> print(shellcraft.amd64.mov('eax', 'ebx').rstrip()) mov eax, ebx >>> print(shellcraft.amd64.mov('eax', 0).rstrip()) xor eax, eax /* 0 */ >>> print(shellcraft.amd64.mov('ax', 0).rstrip()) xor ax, ax /* 0 */ >>> print(shellcraft.amd64.mov('rax', 0).rstrip()) xor eax, eax /* 0 */ >>> print(shellcraft.amd64.mov('rdi', 'ax').rstrip()) movzx edi, ax >>> print(shellcraft.amd64.mov('al', 'ax').rstrip()) /* moving ax into al, but this is a no-op */ >>> print(shellcraft.amd64.mov('ax', 'bl').rstrip()) movzx ax, bl >>> print(shellcraft.amd64.mov('eax', 1).rstrip()) push 1 pop rax >>> print(shellcraft.amd64.mov('rax', 0xc0).rstrip()) xor eax, eax mov al, 0xc0 >>> print(shellcraft.amd64.mov('rax', 0xc000).rstrip()) xor eax, eax mov ah, 0xc000 >> 8 >>> print(shellcraft.amd64.mov('rax', 0xc0c0).rstrip()) xor eax, eax mov ax, 0xc0c0 >>> print(shellcraft.amd64.mov('rdi', 0xff).rstrip()) mov edi, 0x1010101 /* 255 == 0xff */ xor edi, 0x10101fe >>> print(shellcraft.amd64.mov('rax', 0xdead00ff).rstrip()) mov eax, 0x1010101 /* 3735879935 == 0xdead00ff */ xor eax, 0xdfac01fe >>> print(shellcraft.amd64.mov('rax', 0x11dead00ff).rstrip()) mov rax, 0x101010101010101 /* 76750323967 == 0x11dead00ff */ push rax mov rax, 0x1010110dfac01fe xor [rsp], rax pop rax
>>> with context.local(os='linux'): ... print(shellcraft.amd64.mov('eax', 'SYS_read').rstrip()) xor eax, eax /* (SYS_read) */ >>> with context.local(os='freebsd'): ... print(shellcraft.amd64.mov('eax', 'SYS_read').rstrip()) push (SYS_read) /* 3 */ pop rax >>> with context.local(os='linux'): ... print(shellcraft.amd64.mov('eax', 'PROT_READ | PROT_WRITE | PROT_EXEC').rstrip()) push (PROT_READ | PROT_WRITE | PROT_EXEC) /* 7 */ pop rax
Parameters:
-
pwnlib.shellcraft.amd64.
popad
()[source]¶ Pop all of the registers onto the stack which i386 popad does, in the same order.
-
pwnlib.shellcraft.amd64.
push
(value)[source]¶ Pushes a value onto the stack without using null bytes or newline characters.
If src is a string, then we try to evaluate with context.arch = ‘amd64’ using
pwnlib.constants.eval()
before determining how to push it. Note that this means that this shellcode can change behavior depending on the value of context.os.Parameters: value (int, str) – The value or register to push Example
>>> print(pwnlib.shellcraft.amd64.push(0).rstrip()) /* push 0 */ push 1 dec byte ptr [rsp] >>> print(pwnlib.shellcraft.amd64.push(1).rstrip()) /* push 1 */ push 1 >>> print(pwnlib.shellcraft.amd64.push(256).rstrip()) /* push 256 */ push 0x1010201 ^ 0x100 xor dword ptr [rsp], 0x1010201 >>> with context.local(os='linux'): ... print(pwnlib.shellcraft.amd64.push('SYS_write').rstrip()) /* push 'SYS_write' */ push 1 >>> with context.local(os='freebsd'): ... print(pwnlib.shellcraft.amd64.push('SYS_write').rstrip()) /* push 'SYS_write' */ push 4
-
pwnlib.shellcraft.amd64.
pushad
()[source]¶ Push all of the registers onto the stack which i386 pushad does, in the same order.
-
pwnlib.shellcraft.amd64.
pushstr
(string, append_null=True)[source]¶ Pushes a bytes or string onto the stack without using null bytes or newline characters.
Example
>>> print(shellcraft.amd64.pushstr('').rstrip()) /* push b'\x00' */ push 1 dec byte ptr [rsp] >>> print(shellcraft.amd64.pushstr('a').rstrip()) /* push b'a\x00' */ push 0x61 >>> print(shellcraft.amd64.pushstr('aa').rstrip()) /* push b'aa\x00' */ push 0x1010101 ^ 0x6161 xor dword ptr [rsp], 0x1010101 >>> print(shellcraft.amd64.pushstr('aaa').rstrip()) /* push b'aaa\x00' */ push 0x1010101 ^ 0x616161 xor dword ptr [rsp], 0x1010101 >>> print(shellcraft.amd64.pushstr('aaaa').rstrip()) /* push b'aaaa\x00' */ push 0x61616161 >>> print(shellcraft.amd64.pushstr(b'aaa\xc3').rstrip()) /* push b'aaa\xc3\x00' */ mov rax, 0x101010101010101 push rax mov rax, 0x101010101010101 ^ 0xc3616161 xor [rsp], rax >>> print(shellcraft.amd64.pushstr(b'aaa\xc3', append_null=False).rstrip()) /* push b'aaa\xc3' */ push -0x3c9e9e9f >>> print(shellcraft.amd64.pushstr(b'\xc3').rstrip()) /* push b'\xc3\x00' */ push 0x1010101 ^ 0xc3 xor dword ptr [rsp], 0x1010101 >>> print(shellcraft.amd64.pushstr(b'\xc3', append_null=False).rstrip()) /* push b'\xc3' */ push -0x3d >>> with context.local(): ... context.arch = 'amd64' ... print(enhex(asm(shellcraft.pushstr("/bin/sh")))) 48b801010101010101015048b82e63686f2e72690148310424 >>> with context.local(): ... context.arch = 'amd64' ... print(enhex(asm(shellcraft.pushstr("")))) 6a01fe0c24 >>> with context.local(): ... context.arch = 'amd64' ... print(enhex(asm(shellcraft.pushstr(b"\x00", False)))) 6a01fe0c24
Parameters:
-
pwnlib.shellcraft.amd64.
pushstr_array
(reg, array)[source]¶ Pushes an array/envp-style array of pointers onto the stack.
Parameters:
-
pwnlib.shellcraft.amd64.
ret
(return_value=None)[source]¶ A single-byte RET instruction.
Parameters: return_value – Value to return
-
pwnlib.shellcraft.amd64.
setregs
(reg_context, stack_allowed=True)[source]¶ Sets multiple registers, taking any register dependencies into account (i.e., given eax=1,ebx=eax, set ebx first).
Parameters: Example
>>> print(shellcraft.setregs({'rax': 1, 'rbx': 'rax'}).rstrip()) mov rbx, rax push 1 pop rax >>> print(shellcraft.setregs({'rax': 'SYS_write', 'rbx': 'rax'}).rstrip()) mov rbx, rax push (SYS_write) /* 1 */ pop rax >>> print(shellcraft.setregs({'rax': 'rbx', 'rbx': 'rax', 'rcx': 'rbx'}).rstrip()) mov rcx, rbx xchg rax, rbx >>> print(shellcraft.setregs({'rax': 1, 'rdx': 0}).rstrip()) push 1 pop rax cdq /* rdx=0 */
-
pwnlib.shellcraft.amd64.
strcpy
(dst, src)[source]¶ Copies a string
Example
>>> sc = 'jmp get_str\n' >>> sc += 'pop_str: pop rax\n' >>> sc += shellcraft.amd64.strcpy('rsp', 'rax') >>> sc += shellcraft.amd64.linux.write(1, 'rsp', 32) >>> sc += shellcraft.amd64.linux.exit(0) >>> sc += 'get_str: call pop_str\n' >>> sc += '.asciz "Hello, world\\n"' >>> run_assembly(sc).recvline() b'Hello, world\n'
-
pwnlib.shellcraft.amd64.
strlen
(string, reg='rcx')[source]¶ Calculate the length of the specified string.
