-
Notifications
You must be signed in to change notification settings - Fork 4
/
Copy pathbreakpoints
80 lines (72 loc) · 1.51 KB
/
breakpoints
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
echo \n\n\n
echo ###################################\n
echo # Starting instrumented binary\n
echo ###################################\n\n
echo \ Nothing ventured, nothing gained.\n
echo \ You can't do anything without risking something.\n
echo \n\n\n
#Skip all forks at the beginning of main()
b * 0x4067d0
commands
echo Skipping all the forks\n
echo and the setsid\n
set $rip=0x406842
c
end
#Connection start: let's grab IP of C&C
#tip: readelf -x .rodata Rx64 | head -1
#We're inside initConnection()
b * 0x406466
commands
echo We got currentServer!\n
x/s commServer
echo Continuing...\n
c
end
#After connection win
#back to main
b * 0x40689b
commands
echo Back to main\n
echo Jumping all code related to forks\n
set $rip=0x4069da
c
end
#This is the interesting part, C&C sending commands
#TODO: save those somewhere? in a file?
b * 0x4069df
commands
echo *******************************\n
echo * C&C is talking to us:\n
echo *
x/s $rbp-0x14c0
echo *******************************\n
c
end
#C&C sends us "DUP" which means EXIT
b * 0x406a4d
commands
echo ########################\n
echo C&C asks us to leave with "DUP" commands\n
echo Bye.\n
echo ########################\n
c
end
#C&C sends a SH command
b * 0x406c4d
commands
echo /!\\ DANGER: SHELL /!\\\n
echo C&C sends a shell command\n
echo Will safely ignore it\n
set $rip=0x406d02
c
end
#C&C sends a command
b * 0x406e0b
commands
echo /!\\ DANGER: COMMAND /!\\\n
echo C&C sends a command\n
echo Will safely ignore it\n
set $rip=0x406e10
c
end