OneGadget
When solving CTF pwn challenges we usually want a one-gadget RCE: a single address in
libc that, jumped to, calls execve("/bin/sh", NULL, NULL).
This gem finds them for you, so you don't have to dig through objdump or IDA Pro every
time :wink:
Point it at a libc -- one_gadget /path/to/libc -- and enjoy the magic :laughing:
Installation
Available on RubyGems.org!
$ gem install one_gadget
Supported Architectures
Implementation
OneGadget symbolically executes the code around each candidate address to work out what
has to hold for the gadget to work.
Gadgets are found by walking the control-flow graph backward from each exec/posix_spawn
call, following conditional branches both ways. When a gadget is only reachable if a branch is
(not) taken, that decision shows up as an extra constraint, e.g. x2 == 0x1.
The article introducing how I develop this tool can be found on my blog.
Checked by running them
Constraints are only worth as much as they are complete, so the gadgets this repository
ships are verified by being run. Aletheia loads the libc in a live
process, arranges exactly what a gadget's constraints ask for, poisons every register and
page they don't mention, jumps to the offset, and requires a real /bin/sh to come back
and list the root directory. A gadget whose constraint list is missing something fails
there instead of passing by luck -- which is how several missing constraints were found.
bundle exec rake aletheia:verify # every libc under spec/data, level 0
bundle exec rake "aletheia:verify[1, aarch64]" # one output level, one architecture
Aletheia is development tooling: it lives outside lib/ and bin/, so it is not part of
the published gem.
Usage
Command Line Interface
$ one_gadget
# Usage: one_gadget <FILE|-b BuildID> [options]
# -b, --build-id BuildID BuildID[sha1] of libc.
# -f, --[no-]force-file Force search gadgets in file instead of build id first.
# -l, --level OUTPUT_LEVEL The output level.
# OneGadget automatically selects gadgets with higher successful probability.
# Increase this level to ask OneGadget show more gadgets it found.
# Default: 0
# -n, --near FUNCTIONS/FILE Order gadgets by their distance to the given functions or to the GOT functions of the given file.
# -o, --output-format FORMAT Output format. FORMAT should be one of <pretty|raw|json>.
# Default: pretty
# -r, --raw Alias of -o raw. Output gadgets offset only, split with one space.
# -s, --script exploit-script Run exploit script with all possible gadgets.
# The script will be run as 'exploit-script $offset'.
# --info BuildID Show version information given BuildID.
# --base BASE_ADDRESS The base address of libc.
# Default: 0
# --version Current gem version.
$ one_gadget spec/data/libc-2.31-9fdb74e7b217d06c93172a8243f8547f947ee6d1.so
# 0xe3b31 execve("/bin/sh", r15, rdx)
# constraints:
# [r15] == NULL || r15 == NULL || r15 is a valid argv
# [rdx] == NULL || rdx == NULL || rdx is a valid envp
#
# 0xe3b34 execve("/bin/sh", rsi, rdx)
# constraints:
# [rsi] == NULL || rsi == NULL || rsi is a valid argv
# [rdx] == NULL || rdx == NULL || rdx is a valid envp
#
# 0xe3c20 execve("/bin/sh", r15, r12)
# constraints:
# [r15] == NULL || r15 == NULL || r15 is a valid argv
# [r12] == NULL || r12 == NULL || r12 is a valid envp
#
# 0x107cea posix_spawn(rsp+0x64, "/bin/sh", [rsp+0x38], 0, rsp+0x70, environ)
# constraints:
# [rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv
# [rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] <= 0x0
Given BuildID
$ one_gadget -b b417c0ba7cc5cf06d1d1bed6652cedb9253c60d0
# 0x4f322 execve("/bin/sh", rsp+0x40, environ)
# constraints:
# [rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv
#
# 0xe56d8 execve("/bin/sh", r14, r12)
# constraints:
# [r14] == NULL || r14 == NULL || r14 is a valid argv
# [r12] == NULL || r12 == NULL || r12 is a valid envp
#
# 0xe5863 execve("/bin/sh", r10, rdx)
# constraints:
# [r10] == NULL || r10 == NULL || r10 is a valid argv
# [rdx] == NULL || rdx == NULL || rdx is a valid envp
#
# 0x10a38c execve("/bin/sh", rsp+0x70, environ)
# constraints:
# [rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv
This is the beginning of the README. Read the rest at the original. Read the full README ↗