Parameters: Example
>>> sc = 'jmp get_str\n' >>> sc += 'pop_str: pop rdi\n' >>> sc += shellcraft.amd64.strlen('rdi', 'rax') >>> sc += 'push rax;' >>> sc += shellcraft.amd64.linux.write(1, 'rsp', 8) >>> sc += shellcraft.amd64.linux.exit(0) >>> sc += 'get_str: call pop_str\n' >>> sc += '.asciz "Hello, world\\n"' >>> run_assembly(sc).unpack() == len('Hello, world\n') True
-
pwnlib.shellcraft.amd64.
xor
(key, address, count)[source]¶ XORs data a constant value.
Parameters: - key (int, bytes, str) – XOR key either as a 8-byte integer, If a string, length must be a power of two, and not longer than 8 bytes. Alternately, may be a register.
- address (int) – Address of the data (e.g. 0xdead0000, ‘esp’)
- count (int) – Number of bytes to XOR, or a register containing the number of bytes to XOR.
Example
>>> sc = shellcraft.read(0, 'rsp', 32) >>> sc += shellcraft.xor(0xdeadbeef, 'rsp', 32) >>> sc += shellcraft.write(1, 'rsp', 32) >>> io = run_assembly(sc) >>> io.send(cyclic(32)) >>> result = io.recvn(32) >>> expected = xor(cyclic(32), p32(0xdeadbeef)) >>> result == expected True
pwnlib.shellcraft.amd64.linux
¶
Shellcraft module containing Intel x86_64 shellcodes for Linux.
-
pwnlib.shellcraft.amd64.linux.
accept
(fd, addr, addr_len)[source]¶ Invokes the syscall accept. See ‘man 2 accept’ for more information.
Parameters: - fd (int) – fd
- addr (SOCKADDR_ARG) – addr
- addr_len (socklen_t) – addr_len
-
pwnlib.shellcraft.amd64.linux.
access
(name, type)[source]¶ Invokes the syscall access. See ‘man 2 access’ for more information.
Parameters: - name (char) – name
- type (int) – type
-
pwnlib.shellcraft.amd64.linux.
acct
(name)[source]¶ Invokes the syscall acct. See ‘man 2 acct’ for more information.
Parameters: name (char) – name
-
pwnlib.shellcraft.amd64.linux.
alarm
(seconds)[source]¶ Invokes the syscall alarm. See ‘man 2 alarm’ for more information.
Parameters: seconds (unsigned) – seconds
-
pwnlib.shellcraft.amd64.linux.
bind
(fd, addr, length)[source]¶ Invokes the syscall bind. See ‘man 2 bind’ for more information.
Parameters: - fd (int) – fd
- addr (CONST_SOCKADDR_ARG) – addr
- len (socklen_t) – len
-
pwnlib.shellcraft.amd64.linux.
bindsh
(port, network)[source]¶ Listens on a TCP port and spawns a shell for the first to connect. Port is the TCP port to listen on, network is either ‘ipv4’ or ‘ipv6’.
-
pwnlib.shellcraft.amd64.linux.
brk
(addr)[source]¶ Invokes the syscall brk. See ‘man 2 brk’ for more information.
Parameters: addr (void) – addr
-
pwnlib.shellcraft.amd64.linux.
cat
(filename, fd=1)[source]¶ Opens a file and writes its contents to the specified file descriptor.
-
pwnlib.shellcraft.amd64.linux.
chdir
(path)[source]¶ Invokes the syscall chdir. See ‘man 2 chdir’ for more information.
Parameters: path (char) – path
-
pwnlib.shellcraft.amd64.linux.
chmod
(file, mode)[source]¶ Invokes the syscall chmod. See ‘man 2 chmod’ for more information.
Parameters: - file (char) – file
- mode (mode_t) – mode
-
pwnlib.shellcraft.amd64.linux.
chown
(file, owner, group)[source]¶ Invokes the syscall chown. See ‘man 2 chown’ for more information.
Parameters: - file (char) – file
- owner (uid_t) – owner
- group (gid_t) – group
-
pwnlib.shellcraft.amd64.linux.
chroot
(path)[source]¶ Invokes the syscall chroot. See ‘man 2 chroot’ for more information.
Parameters: path (char) – path
-
pwnlib.shellcraft.amd64.linux.
clock_getres
(clock_id, res)[source]¶ Invokes the syscall clock_getres. See ‘man 2 clock_getres’ for more information.
Parameters: - clock_id (clockid_t) – clock_id
- res (timespec) – res
-
pwnlib.shellcraft.amd64.linux.
clock_gettime
(clock_id, tp)[source]¶ Invokes the syscall clock_gettime. See ‘man 2 clock_gettime’ for more information.
Parameters: - clock_id (clockid_t) – clock_id
- tp (timespec) – tp
-
pwnlib.shellcraft.amd64.linux.
clock_nanosleep
(clock_id, flags, req, rem)[source]¶ Invokes the syscall clock_nanosleep. See ‘man 2 clock_nanosleep’ for more information.
Parameters: - clock_id (clockid_t) – clock_id
- flags (int) – flags
- req (timespec) – req
- rem (timespec) – rem
-
pwnlib.shellcraft.amd64.linux.
clock_settime
(clock_id, tp)[source]¶ Invokes the syscall clock_settime. See ‘man 2 clock_settime’ for more information.
Parameters: - clock_id (clockid_t) – clock_id
- tp (timespec) – tp
-
pwnlib.shellcraft.amd64.linux.
clone
(fn, child_stack, flags, arg, vararg)[source]¶ Invokes the syscall clone. See ‘man 2 clone’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
close
(fd)[source]¶ Invokes the syscall close. See ‘man 2 close’ for more information.
Parameters: fd (int) – fd
-
pwnlib.shellcraft.amd64.linux.
connect
(host, port, network='ipv4')[source]¶ Connects to the host on the specified port. Network is either ‘ipv4’ or ‘ipv6’. Leaves the connected socket in rbp.
-
pwnlib.shellcraft.amd64.linux.
connectstager
(host, port, network='ipv4')[source]¶ connect recvsize stager :param host, where to connect to: :param port, which port to connect to: :param network, ipv4 or ipv6? (default: ipv4)
-
pwnlib.shellcraft.amd64.linux.
creat
(file, mode)[source]¶ Invokes the syscall creat. See ‘man 2 creat’ for more information.
Parameters: - file (char) – file
- mode (mode_t) – mode
-
pwnlib.shellcraft.amd64.linux.
dup
(sock='rbp')[source]¶ Args: [sock (imm/reg) = rbp] Duplicates sock to stdin, stdout and stderr
-
pwnlib.shellcraft.amd64.linux.
dup2
(fd, fd2)[source]¶ Invokes the syscall dup2. See ‘man 2 dup2’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
dup3
(fd, fd2, flags)[source]¶ Invokes the syscall dup3. See ‘man 2 dup3’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
dupsh
(sock='rbp')[source]¶ Args: [sock (imm/reg) = rbp] Duplicates sock to stdin, stdout and stderr and spawns a shell.
-
pwnlib.shellcraft.amd64.linux.
egghunter
(egg, start_address=0)[source]¶ Searches memory for the byte sequence ‘egg’.
Return value is the address immediately following the match, stored in RDI.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
epoll_create
(size)[source]¶ Invokes the syscall epoll_create. See ‘man 2 epoll_create’ for more information.
Parameters: size (int) – size
-
pwnlib.shellcraft.amd64.linux.
epoll_create1
(flags)[source]¶ Invokes the syscall epoll_create1. See ‘man 2 epoll_create1’ for more information.
Parameters: flags (int) – flags
-
pwnlib.shellcraft.amd64.linux.
epoll_ctl
(epfd, op, fd, event)[source]¶ Invokes the syscall epoll_ctl. See ‘man 2 epoll_ctl’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
epoll_pwait
(epfd, events, maxevents, timeout, ss)[source]¶ Invokes the syscall epoll_pwait. See ‘man 2 epoll_pwait’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
epoll_wait
(epfd, events, maxevents, timeout)[source]¶ Invokes the syscall epoll_wait. See ‘man 2 epoll_wait’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
execve
(path='/bin///sh', argv=[], envp={})[source]¶ Execute a different process.
