3 ms·

I think what the author hasn't realized yet is that for the most part - exploit development, fuzzing a binary, finding a logical problem and building a feasible

I think what the author hasn't realized yet is that for the most part - exploit development, fuzzing a binary, finding a logical problem and building a feasible exploit for it - you are fighting against the language that you chose. The reason Go got so popular is not because of its type system, but because it also has a mode of programming "good enough" prototypes. Python for exploit development is also great due to the gdb fork that can generate python payloads, offsets etc, but it sucks for deployment on targets. If I would compare the three language choices I don't see why anyone would choose Rust over the other two in terms of efficiency and not having to fight the language. I don't even know whether it would be possible to write an exploit that overflows something in an external ABI binary in Rust without sacrificing everything that Rust stands for. After all, the binary would have to be statically linked for deployment, have to support invalid types, have to support invalid control flows etc. On the other hand, in Go that's what CGo is made for. The VM and GC in Go doesn't care about what CGo does. Edit: nevermind, the only example that is using Rust for this type of exploits is a sudo cli argument exploit, lol. I would have expected a little more than a char array generator that's using the FFI package. [1] [1] https://github.com/skerkour/black-hat-rust/blob/main/ch_07/exploits/cve_2021_3156/exploit/src/main.rs https://github.com/skerkour/black-hat-rust/blob/main/ch_07/e...

rollulus 2y ago
Exactly my thoughts reading the ToC. One exception would come to my mind though: Rust would seem a very reasonable language choice to me to write malware. E.g., the next Stuxnet. Low level enough, plus the language safety to help staying under the radar.
- Fnoord 2y ago
  There are already terrible Rust projects out there where the mention of Rust is entirely marketing fluff, such as Rustdesk.
Ygg2 2y ago
> The reason Go got so popular is not because of its type system, but because it also has a mode of programming "good enough" prototypes. You can Grug program in any language. Including Rust. Just clone, Arc, and unwrap everything. The reason why Go got popular is: A) It's backed by Google (this is essential, there are many languages simpler/easier than it) B) It's easy to pickup
- tucnak 2y ago
  How is (A) relevant? It's not like Google is pouring lots of money into Go! The use of Go _inside_ Google is limited at best. I would say, the success of Go is exactly aligned with the success of cloud plumbing as a whole: Docker, Hashistack, Kubernetes (which is not successful "because Google", but rather because it's virtually unmatched in capability and just happens to be written in Go.) People like to say Google has helped Go succeed, however in reality Google's influence is vastly overstated. This is nothing else but expendable excuse, see "big company = big money = bad." Apple spent order of magnitude more on Swift, and yet it's not as successful outside of a handful applications. Google itself had _actually_ spent orders of magnitude more on Dart, enabling its adoption, holding conferences, investing deeply into Flutter, and it's nowhere near as successful as Go. The real reason Go is a success is the Go team, and engineering prowess they brought to the table. Go is the language where people get shit done; now, Rust may be "the most loved language" or whatever, but the overwhelming success of Go as a programming platform (which is Rust community is supposedly obsessed with) cannot be attributed to anything else but engineering reasons. People like it. Why do they like it? Because it's easy to use, gets out the way, and it gets the job done. You find a library on Github, read the godoc, and you're literally seconds away from incorporating it in your program. This is not something you can get by accident, by means of investment, or otherwise by making bad design decisions.
  - cookiengineer 2y ago
    I'd also like to add that Go has the advantage that its ideology of using a "pure go until the syscall level" approach is what makes it an optimal malware development language. It's so much easier to develop and deploy malware because most of the EDR world focus heavily on the "C-like world" and its limitations. The only other project that comes close to what you can do with Go when it comes to mutating binaries is in my opinion the APE/cosmopolitan ecosystem. But those binaries tend to get flagged immediately because there's no major software that's being used that requires APE binaries to run. On the other hand, the static parts of any Go binary (the head/runtime part) can't be flagged because of so many devops tools rely on Go binaries to work. There was the Ebowla incident in 2016, where all go binaries (including docker) were flagged as malware because the static parts were added as yara rules in Kaspersky and other Antivirus tools. They had to revert those changes after a week.
timeon 2y ago
> not having to fight the language Why would you fight Rust? It is decent for prototyping.
- leosanchez 2y ago
  Type system, borrow checker come to mind.
  - mountainriver 2y ago
    Honestly those aren’t a big deal if you are using LLM assisted development. I used to steer clear of Rust for a lot of problems because of its complexity, now I use it for almost everything and it’s great
deleted 2y ago
[deleted]

