16 lines
1.4 KiB
Markdown
16 lines
1.4 KiB
Markdown
Tiny stripped rust binary (8.6 KiB, x86_64, dynamic libc) that loads and executes a shellcode payload built into it.
|
|
|
|
## Building
|
|
|
|
Just `just build`. Mostly uses CLI flags, but most could be moved into the `Cargo.toml`, needs a nightly compiler as of rust 1.96.0, the `rust-toolchain.toml` should take care of that though.
|
|
|
|
It assumes building for `x86_64-unknown-linux-gnu` as I cannot manage to get a musl build and I don't know other architectures which need manual shellcode addition. But this can be extended to other architectures.
|
|
|
|
## Properties
|
|
|
|
The code is completely correct, checks `mmap` and `mprotect` succeeded, the code could theoretically be smaller but less correct by:
|
|
|
|
- Memory mapping a RWX page directly, some protected kernel builds require `RW` -> `RX` transition though.
|
|
- Assuming mmap and mprotect succeeded, no modern kernel should fail on `mmap` even if out of memory, the mapping is done regardless and memory actually reserved once used. `mprotect` shouldn't fail either if done correctly (man page mentions failures because no memory, which I said shouldn't happen, invalid permission combinations and invalid, which don't happen if you do correct permissions and valid pointers, or rare permission cases).
|
|
- `no_std`, this barely needs std, could just hardcode the 3-4 syscalls present and don't use `std` at all. This code also hardcoded `libc` values before so that's not needed either, but I think `libc` has `no_std` support either way.
|