Attempts to perform some automatic detection of types. Otherwise, the arguments behave as normal.
- If
path
is a string that is not a known register, it is pushed onto the stack. - If
argv
is an array of strings, it is pushed onto the stack, and NULL-terminated. - If
envp
is an dictionary of {string:string}, it is pushed onto the stack, and NULL-terminated.
Example
>>> path = '/bin/sh' >>> argv = ['sh', '-c', 'echo Hello, $NAME; exit $STATUS'] >>> envp = {'NAME': 'zerocool', 'STATUS': '3'} >>> sc = shellcraft.amd64.linux.execve(path, argv, envp) >>> io = run_assembly(sc) >>> io.recvall() b'Hello, zerocool\n' >>> io.poll(True) 3
- If
-
pwnlib.shellcraft.amd64.linux.
exit
(status=None)[source]¶ Invokes the syscall exit. See ‘man 2 exit’ for more information.
Parameters: status (int) – status Doctest
>>> run_assembly_exitcode(shellcraft.exit(33)) 33
-
pwnlib.shellcraft.amd64.linux.
faccessat
(fd, file, type, flag)[source]¶ Invokes the syscall faccessat. See ‘man 2 faccessat’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
fallocate
(fd, mode, offset, length)[source]¶ Invokes the syscall fallocate. See ‘man 2 fallocate’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
fchdir
(fd)[source]¶ Invokes the syscall fchdir. See ‘man 2 fchdir’ for more information.
Parameters: fd (int) – fd
-
pwnlib.shellcraft.amd64.linux.
fchmod
(fd, mode)[source]¶ Invokes the syscall fchmod. See ‘man 2 fchmod’ for more information.
Parameters: - fd (int) – fd
- mode (mode_t) – mode
-
pwnlib.shellcraft.amd64.linux.
fchmodat
(fd, file, mode, flag)[source]¶ Invokes the syscall fchmodat. See ‘man 2 fchmodat’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
fchown
(fd, owner, group)[source]¶ Invokes the syscall fchown. See ‘man 2 fchown’ for more information.
Parameters: - fd (int) – fd
- owner (uid_t) – owner
- group (gid_t) – group
-
pwnlib.shellcraft.amd64.linux.
fchownat
(fd, file, owner, group, flag)[source]¶ Invokes the syscall fchownat. See ‘man 2 fchownat’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
fcntl
(fd, cmd, vararg)[source]¶ Invokes the syscall fcntl. See ‘man 2 fcntl’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
fdatasync
(fildes)[source]¶ Invokes the syscall fdatasync. See ‘man 2 fdatasync’ for more information.
Parameters: fildes (int) – fildes
-
pwnlib.shellcraft.amd64.linux.
findpeer
(port=None)[source]¶ Args: port (defaults to any port) Finds a socket, which is connected to the specified port. Leaves socket in RDI.
-
pwnlib.shellcraft.amd64.linux.
findpeersh
(port=None)[source]¶ Args: port (defaults to any) Finds an open socket which connects to a specified port, and then opens a dup2 shell on it.
-
pwnlib.shellcraft.amd64.linux.
findpeerstager
(port=None)[source]¶ Findpeer recvsize stager :param port, the port given to findpeer: :type port, the port given to findpeer: defaults to any
-
pwnlib.shellcraft.amd64.linux.
flock
(fd, operation)[source]¶ Invokes the syscall flock. See ‘man 2 flock’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
fork
()[source]¶ Invokes the syscall fork. See ‘man 2 fork’ for more information.
Arguments:
-
pwnlib.shellcraft.amd64.linux.
forkexit
()[source]¶ Attempts to fork. If the fork is successful, the parent exits.
-
pwnlib.shellcraft.amd64.linux.
fstat
(fd, buf)[source]¶ Invokes the syscall fstat. See ‘man 2 fstat’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
fstat64
(fd, buf)[source]¶ Invokes the syscall fstat64. See ‘man 2 fstat64’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
fstatat64
(fd, file, buf, flag)[source]¶ Invokes the syscall fstatat64. See ‘man 2 fstatat64’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
fsync
(fd)[source]¶ Invokes the syscall fsync. See ‘man 2 fsync’ for more information.
Parameters: fd (int) – fd
-
pwnlib.shellcraft.amd64.linux.
ftruncate
(fd, length)[source]¶ Invokes the syscall ftruncate. See ‘man 2 ftruncate’ for more information.
Parameters: - fd (int) – fd
- length (off_t) – length
-
pwnlib.shellcraft.amd64.linux.
ftruncate64
(fd, length)[source]¶ Invokes the syscall ftruncate64. See ‘man 2 ftruncate64’ for more information.
Parameters: - fd (int) – fd
- length (off64_t) – length
-
pwnlib.shellcraft.amd64.linux.
futimesat
(fd, file, tvp)[source]¶ Invokes the syscall futimesat. See ‘man 2 futimesat’ for more information.
Parameters: - fd (int) – fd
- file (char) – file
- tvp (timeval) – tvp
-
pwnlib.shellcraft.amd64.linux.
getcwd
(buf, size)[source]¶ Invokes the syscall getcwd. See ‘man 2 getcwd’ for more information.
Parameters: - buf (char) – buf
- size (size_t) – size
-
pwnlib.shellcraft.amd64.linux.
getegid
()[source]¶ Invokes the syscall getegid. See ‘man 2 getegid’ for more information.
Arguments:
-
pwnlib.shellcraft.amd64.linux.
geteuid
()[source]¶ Invokes the syscall geteuid. See ‘man 2 geteuid’ for more information.
Arguments:
-
pwnlib.shellcraft.amd64.linux.
getgid
()[source]¶ Invokes the syscall getgid. See ‘man 2 getgid’ for more information.
Arguments:
-
pwnlib.shellcraft.amd64.linux.
getgroups
(size, list)[source]¶ Invokes the syscall getgroups. See ‘man 2 getgroups’ for more information.
Parameters: - size (int) – size
- list (gid_t) – list
-
pwnlib.shellcraft.amd64.linux.
getitimer
(which, value)[source]¶ Invokes the syscall getitimer. See ‘man 2 getitimer’ for more information.
Parameters: - which (itimer_which_t) – which
- value (itimerval) – value
-
pwnlib.shellcraft.amd64.linux.
getpeername
(fd, addr, length)[source]¶ Invokes the syscall getpeername. See ‘man 2 getpeername’ for more information.
Parameters: - fd (int) – fd
- addr (SOCKADDR_ARG) – addr
- len (socklen_t) – len
-
pwnlib.shellcraft.amd64.linux.
getpgid
(pid)[source]¶ Invokes the syscall getpgid. See ‘man 2 getpgid’ for more information.
Parameters: pid (pid_t) – pid
-
pwnlib.shellcraft.amd64.linux.
getpgrp
()[source]¶ Invokes the syscall getpgrp. See ‘man 2 getpgrp’ for more information.
Arguments:
-
pwnlib.shellcraft.amd64.linux.
getpmsg
(fildes, ctlptr, dataptr, bandp, flagsp)[source]¶ Invokes the syscall getpmsg. See ‘man 2 getpmsg’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
getppid
()[source]¶ Invokes the syscall getppid. See ‘man 2 getppid’ for more information.
Arguments:
-
pwnlib.shellcraft.amd64.linux.
getpriority
(which, who)[source]¶ Invokes the syscall getpriority. See ‘man 2 getpriority’ for more information.
Parameters: - which (priority_which_t) – which
- who (id_t) – who
-
pwnlib.shellcraft.amd64.linux.
getresgid
(rgid, egid, sgid)[source]¶ Invokes the syscall getresgid. See ‘man 2 getresgid’ for more information.
Parameters: - rgid (gid_t) – rgid
- egid (gid_t) – egid
- sgid (gid_t) – sgid
-
pwnlib.shellcraft.amd64.linux.
getresuid
(ruid, euid, suid)[source]¶ Invokes the syscall getresuid. See ‘man 2 getresuid’ for more information.
