pwntools icon indicating copy to clipboard operation
pwntools copied to clipboard

Add the ability to specify custom shellcraft templates

Open Ninja3047 opened this issue 1 year ago • 2 comments

Shellcraft templates are a really nice feature when needing to write custom shellcode but there is currently no easy way to do this. The best way I can come up with is something like the following:

from pwn import shellcraft
from pwnlib.shellcraft.internal import make_function
import shutil

shellcraft_templates = Path(shellcraft.__file__).resolve().parent / "templates"
shutil.copy("custom_shellcode.asm", shellcraft_templates / "x86" / "linux")
custom_shellcode = make_function("custom_shellcode", "custom_shellcode.asm", "x86/linux")
...

But copying files to shellcraft's template folder and relying on internal interfaces to do this does not seem ideal

Ninja3047 avatar Apr 18 '24 16:04 Ninja3047

How could this look like? I'd imagine the custom templates tend to be architecture specific. So maybe a folder like ~/.config/pwntools/shellcraft which gets checked? Then you'd have to create the directory structure like amd64/linux/thething.asm which would be available through the ordinary API.

That wouldn't be very portable though when passing the exploit script around. Maybe something like the internal API but well defined to add arbitrary files to the shellcraft module is the way to go? Maybe even support to add them inline without requiring a file.

Feel free to contribute any shellcode templates you deem useful and missing:) What is the use case that made you want this feature?

peace-maker avatar Apr 18 '24 21:04 peace-maker

yeah in my head something like the internal API but allowing arbitrary files

the main use case is if i want to use a template but slightly modify it for particular one-off situations/challenges but it wouldn't make sense to upstream

Ninja3047 avatar Apr 19 '24 15:04 Ninja3047