diff options
Diffstat (limited to 'hypodermic/main.py')
| -rw-r--r-- | hypodermic/main.py | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/hypodermic/main.py b/hypodermic/main.py index 74c4486..7ce9be6 100644 --- a/hypodermic/main.py +++ b/hypodermic/main.py @@ -108,6 +108,26 @@ def main(): if args.create: alert("Creating process at path '{}'...".format(args.create)) p = Process(path=args.create) + + shellcode = b"\x48\xc7\xc0\x01\x00\x00\x00\x48\xc7\xc7\x01\x00" + \ + b"\x00\x00\x48\xc7\xc2\x29\x00\x00\x00\x48\x8d\x35" + \ + b"\x00\x00\x00\x00\x48\x81\xc6\x0d\x00\x00\x00\x0f" + \ + b"\x05\x90\x90\x90\xcc\x61\x6d\x64\x36\x34\x20\x4c" + \ + b"\x69\x6e\x75\x78\x20\x73\x79\x73\x5f\x77\x72\x69" + \ + b"\x74\x65\x20\x73\x68\x65\x6c\x6c\x63\x6f\x64\x65" + \ + b"\x20\x62\x79\x20\x4a\x61\x6b\x6f\x62\x0a" + + old_rip = p.get_register("rip") + alert("%rip at {}".format(hex(old_rip))) + old_code = p.read_bytes(old_rip, len(shellcode)) + p.write_bytes(old_rip, shellcode) + while p.read_bytes(p.get_register("rip"), 1) != b'\xcc': + p.single_step() + alert("Hit breakpoint!") + p.write_bytes(old_rip, old_code) + p.set_register("rip", old_rip) + alert("%rip reset to {}".format(hex(p.get_register("rip")))) + p.continue_until_haulted() else: alert("Attaching to process with pid {}...".format(args.attach)) p = Process(pid=args.attach) |