Parameters: - ruid (uid_t) – ruid
- euid (uid_t) – euid
- suid (uid_t) – suid
-
pwnlib.shellcraft.amd64.linux.
getrlimit
(resource, rlimits)[source]¶ Invokes the syscall getrlimit. See ‘man 2 getrlimit’ for more information.
Parameters: - resource (rlimit_resource_t) – resource
- rlimits (rlimit) – rlimits
-
pwnlib.shellcraft.amd64.linux.
getrusage
(who, usage)[source]¶ Invokes the syscall getrusage. See ‘man 2 getrusage’ for more information.
Parameters: - who (rusage_who_t) – who
- usage (rusage) – usage
-
pwnlib.shellcraft.amd64.linux.
getsid
(pid)[source]¶ Invokes the syscall getsid. See ‘man 2 getsid’ for more information.
Parameters: pid (pid_t) – pid
-
pwnlib.shellcraft.amd64.linux.
getsockname
(fd, addr, length)[source]¶ Invokes the syscall getsockname. See ‘man 2 getsockname’ for more information.
Parameters: - fd (int) – fd
- addr (SOCKADDR_ARG) – addr
- len (socklen_t) – len
-
pwnlib.shellcraft.amd64.linux.
getsockopt
(fd, level, optname, optval, optlen)[source]¶ Invokes the syscall getsockopt. See ‘man 2 getsockopt’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
gettimeofday
(tv, tz)[source]¶ Invokes the syscall gettimeofday. See ‘man 2 gettimeofday’ for more information.
Parameters: - tv (timeval) – tv
- tz (timezone_ptr_t) – tz
-
pwnlib.shellcraft.amd64.linux.
getuid
()[source]¶ Invokes the syscall getuid. See ‘man 2 getuid’ for more information.
Arguments:
-
pwnlib.shellcraft.amd64.linux.
gtty
(fd, params)[source]¶ Invokes the syscall gtty. See ‘man 2 gtty’ for more information.
Parameters: - fd (int) – fd
- params (sgttyb) – params
-
pwnlib.shellcraft.amd64.linux.
ioctl
(fd, request, vararg)[source]¶ Invokes the syscall ioctl. See ‘man 2 ioctl’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
ioperm
(from_, num, turn_on)[source]¶ Invokes the syscall ioperm. See ‘man 2 ioperm’ for more information.
Parameters: - from (unsigned) – from
- num (unsigned) – num
- turn_on (int) – turn_on
-
pwnlib.shellcraft.amd64.linux.
iopl
(level)[source]¶ Invokes the syscall iopl. See ‘man 2 iopl’ for more information.
Parameters: level (int) – level
-
pwnlib.shellcraft.amd64.linux.
kill
(pid, signal='SIGKILL')[source]¶ Writes a string to a file descriptor
-
pwnlib.shellcraft.amd64.linux.
killparent
()[source]¶ Kills its parent process until whatever the parent is (probably init) cannot be killed any longer.
-
pwnlib.shellcraft.amd64.linux.
lchown
(file, owner, group)[source]¶ Invokes the syscall lchown. See ‘man 2 lchown’ for more information.
Parameters: - file (char) – file
- owner (uid_t) – owner
- group (gid_t) – group
-
pwnlib.shellcraft.amd64.linux.
link
(from_, to)[source]¶ Invokes the syscall link. See ‘man 2 link’ for more information.
Parameters: - from (char) – from
- to (char) – to
-
pwnlib.shellcraft.amd64.linux.
linkat
(fromfd, from_, tofd, to, flags)[source]¶ Invokes the syscall linkat. See ‘man 2 linkat’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
listen
(port, network)[source]¶ Listens on a TCP port, accept a client and leave his socket in RAX. Port is the TCP port to listen on, network is either ‘ipv4’ or ‘ipv6’.
-
pwnlib.shellcraft.amd64.linux.
loader
(address)[source]¶ Loads a statically-linked ELF into memory and transfers control.
Parameters: address (int) – Address of the ELF as a register or integer.
-
pwnlib.shellcraft.amd64.linux.
loader_append
(data=None)[source]¶ Loads a statically-linked ELF into memory and transfers control.
Similar to loader.asm but loads an appended ELF.
Parameters: data (bytes, str) – If a valid filename, the data is loaded from the named file. Otherwise, this is treated as raw ELF data to append. If None
, it is ignored.Example
>>> gcc = process(['gcc', '-m64', '-xc', '-static', '-Wl,-Ttext-segment=0x20000000', '-']) >>> gcc.write(''' ... int main() { ... printf("Hello, %s!\\n", "amd64"); ... } ... ''') >>> gcc.shutdown('send') >>> gcc.poll(True) 0 >>> sc = shellcraft.loader_append('a.out')
The following doctest is commented out because it doesn’t work on Travis for reasons I cannot diagnose. However, it should work just fine :-)
# >>> run_assembly(sc).recvline() == b’Hello, amd64!n’ # True
-
pwnlib.shellcraft.amd64.linux.
lseek
(fd, offset, whence)[source]¶ Invokes the syscall lseek. See ‘man 2 lseek’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
lstat
(file, buf)[source]¶ Invokes the syscall lstat. See ‘man 2 lstat’ for more information.
Parameters: - file (char) – file
- buf (stat) – buf
-
pwnlib.shellcraft.amd64.linux.
lstat64
(file, buf)[source]¶ Invokes the syscall lstat64. See ‘man 2 lstat64’ for more information.
Parameters: - file (char) – file
- buf (stat64) – buf
-
pwnlib.shellcraft.amd64.linux.
madvise
(addr, length, advice)[source]¶ Invokes the syscall madvise. See ‘man 2 madvise’ for more information.
Parameters: - addr (void) – addr
- len (size_t) – len
- advice (int) – advice
-
pwnlib.shellcraft.amd64.linux.
membot
(readsock=0, writesock=1)[source]¶ Read-write access to a remote process’ memory.
Provide a single pointer-width value to determine the operation to perform:
- 0: Exit the loop
- 1: Read data
- 2: Write data
-
pwnlib.shellcraft.amd64.linux.
mincore
(start, length, vec)[source]¶ Invokes the syscall mincore. See ‘man 2 mincore’ for more information.
Parameters: - start (void) – start
- len (size_t) – len
- vec (unsigned) – vec
-
pwnlib.shellcraft.amd64.linux.
mkdir
(path, mode)[source]¶ Invokes the syscall mkdir. See ‘man 2 mkdir’ for more information.
Parameters: - path (char) – path
- mode (mode_t) – mode
-
pwnlib.shellcraft.amd64.linux.
mkdirat
(fd, path, mode)[source]¶ Invokes the syscall mkdirat. See ‘man 2 mkdirat’ for more information.
Parameters: - fd (int) – fd
- path (char) – path
- mode (mode_t) – mode
-
pwnlib.shellcraft.amd64.linux.
mknod
(path, mode, dev)[source]¶ Invokes the syscall mknod. See ‘man 2 mknod’ for more information.
Parameters: - path (char) – path
- mode (mode_t) – mode
- dev (dev_t) – dev
-
pwnlib.shellcraft.amd64.linux.
mknodat
(fd, path, mode, dev)[source]¶ Invokes the syscall mknodat. See ‘man 2 mknodat’ for more information.
Parameters: - fd (int) – fd
- path (char) – path
- mode (mode_t) – mode
- dev (dev_t) – dev
-
pwnlib.shellcraft.amd64.linux.
mlock
(addr, length)[source]¶ Invokes the syscall mlock. See ‘man 2 mlock’ for more information.
Parameters: - addr (void) – addr
- len (size_t) – len
-
pwnlib.shellcraft.amd64.linux.
mlockall
(flags)[source]¶ Invokes the syscall mlockall. See ‘man 2 mlockall’ for more information.
