one_gadget

Go to file

david942j e28085f083 speed up testing and remove test_files in gemspec		2017-02-14 17:26:47 +08:00
bin	add --force-file option	2017-02-13 18:24:33 +08:00
examples	feature suggested by lyc12345	2017-02-09 15:33:05 +08:00
lib	speed up testing and remove test_files in gemspec	2017-02-14 17:26:47 +08:00
spec	speed up testing and remove test_files in gemspec	2017-02-14 17:26:47 +08:00
tasks	tasklize generate builds list	2017-02-11 21:35:56 +08:00
.gitignore	empty gem	2017-02-07 16:30:06 +08:00
.rubocop.yml	refactor builds' format	2017-02-09 12:51:18 +08:00
.travis.yml	fix	2017-02-09 14:41:17 +08:00
Gemfile	add executable and fix codeclimate	2017-02-07 17:54:25 +08:00
Gemfile.lock	add executable and fix codeclimate	2017-02-07 17:54:25 +08:00
LICENSE	Initial commit	2017-02-07 16:03:34 +08:00
README.md	update readme	2017-02-13 23:23:47 +08:00
Rakefile	tasklize generate builds list	2017-02-11 21:35:56 +08:00
builds_list	support of i386, tested on 16.04 and 14.04 lib32	2017-02-13 23:06:20 +08:00
one_gadget.gemspec	speed up testing and remove test_files in gemspec	2017-02-14 17:26:47 +08:00

README.md

One Gadget

When playing ctf pwn challenges we usually needs the one-gadget of execve('/bin/sh', NULL, NULL).

This gem provides such gadget finder, no need to use IDA-pro every time like a fool.

Also provides the command-line tool one_gadget for easy usage.

Note: Supports amd64 and i386!

Note2: still work in progress, the gem version might update frequently :p.

Install

Available on RubyGems.org!

gem install one_gadget

Usage

Command Line Tool

one_gadget
# Usage: one_gadget [file] [options]
#     -b, --build-id BuildID           BuildID[sha1] of libc.
#     -f, --[no-]force-file            Force search gadgets in file instead of build id first.
#     -r, --[no-]raw                   Output gadgets offset only, split with one space.
#     -s, --script exploit-script      Run exploit script with all possible gadgets.
#                                      The script will be run as 'exploit-script $offset'.

one_gadget -b 60131540dadc6796cab33388349e6e4e68692053
# offset: 0x4526a
# constraints:
#   [rsp+0x30] == NULL
#
# offset: 0xef6c4
# constraints:
#   [rsp+0x50] == NULL
#
# offset: 0xf0567
# constraints:
#   [rsp+0x70] == NULL
#
# offset: 0xf5b10
# constraints:
#   [rbp-0xf8] == NULL
#   rcx == NULL

one_gadget /lib/i386-linux-gnu/libc.so.6
# offset: 0x3ac69
# constraints:
#   esi is the address of `rw-p` area of libc
#   [esp+0x34] == NULL
#
# offset: 0x5fbbe
# constraints:
#   esi is the address of `rw-p` area of libc
#   eax == NULL
#
# offset: 0x12036c
# constraints:
#   esi is the address of `rw-p` area of libc
#   eax == NULL

Combine with exploit script

Pass your exploit script as one_gadget's arguments, it can try all gadgets one by one, so you don't need to try every possible gadgets manually.

one_gadget ./spec/data/libc-2.19.so -s 'echo "offset ->"'

Directly use in script

require 'one_gadget'
OneGadget.gadgets(file: '/lib/x86_64-linux-gnu/libc.so.6')
# => [283242, 980676, 984423, 1006352]