This commit is contained in:
2026-08-23 21:17:51 +02:00
parent 7807cf430c
commit 1a422196eb
8 changed files with 104 additions and 94 deletions

View File

@@ -1,10 +1,10 @@
if params.len < 1 or params[0] == "-h" or params[0] == "--help" then
current_program = get_shell.host_computer.File(program_path)
print("Usage: " + current_program.name + " [-h|<library path> [extra]]")
print(" -h show this help message")
print(" <library path> only exploit the specified library (e.g. /lib/init.so)")
print(" extra optional overflow value to attempt")
print(" (no args) try all libraries in /lib and current_path")
print "Usage: " + current_program.name + " [-h|<library path> [extra]]"
print " -h show this help message"
print " <library path> only exploit the specified library (e.g. /lib/init.so)"
print " extra optional overflow value to attempt"
print " (no args) try all libraries in /lib and current_path"
exit
end if
@@ -16,7 +16,7 @@ computer = get_shell.host_computer
ends_with = function(s, suffix)
if s.len < suffix.len then return 0
return s[s.len - suffix.len:] == suffix
return s[s.len - suffix.len : ] == suffix
end function
extra = ""
@@ -36,7 +36,7 @@ extract_value = function(line)
if start == null or finish == null then return ""
if start == -1 or finish == -1 then return ""
if finish > start then
return line[start + 3:finish]
return line[start + 3 : finish]
end if
before_dot = line.split("\.")[0]
@@ -74,11 +74,11 @@ libs = []
add_lib_dir = function(dirpath)
folder = computer.File(dirpath)
if not folder then return
if not folder.is_folder then return
if not folder.has_permission("r") then return
if not folder then return
if not folder.is_folder then return
if not folder.has_permission("r") then return
files = folder.get_files
if not files then return
if not files then return
for f in files
if not f.has_permission("r") then continue
if not ends_with(f.name, ".so") then continue
@@ -92,8 +92,13 @@ add_lib_dir = function(dirpath)
if already then continue
lib = mx.load(f.path)
if not lib then continue
known_paths.push(f.path)
libs.push({"path": f.path, "name": lib.lib_name, "version": lib.version, "lib": lib})
known_paths.push f.path
libs.push {
"path": f.path,
"name": lib.lib_name,
"version": lib.version,
"lib": lib,
}
end for
end function
@@ -102,23 +107,33 @@ if target_lib then
if not lf then exit("Unable to locate library: " + target_lib)
lib = mx.load(target_lib)
if not lib then exit("Unable to load library: " + target_lib)
libs.push({"path": target_lib, "name": lib.lib_name, "version": lib.version, "lib": lib})
libs.push {
"path": target_lib,
"name": lib.lib_name,
"version": lib.version,
"lib": lib,
}
else
add_lib_dir("/lib")
add_lib_dir "/lib"
if current_path != "/lib" then add_lib_dir(current_path)
end if
if libs.len == 0 then
print("Nothing found")
print "Nothing found"
exit
end if
preferred = ["kernel_module.so", "init.so", "net.so", "kernel_router.so"]
preferred = [
"kernel_module.so",
"init.so",
"net.so",
"kernel_router.so",
]
ordered = []
for name in preferred
for item in libs
if ends_with(item.path, "/" + name) or item.name == name then
ordered.push(item)
ordered.push item
end if
end for
end for
@@ -131,7 +146,7 @@ for item in libs
end if
end for
if already then continue
ordered.push(item)
ordered.push item
end for
libs = ordered
@@ -139,7 +154,7 @@ lines = "PATH LIBRARY VERSION"
for item in libs
lines = lines + "\n" + item.path + " " + item.name + " " + item.version
end for
print(format_columns(lines))
print format_columns(lines)
try_overflow = function(lib, add, value)
of = lib.overflow(add, value)
@@ -186,4 +201,4 @@ if active_user == "guest" and user_shell then
exit
end if
print("Nothing found")
print "Nothing found"