Parameters: flags (int) – flags
-
pwnlib.shellcraft.amd64.linux.
mmap
(addr=0, length=4096, prot=7, flags=34, fd=-1, offset=0)[source]¶ Invokes the syscall mmap. See ‘man 2 mmap’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
mmap_rwx
(size=4096, protection=7, address=None)[source]¶ Maps some memory
-
pwnlib.shellcraft.amd64.linux.
mov
(dest, src, stack_allowed=True)[source]¶ Thin wrapper around
pwnlib.shellcraft.amd64.mov()
, which sets context.os to ‘linux’ before calling.Example
>>> print(pwnlib.shellcraft.amd64.linux.mov('eax', 'SYS_execve').rstrip()) push (SYS_execve) /* 0x3b */ pop rax
-
pwnlib.shellcraft.amd64.linux.
mprotect
(addr, length, prot)[source]¶ Invokes the syscall mprotect. See ‘man 2 mprotect’ for more information.
Parameters: - addr (void) – addr
- length (size_t) – length
- prot (int) – prot
-
pwnlib.shellcraft.amd64.linux.
mq_notify
(mqdes, notification)[source]¶ Invokes the syscall mq_notify. See ‘man 2 mq_notify’ for more information.
Parameters: - mqdes (mqd_t) – mqdes
- notification (sigevent) – notification
-
pwnlib.shellcraft.amd64.linux.
mq_open
(name, oflag, vararg)[source]¶ Invokes the syscall mq_open. See ‘man 2 mq_open’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
mq_timedreceive
(mqdes, msg_ptr, msg_len, msg_prio, abs_timeout)[source]¶ Invokes the syscall mq_timedreceive. See ‘man 2 mq_timedreceive’ for more information.
Parameters: - mqdes (mqd_t) – mqdes
- msg_ptr (char) – msg_ptr
- msg_len (size_t) – msg_len
- msg_prio (unsigned) – msg_prio
- abs_timeout (timespec) – abs_timeout
-
pwnlib.shellcraft.amd64.linux.
mq_timedsend
(mqdes, msg_ptr, msg_len, msg_prio, abs_timeout)[source]¶ Invokes the syscall mq_timedsend. See ‘man 2 mq_timedsend’ for more information.
Parameters: - mqdes (mqd_t) – mqdes
- msg_ptr (char) – msg_ptr
- msg_len (size_t) – msg_len
- msg_prio (unsigned) – msg_prio
- abs_timeout (timespec) – abs_timeout
-
pwnlib.shellcraft.amd64.linux.
mq_unlink
(name)[source]¶ Invokes the syscall mq_unlink. See ‘man 2 mq_unlink’ for more information.
Parameters: name (char) – name
-
pwnlib.shellcraft.amd64.linux.
mremap
(addr, old_len, new_len, flags, vararg)[source]¶ Invokes the syscall mremap. See ‘man 2 mremap’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
msync
(addr, length, flags)[source]¶ Invokes the syscall msync. See ‘man 2 msync’ for more information.
Parameters: - addr (void) – addr
- len (size_t) – len
- flags (int) – flags
-
pwnlib.shellcraft.amd64.linux.
munlock
(addr, length)[source]¶ Invokes the syscall munlock. See ‘man 2 munlock’ for more information.
Parameters: - addr (void) – addr
- len (size_t) – len
-
pwnlib.shellcraft.amd64.linux.
munlockall
()[source]¶ Invokes the syscall munlockall. See ‘man 2 munlockall’ for more information.
Arguments:
-
pwnlib.shellcraft.amd64.linux.
munmap
(addr, length)[source]¶ Invokes the syscall munmap. See ‘man 2 munmap’ for more information.
Parameters: - addr (void) – addr
- len (size_t) – len
-
pwnlib.shellcraft.amd64.linux.
nanosleep
(requested_time, remaining)[source]¶ Invokes the syscall nanosleep. See ‘man 2 nanosleep’ for more information.
Parameters: - requested_time (timespec) – requested_time
- remaining (timespec) – remaining
-
pwnlib.shellcraft.amd64.linux.
nice
(inc)[source]¶ Invokes the syscall nice. See ‘man 2 nice’ for more information.
Parameters: inc (int) – inc
-
pwnlib.shellcraft.amd64.linux.
open
(file, oflag, vararg)[source]¶ Invokes the syscall open. See ‘man 2 open’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
openat
(fd, file, oflag, vararg)[source]¶ Invokes the syscall openat. See ‘man 2 openat’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
pause
()[source]¶ Invokes the syscall pause. See ‘man 2 pause’ for more information.
Arguments:
-
pwnlib.shellcraft.amd64.linux.
pipe
(pipedes)[source]¶ Invokes the syscall pipe. See ‘man 2 pipe’ for more information.
Parameters: pipedes (int) – pipedes
-
pwnlib.shellcraft.amd64.linux.
pipe2
(pipedes, flags)[source]¶ Invokes the syscall pipe2. See ‘man 2 pipe2’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
poll
(fds, nfds, timeout)[source]¶ Invokes the syscall poll. See ‘man 2 poll’ for more information.
Parameters: - fds (pollfd) – fds
- nfds (nfds_t) – nfds
- timeout (int) – timeout
-
pwnlib.shellcraft.amd64.linux.
ppoll
(fds, nfds, timeout, ss)[source]¶ Invokes the syscall ppoll. See ‘man 2 ppoll’ for more information.
Parameters: - fds (pollfd) – fds
- nfds (nfds_t) – nfds
- timeout (timespec) – timeout
- ss (sigset_t) – ss
-
pwnlib.shellcraft.amd64.linux.
prctl
(option, *vararg)[source]¶ Invokes the syscall prctl. See ‘man 2 prctl’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
pread
(fd, buf, nbytes, offset)[source]¶ Invokes the syscall pread. See ‘man 2 pread’ for more information.
Parameters: - fd (int) – fd
- buf (void) – buf
- nbytes (size_t) – nbytes
- offset (off_t) – offset
-
pwnlib.shellcraft.amd64.linux.
preadv
(fd, iovec, count, offset)[source]¶ Invokes the syscall preadv. See ‘man 2 preadv’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
prlimit64
(pid, resource, new_limit, old_limit)[source]¶ Invokes the syscall prlimit64. See ‘man 2 prlimit64’ for more information.
Parameters: - pid (pid_t) – pid
- resource (rlimit_resource) – resource
- new_limit (rlimit64) – new_limit
- old_limit (rlimit64) – old_limit
-
pwnlib.shellcraft.amd64.linux.
profil
(sample_buffer, size, offset, scale)[source]¶ Invokes the syscall profil. See ‘man 2 profil’ for more information.
Parameters: - sample_buffer (unsigned) – sample_buffer
- size (size_t) – size
- offset (size_t) – offset
- scale (unsigned) – scale
-
pwnlib.shellcraft.amd64.linux.
ptrace
(request, *vararg)[source]¶ Invokes the syscall ptrace. See ‘man 2 ptrace’ for more information.
Parameters: - request (ptrace_request) – request
- vararg (int) – vararg
-
pwnlib.shellcraft.amd64.linux.
push
(value)[source]¶ Thin wrapper around
pwnlib.shellcraft.amd64.push()
, which sets context.os to ‘linux’ before calling.Example
>>> print(pwnlib.shellcraft.amd64.linux.push('SYS_execve').rstrip()) /* push 'SYS_execve' */ push 0x3b
-
pwnlib.shellcraft.amd64.linux.
putpmsg
(fildes, ctlptr, dataptr, band, flags)[source]¶ Invokes the syscall putpmsg. See ‘man 2 putpmsg’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
pwrite
(fd, buf, n, offset)[source]¶ Invokes the syscall pwrite. See ‘man 2 pwrite’ for more information.
Parameters: - fd (int) – fd
- buf (void) – buf
- n (size_t) – n
- offset (off_t) – offset
-
pwnlib.shellcraft.amd64.linux.
pwritev
(fd, iovec, count, offset)[source]¶ Invokes the syscall pwritev. See ‘man 2 pwritev’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
read
(fd=0, buffer='rsp', count=8)[source]¶ Reads data from the file descriptor into the provided buffer. This is a one-shot and does not fill the request.
-
pwnlib.shellcraft.amd64.linux.
read_upto
(fd=0, buffer='rsp', sizereg='rdx')[source]¶ Reads up to N bytes 8 bytes into the specified register
-
pwnlib.shellcraft.amd64.linux.
readahead
(fd, offset, count)[source]¶ Invokes the syscall readahead. See ‘man 2 readahead’ for more information.
