Sgoettschkes
I recently came across the explanation for remote code execution in Elixir, using a base64 encoded payload, which is encoded and passed to binary_to_term/2.
I understand the steps taken and the problem with binary_to_term. What I do not understand and what interests me is how anonymous functions are represented internally for this to work. For example, this code snipped somehow works, but I have no clear understanding of why and how:
Enum.zip(fn _x, _y -> {:cont, []} end)
It would be highly appreciated if anybody has any good resources or an explanation. Thanks!
Where Next?
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Producing high quality Elixir screencasts since 2017.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #blog-post
- #phoenix_html
- #iex
- #graphql
- #ai
- #genstage
- #elixirconf-us
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #security
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Bringing learning, work and compliance together since 1987.
Producing high quality Elixir screencasts since 2017.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
First 3 of 3 Posts
benhaney
I’m not exactly sure what you’re looking for with your question about how anonymous functions are represented internally, but the reason your snippet works is simply because the
Enumerableprotocol is implemented forFunction. See elixir/lib/elixir/lib/enum.ex at v1.14 · elixir-lang/elixir · GitHubSgoettschkes
Thank you for that link! I guess that is one part of what I’m looking for.
Now I must understand how
Enum.zip/1works under the hood. I’ll dive into elixir/lib/elixir/lib/enum.ex at a64d42f5d3cb6c32752af9d3312897e8cd5bb7ec · elixir-lang/elixir · GitHub to see if I can understand what’s happening.D4no0
Nothing is happening internally, the actual exploit relies on the fact that you can use Enum on a function(for some reason, I never knew that) and that will force the function to be evaluated, there you can inject a random amount of code that will be executed by the server.