sh4d0wup 0.11.0

Signing-key abuse and update exploitation framework
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

use crate::errors::*;
use crate::plot::{Artifacts, PkgFilter, PkgRef};
use crate::tamper;
use crate::templates;
use crate::utils;
use serde::{Deserialize, Serialize};
use std::io::BufReader;
use std::io::Read;
use tar::Archive;
use url::Url;

#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
pub struct ApkPkg {
    pub artifact: String,
    pub url: Url,
    pub pkg: PkgFilter,
}

impl ApkPkg {
    pub fn resolve(&self, artifacts: &mut Artifacts) -> Result<Vec<u8>> {
        let artifact = artifacts.get(&self.artifact).with_context(|| {
            anyhow!(
                "Referencing artifact that doesn't exist: {:?}",
                self.artifact
            )
        })?;

        let mut reader = BufReader::new(artifact.as_bytes());
        let _signature_buf = utils::apk::read_gzip_to_end(&mut reader)?;
        let index_buf = utils::apk::read_gzip_to_end(&mut reader)?;
        let mut archive = Archive::new(&index_buf[..]);

        for entry in archive.entries()?.raw(true) {
            let mut entry = entry?;
            let header = entry.header().clone();
            trace!("Found entry in tar: {:?}", header.path());
            let filename = header.path()?;

            if filename.to_str() == Some("APKINDEX") {
                let mut bytes = Vec::new();
                entry.read_to_end(&mut bytes)?;
                let mut bytes = &bytes[..];

                while !bytes.is_empty() {
                    let (pkg, remaining) =
                        tamper::apk::Pkg::parse(bytes).context("Failed to parse package index")?;
                    bytes = remaining;

                    trace!("Found package in archive: {pkg:?}");

                    if self.pkg.matches_pkg(&pkg) {
                        debug!("Found matching package in archive: {pkg:?}");

                        let name = pkg.name();
                        let version = pkg.version().to_string();
                        let filename = format!("{}-{}.apk", name, version);
                        let url = self.url.join(&filename)?;

                        // TODO: extract sha1 hash from index: https://wiki.alpinelinux.org/wiki/Apk_spec#Package_Checksum_Field

                        let artifact = templates::ArtifactMetadata {
                            url,
                            filename: Some(filename),
                            version: Some(version),
                            sha256: None,
                        };
                        let json = artifact.to_json()?;
                        return Ok(json);
                    }
                }
            }
        }

        bail!("Did not find any matching package in apk pkg index")
    }
}