Parameters: - fd (int) – fd
- offset (off64_t) – offset
- count (size_t) – count
-
pwnlib.shellcraft.amd64.linux.
readdir
(dirp)[source]¶ Invokes the syscall readdir. See ‘man 2 readdir’ for more information.
Parameters: dirp (DIR) – dirp
-
pwnlib.shellcraft.amd64.linux.
readfile
(path, dst='rdi')[source]¶ Args: [path, dst (imm/reg) = rdi] Opens the specified file path and sends its content to the specified file descriptor.
-
pwnlib.shellcraft.amd64.linux.
readinto
(sock=0)[source]¶ Reads into a buffer of a size and location determined at runtime. When the shellcode is executing, it should send a pointer and pointer-width size to determine the location and size of buffer.
-
pwnlib.shellcraft.amd64.linux.
readlink
(path, buf, length)[source]¶ Invokes the syscall readlink. See ‘man 2 readlink’ for more information.
Parameters: - path (char) – path
- buf (char) – buf
- len (size_t) – len
-
pwnlib.shellcraft.amd64.linux.
readlinkat
(fd, path, buf, length)[source]¶ Invokes the syscall readlinkat. See ‘man 2 readlinkat’ for more information.
Parameters: - fd (int) – fd
- path (char) – path
- buf (char) – buf
- len (size_t) – len
-
pwnlib.shellcraft.amd64.linux.
readloop
(sock=0)[source]¶ Reads into a buffer of a size and location determined at runtime. When the shellcode is executing, it should send a pointer and pointer-width size to determine the location and size of buffer.
-
pwnlib.shellcraft.amd64.linux.
readn
(fd, buf, nbytes)[source]¶ Reads exactly nbytes bytes from file descriptor fd into the buffer buf.
Parameters: - fd (int) – fd
- buf (void) – buf
- nbytes (size_t) – nbytes
-
pwnlib.shellcraft.amd64.linux.
readptr
(fd=0, target_reg='rdx')[source]¶ Reads 8 bytes into the specified register
-
pwnlib.shellcraft.amd64.linux.
readv
(fd, iovec, count)[source]¶ Invokes the syscall readv. See ‘man 2 readv’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
recv
(fd, buf, n, flags)[source]¶ Invokes the syscall recv. See ‘man 2 recv’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
recvfrom
(fd, buf, n, flags, addr, addr_len)[source]¶ Invokes the syscall recvfrom. See ‘man 2 recvfrom’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
recvmmsg
(fd, vmessages, vlen, flags, tmo)[source]¶ Invokes the syscall recvmmsg. See ‘man 2 recvmmsg’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
recvmsg
(fd, message, flags)[source]¶ Invokes the syscall recvmsg. See ‘man 2 recvmsg’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
recvsize
(sock, reg='rcx')[source]¶ Recives 4 bytes size field Useful in conjuncion with findpeer and stager :param sock, the socket to read the payload from.: :param reg, the place to put the size: :type reg, the place to put the size: default ecx
Leaves socket in ebx
-
pwnlib.shellcraft.amd64.linux.
remap_file_pages
(start, size, prot, pgoff, flags)[source]¶ Invokes the syscall remap_file_pages. See ‘man 2 remap_file_pages’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
rename
(old, new)[source]¶ Invokes the syscall rename. See ‘man 2 rename’ for more information.
Parameters: - old (char) – old
- new (char) – new
-
pwnlib.shellcraft.amd64.linux.
renameat
(oldfd, old, newfd, new)[source]¶ Invokes the syscall renameat. See ‘man 2 renameat’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
rmdir
(path)[source]¶ Invokes the syscall rmdir. See ‘man 2 rmdir’ for more information.
Parameters: path (char) – path
-
pwnlib.shellcraft.amd64.linux.
sched_get_priority_max
(algorithm)[source]¶ Invokes the syscall sched_get_priority_max. See ‘man 2 sched_get_priority_max’ for more information.
Parameters: algorithm (int) – algorithm
-
pwnlib.shellcraft.amd64.linux.
sched_get_priority_min
(algorithm)[source]¶ Invokes the syscall sched_get_priority_min. See ‘man 2 sched_get_priority_min’ for more information.
Parameters: algorithm (int) – algorithm
-
pwnlib.shellcraft.amd64.linux.
sched_getaffinity
(pid, cpusetsize, cpuset)[source]¶ Invokes the syscall sched_getaffinity. See ‘man 2 sched_getaffinity’ for more information.
Parameters: - pid (pid_t) – pid
- cpusetsize (size_t) – cpusetsize
- cpuset (cpu_set_t) – cpuset
-
pwnlib.shellcraft.amd64.linux.
sched_getparam
(pid, param)[source]¶ Invokes the syscall sched_getparam. See ‘man 2 sched_getparam’ for more information.
Parameters: - pid (pid_t) – pid
- param (sched_param) – param
-
pwnlib.shellcraft.amd64.linux.
sched_getscheduler
(pid)[source]¶ Invokes the syscall sched_getscheduler. See ‘man 2 sched_getscheduler’ for more information.
Parameters: pid (pid_t) – pid
-
pwnlib.shellcraft.amd64.linux.
sched_rr_get_interval
(pid, t)[source]¶ Invokes the syscall sched_rr_get_interval. See ‘man 2 sched_rr_get_interval’ for more information.
Parameters: - pid (pid_t) – pid
- t (timespec) – t
-
pwnlib.shellcraft.amd64.linux.
sched_setaffinity
(pid, cpusetsize, cpuset)[source]¶ Invokes the syscall sched_setaffinity. See ‘man 2 sched_setaffinity’ for more information.
Parameters: - pid (pid_t) – pid
- cpusetsize (size_t) – cpusetsize
- cpuset (cpu_set_t) – cpuset
-
pwnlib.shellcraft.amd64.linux.
sched_setparam
(pid, param)[source]¶ Invokes the syscall sched_setparam. See ‘man 2 sched_setparam’ for more information.
Parameters: - pid (pid_t) – pid
- param (sched_param) – param
-
pwnlib.shellcraft.amd64.linux.
sched_setscheduler
(pid, policy, param)[source]¶ Invokes the syscall sched_setscheduler. See ‘man 2 sched_setscheduler’ for more information.
Parameters: - pid (pid_t) – pid
- policy (int) – policy
- param (sched_param) – param
-
pwnlib.shellcraft.amd64.linux.
sched_yield
()[source]¶ Invokes the syscall sched_yield. See ‘man 2 sched_yield’ for more information.
Arguments:
-
pwnlib.shellcraft.amd64.linux.
select
(nfds, readfds, writefds, exceptfds, timeout)[source]¶ Invokes the syscall select. See ‘man 2 select’ for more information.
Parameters: - nfds (int) – nfds
- readfds (fd_set) – readfds
- writefds (fd_set) – writefds
- exceptfds (fd_set) – exceptfds
- timeout (timeval) – timeout
-
pwnlib.shellcraft.amd64.linux.
sendfile
(out_fd, in_fd, offset, count)[source]¶ Invokes the syscall sendfile. See ‘man 2 sendfile’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
sendfile64
(out_fd, in_fd, offset, count)[source]¶ Invokes the syscall sendfile64. See ‘man 2 sendfile64’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
setdomainname
(name, length)[source]¶ Invokes the syscall setdomainname. See ‘man 2 setdomainname’ for more information.
Parameters: - name (char) – name
- len (size_t) – len
-
pwnlib.shellcraft.amd64.linux.
setgid
(gid)[source]¶ Invokes the syscall setgid. See ‘man 2 setgid’ for more information.
Parameters: gid (gid_t) – gid
-
pwnlib.shellcraft.amd64.linux.
setgroups
(n, groups)[source]¶ Invokes the syscall setgroups. See ‘man 2 setgroups’ for more information.
Parameters: - n (size_t) – n
- groups (gid_t) – groups
-
pwnlib.shellcraft.amd64.linux.
sethostname
(name, length)[source]¶ Invokes the syscall sethostname. See ‘man 2 sethostname’ for more information.