rollulus 2y ago

Exactly my thoughts reading the ToC. One exception would come to my mind though: Rust would seem a very reasonable language choice to me to write malware. E.g., the next Stuxnet. Low level enough, plus the language safety to help staying under the radar.

Fnoord 2y ago
There are already terrible Rust projects out there where the mention of Rust is entirely marketing fluff, such as Rustdesk.

Ygg2 2y ago

> The reason Go got so popular is not because of its type system, but because it also has a mode of programming "good enough" prototypes. You can Grug program in any language. Including Rust. Just clone, Arc, and unwrap everything. The reason why Go got popular is: A) It's backed by Google (this is essential, there are many languages simpler/easier than it) B) It's easy to pickup

tucnak 2y ago
How is (A) relevant? It's not like Google is pouring lots of money into Go! The use of Go _inside_ Google is limited at best. I would say, the success of Go is exactly aligned with the success of cloud plumbing as a whole: Docker, Hashistack, Kubernetes (which is not successful "because Google", but rather because it's virtually unmatched in capability and just happens to be written in Go.) People like to say Google has helped Go succeed, however in reality Google's influence is vastly overstated. This is nothing else but expendable excuse, see "big company = big money = bad." Apple spent order of magnitude more on Swift, and yet it's not as successful outside of a handful applications. Google itself had _actually_ spent orders of magnitude more on Dart, enabling its adoption, holding conferences, investing deeply into Flutter, and it's nowhere near as successful as Go. The real reason Go is a success is the Go team, and engineering prowess they brought to the table. Go is the language where people get shit done; now, Rust may be "the most loved language" or whatever, but the overwhelming success of Go as a programming platform (which is Rust community is supposedly obsessed with) cannot be attributed to anything else but engineering reasons. People like it. Why do they like it? Because it's easy to use, gets out the way, and it gets the job done. You find a library on Github, read the godoc, and you're literally seconds away from incorporating it in your program. This is not something you can get by accident, by means of investment, or otherwise by making bad design decisions.
- cookiengineer 2y ago
  I'd also like to add that Go has the advantage that its ideology of using a "pure go until the syscall level" approach is what makes it an optimal malware development language. It's so much easier to develop and deploy malware because most of the EDR world focus heavily on the "C-like world" and its limitations. The only other project that comes close to what you can do with Go when it comes to mutating binaries is in my opinion the APE/cosmopolitan ecosystem. But those binaries tend to get flagged immediately because there's no major software that's being used that requires APE binaries to run. On the other hand, the static parts of any Go binary (the head/runtime part) can't be flagged because of so many devops tools rely on Go binaries to work. There was the Ebowla incident in 2016, where all go binaries (including docker) were flagged as malware because the static parts were added as yara rules in Kaspersky and other Antivirus tools. They had to revert those changes after a week.

timeon 2y ago

> not having to fight the language Why would you fight Rust? It is decent for prototyping.

leosanchez 2y ago
Type system, borrow checker come to mind.
- mountainriver 2y ago
  Honestly those aren’t a big deal if you are using LLM assisted development. I used to steer clear of Rust for a lot of problems because of its complexity, now I use it for almost everything and it’s great

deleted 2y ago

[deleted]