Parameters: - name (char) – name
- len (size_t) – len
-
pwnlib.shellcraft.amd64.linux.
setitimer
(which, new, old)[source]¶ Invokes the syscall setitimer. See ‘man 2 setitimer’ for more information.
Parameters: - which (itimer_which_t) – which
- new (itimerval) – new
- old (itimerval) – old
-
pwnlib.shellcraft.amd64.linux.
setpgid
(pid, pgid)[source]¶ Invokes the syscall setpgid. See ‘man 2 setpgid’ for more information.
Parameters: - pid (pid_t) – pid
- pgid (pid_t) – pgid
-
pwnlib.shellcraft.amd64.linux.
setpriority
(which, who, prio)[source]¶ Invokes the syscall setpriority. See ‘man 2 setpriority’ for more information.
Parameters: - which (priority_which_t) – which
- who (id_t) – who
- prio (int) – prio
-
pwnlib.shellcraft.amd64.linux.
setregid
(gid='egid')[source]¶ Args: [gid (imm/reg) = egid] Sets the real and effective group id.
-
pwnlib.shellcraft.amd64.linux.
setresgid
(rgid, egid, sgid)[source]¶ Invokes the syscall setresgid. See ‘man 2 setresgid’ for more information.
Parameters: - rgid (gid_t) – rgid
- egid (gid_t) – egid
- sgid (gid_t) – sgid
-
pwnlib.shellcraft.amd64.linux.
setresuid
(ruid, euid, suid)[source]¶ Invokes the syscall setresuid. See ‘man 2 setresuid’ for more information.
Parameters: - ruid (uid_t) – ruid
- euid (uid_t) – euid
- suid (uid_t) – suid
-
pwnlib.shellcraft.amd64.linux.
setreuid
(uid='euid')[source]¶ Args: [uid (imm/reg) = euid] Sets the real and effective user id.
-
pwnlib.shellcraft.amd64.linux.
setrlimit
(resource, rlimits)[source]¶ Invokes the syscall setrlimit. See ‘man 2 setrlimit’ for more information.
Parameters: - resource (rlimit_resource_t) – resource
- rlimits (rlimit) – rlimits
-
pwnlib.shellcraft.amd64.linux.
setsid
()[source]¶ Invokes the syscall setsid. See ‘man 2 setsid’ for more information.
Arguments:
-
pwnlib.shellcraft.amd64.linux.
setsockopt
(sockfd, level, optname, optval, optlen)[source]¶ Invokes the syscall setsockopt. See ‘man 2 setsockopt’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
setsockopt_timeout
(sock, secs)[source]¶ Invokes the syscall for setsockopt to set a timeout on a socket in seconds. See ‘man 2 setsockopt’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
settimeofday
(tv, tz)[source]¶ Invokes the syscall settimeofday. See ‘man 2 settimeofday’ for more information.
Parameters: - tv (timeval) – tv
- tz (timezone) – tz
-
pwnlib.shellcraft.amd64.linux.
setuid
(uid)[source]¶ Invokes the syscall setuid. See ‘man 2 setuid’ for more information.
Parameters: uid (uid_t) – uid
-
pwnlib.shellcraft.amd64.linux.
sh
()[source]¶ Execute a different process.
>>> p = run_assembly(shellcraft.amd64.linux.sh()) >>> p.sendline('echo Hello') >>> p.recv() b'Hello\n'
-
pwnlib.shellcraft.amd64.linux.
sigaction
(sig, act, oact)[source]¶ Invokes the syscall sigaction. See ‘man 2 sigaction’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
sigaltstack
(ss, oss)[source]¶ Invokes the syscall sigaltstack. See ‘man 2 sigaltstack’ for more information.
Parameters: - ss (sigaltstack) – ss
- oss (sigaltstack) – oss
-
pwnlib.shellcraft.amd64.linux.
signal
(sig, handler)[source]¶ Invokes the syscall signal. See ‘man 2 signal’ for more information.
Parameters: - sig (int) – sig
- handler (sighandler_t) – handler
-
pwnlib.shellcraft.amd64.linux.
sigpending
(set)[source]¶ Invokes the syscall sigpending. See ‘man 2 sigpending’ for more information.
Parameters: set (sigset_t) – set
-
pwnlib.shellcraft.amd64.linux.
sigprocmask
(how, set, oset, sigsetsize)[source]¶ Invokes the syscall sigprocmask. See ‘man 2 sigprocmask’ for more information.
Parameters: - how (int) – how
- set (sigset_t) – set
- oset (sigset_t) – oset
- sigsetsize (size_t) – sigsetsize
-
pwnlib.shellcraft.amd64.linux.
sigreturn
()[source]¶ Invokes the syscall sigreturn. See ‘man 2 sigreturn’ for more information.
-
pwnlib.shellcraft.amd64.linux.
sigsuspend
(set)[source]¶ Invokes the syscall sigsuspend. See ‘man 2 sigsuspend’ for more information.
Parameters: set (sigset_t) – set
-
pwnlib.shellcraft.amd64.linux.
splice
(fdin, offin, fdout, offout, length, flags)[source]¶ Invokes the syscall splice. See ‘man 2 splice’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
stage
(fd=0, length=None)[source]¶ Migrates shellcode to a new buffer.
Parameters: Example
>>> p = run_assembly(shellcraft.stage()) >>> sc = asm(shellcraft.echo("Hello\n", constants.STDOUT_FILENO)) >>> p.pack(len(sc)) >>> p.send(sc) >>> p.recvline() b'Hello\n'
-
pwnlib.shellcraft.amd64.linux.
stager
(sock, size, handle_error=False)[source]¶ Recives a fixed sized payload into a mmaped buffer Useful in conjuncion with findpeer. After running the socket will be left in RDI. :param sock, the socket to read the payload from.: :param size, the size of the payload:
-
pwnlib.shellcraft.amd64.linux.
stat
(file, buf)[source]¶ Invokes the syscall stat. See ‘man 2 stat’ for more information.
Parameters: - file (char) – file
- buf (stat) – buf
-
pwnlib.shellcraft.amd64.linux.
stat64
(file, buf)[source]¶ Invokes the syscall stat64. See ‘man 2 stat64’ for more information.
Parameters: - file (char) – file
- buf (stat64) – buf
-
pwnlib.shellcraft.amd64.linux.
stime
(when)[source]¶ Invokes the syscall stime. See ‘man 2 stime’ for more information.
Parameters: when (time_t) – when
-
pwnlib.shellcraft.amd64.linux.
stty
(fd, params)[source]¶ Invokes the syscall stty. See ‘man 2 stty’ for more information.
Parameters: - fd (int) – fd
- params (sgttyb) – params
-
pwnlib.shellcraft.amd64.linux.
symlink
(from_, to)[source]¶ Invokes the syscall symlink. See ‘man 2 symlink’ for more information.
Parameters: - from (char) – from
- to (char) – to
-
pwnlib.shellcraft.amd64.linux.
symlinkat
(from_, tofd, to)[source]¶ Invokes the syscall symlinkat. See ‘man 2 symlinkat’ for more information.
Parameters: - from (char) – from
- tofd (int) – tofd
- to (char) – to
-
pwnlib.shellcraft.amd64.linux.
sync
()[source]¶ Invokes the syscall sync. See ‘man 2 sync’ for more information.
Arguments:
-
pwnlib.shellcraft.amd64.linux.
sync_file_range
(fd, offset, count, flags)[source]¶ Invokes the syscall sync_file_range. See ‘man 2 sync_file_range’ for more information.
Parameters: - fd (int) – fd
- offset (off64_t) – offset
- count (off64_t) – count
- flags (unsigned) – flags
-
pwnlib.shellcraft.amd64.linux.
syscall
(syscall=None, arg0=None, arg1=None, arg2=None, arg3=None, arg4=None, arg5=None)[source]¶ - Args: [syscall_number, *args]
- Does a syscall
Any of the arguments can be expressions to be evaluated by
pwnlib.constants.eval()
.Example
>>> print(pwnlib.shellcraft.amd64.linux.syscall('SYS_execve', 1, 'rsp', 2, 0).rstrip()) /* call execve(1, 'rsp', 2, 0) */ xor r10d, r10d /* 0 */ push (SYS_execve) /* 0x3b */ pop rax push 1 pop rdi push 2 pop rdx mov rsi, rsp syscall >>> print(pwnlib.shellcraft.amd64.linux.syscall('SYS_execve', 2, 1, 0, -1).rstrip()) /* call execve(2, 1, 0, -1) */ push -1 pop r10 push (SYS_execve) /* 0x3b */ pop rax push 2 pop rdi push 1 pop rsi cdq /* rdx=0 */ syscall >>> print(pwnlib.shellcraft.amd64.linux.syscall().rstrip()) /* call syscall() */ syscall >>> print(pwnlib.shellcraft.amd64.linux.syscall('rax', 'rdi', 'rsi').rstrip()) /* call syscall('rax', 'rdi', 'rsi') */ /* setregs noop */ syscall >>> print(pwnlib.shellcraft.amd64.linux.syscall('rbp', None, None, 1).rstrip()) /* call syscall('rbp', ?, ?, 1) */ mov rax, rbp push 1 pop rdx syscall >>> print(pwnlib.shellcraft.amd64.linux.syscall( ... 'SYS_mmap', 0, 0x1000, ... 'PROT_READ | PROT_WRITE | PROT_EXEC', ... 'MAP_PRIVATE | MAP_ANONYMOUS', ... -1, 0).rstrip()) /* call mmap(0, 4096, 'PROT_READ | PROT_WRITE | PROT_EXEC', 'MAP_PRIVATE | MAP_ANONYMOUS', -1, 0) */ push (MAP_PRIVATE | MAP_ANONYMOUS) /* 0x22 */ pop r10 push -1 pop r8 xor r9d, r9d /* 0 */ push (SYS_mmap) /* 9 */ pop rax xor edi, edi /* 0 */ push (PROT_READ | PROT_WRITE | PROT_EXEC) /* 7 */ pop rdx mov esi, 0x1010101 /* 4096 == 0x1000 */ xor esi, 0x1011101 syscall
-
pwnlib.shellcraft.amd64.linux.
syslog
(pri, fmt, vararg)[source]¶ Invokes the syscall syslog. See ‘man 2 syslog’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
tee
(fdin, fdout, length, flags)[source]¶ Invokes the syscall tee. See ‘man 2 tee’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
time
(timer)[source]¶ Invokes the syscall time. See ‘man 2 time’ for more information.
Parameters: timer (time_t) – timer
-
pwnlib.shellcraft.amd64.linux.
timer_create
(clock_id, evp, timerid)[source]¶ Invokes the syscall timer_create. See ‘man 2 timer_create’ for more information.
Parameters: - clock_id (clockid_t) – clock_id
- evp (sigevent) – evp
- timerid (timer_t) – timerid
-
pwnlib.shellcraft.amd64.linux.
timer_delete
(timerid)[source]¶ Invokes the syscall timer_delete. See ‘man 2 timer_delete’ for more information.
Parameters: timerid (timer_t) – timerid
-
pwnlib.shellcraft.amd64.linux.
timer_getoverrun
(timerid)[source]¶ Invokes the syscall timer_getoverrun. See ‘man 2 timer_getoverrun’ for more information.
Parameters: timerid (timer_t) – timerid
-
pwnlib.shellcraft.amd64.linux.
timer_gettime
(timerid, value)[source]¶ Invokes the syscall timer_gettime. See ‘man 2 timer_gettime’ for more information.
Parameters: - timerid (timer_t) – timerid
- value (itimerspec) – value
-
pwnlib.shellcraft.amd64.linux.
timer_settime
(timerid, flags, value, ovalue)[source]¶ Invokes the syscall timer_settime. See ‘man 2 timer_settime’ for more information.
Parameters: - timerid (timer_t) – timerid
- flags (int) – flags
- value (itimerspec) – value
- ovalue (itimerspec) – ovalue
-
pwnlib.shellcraft.amd64.linux.
truncate
(file, length)[source]¶ Invokes the syscall truncate. See ‘man 2 truncate’ for more information.
Parameters: - file (char) – file
- length (off_t) – length
-
pwnlib.shellcraft.amd64.linux.
truncate64
(file, length)[source]¶ Invokes the syscall truncate64. See ‘man 2 truncate64’ for more information.
Parameters: - file (char) – file
- length (off64_t) – length
-
pwnlib.shellcraft.amd64.linux.
ulimit
(cmd, vararg)[source]¶ Invokes the syscall ulimit. See ‘man 2 ulimit’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
umask
(mask)[source]¶ Invokes the syscall umask. See ‘man 2 umask’ for more information.
Parameters: mask (mode_t) – mask
-
pwnlib.shellcraft.amd64.linux.
uname
(name)[source]¶ Invokes the syscall uname. See ‘man 2 uname’ for more information.
Parameters: name (utsname) – name
-
pwnlib.shellcraft.amd64.linux.
unlink
(name)[source]¶ Invokes the syscall unlink. See ‘man 2 unlink’ for more information.
Parameters: name (char) – name
-
pwnlib.shellcraft.amd64.linux.
unlinkat
(fd, name, flag)[source]¶ Invokes the syscall unlinkat. See ‘man 2 unlinkat’ for more information.
Parameters:
Invokes the syscall unshare. See ‘man 2 unshare’ for more information.
Parameters: flags (int) – flags
-
pwnlib.shellcraft.amd64.linux.
ustat
(dev, ubuf)[source]¶ Invokes the syscall ustat. See ‘man 2 ustat’ for more information.
Parameters: - dev (dev_t) – dev
- ubuf (ustat) – ubuf
-
pwnlib.shellcraft.amd64.linux.
utime
(file, file_times)[source]¶ Invokes the syscall utime. See ‘man 2 utime’ for more information.
Parameters: - file (char) – file
- file_times (utimbuf) – file_times
-
pwnlib.shellcraft.amd64.linux.
utimensat
(fd, path, times, flags)[source]¶ Invokes the syscall utimensat. See ‘man 2 utimensat’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
utimes
(file, tvp)[source]¶ Invokes the syscall utimes. See ‘man 2 utimes’ for more information.
Parameters: - file (char) – file
- tvp (timeval) – tvp
-
pwnlib.shellcraft.amd64.linux.
vfork
()[source]¶ Invokes the syscall vfork. See ‘man 2 vfork’ for more information.
Arguments:
-
pwnlib.shellcraft.amd64.linux.
vhangup
()[source]¶ Invokes the syscall vhangup. See ‘man 2 vhangup’ for more information.
Arguments:
-
pwnlib.shellcraft.amd64.linux.
vmsplice
(fdout, iov, count, flags)[source]¶ Invokes the syscall vmsplice. See ‘man 2 vmsplice’ for more information.
Parameters: - fdout (int) – fdout
- iov (iovec) – iov
- count (size_t) – count
- flags (unsigned) – flags
-
pwnlib.shellcraft.amd64.linux.
wait4
(pid, stat_loc, options, usage)[source]¶ Invokes the syscall wait4. See ‘man 2 wait4’ for more information.
Parameters: - pid (pid_t) – pid
- stat_loc (WAIT_STATUS) – stat_loc
- options (int) – options
- usage (rusage) – usage
-
pwnlib.shellcraft.amd64.linux.
waitid
(idtype, id, infop, options)[source]¶ Invokes the syscall waitid. See ‘man 2 waitid’ for more information.
Parameters: - idtype (idtype_t) – idtype
- id (id_t) – id
- infop (siginfo_t) – infop
- options (int) – options
-
pwnlib.shellcraft.amd64.linux.
waitpid
(pid, stat_loc, options)[source]¶ Invokes the syscall waitpid. See ‘man 2 waitpid’ for more information.
Parameters:
-
pwnlib.shellcraft.amd64.linux.
write
(fd, buf, n)[source]¶ Invokes the syscall write. See ‘man 2 write’ for more information.
Parameters: - fd (int) – fd
- buf (void) – buf
- n (size_t) – n