one_gadget 1.6.2 → 1.7.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (66) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +141 -94
  3. data/bin/one_gadget +4 -3
  4. data/lib/one_gadget/abi.rb +42 -22
  5. data/lib/one_gadget/builds/libc-2.19-397c84e78c14cbffba39a48184db482211df9fb3.rb +38 -0
  6. data/lib/one_gadget/builds/libc-2.19-4eda8ff01be3fba1c7bdd442a8690c3dc7397b6a.rb +44 -0
  7. data/lib/one_gadget/builds/libc-2.19-509ee0c9616c4c3ed81951501a8950e1f529bbff.rb +38 -0
  8. data/lib/one_gadget/builds/libc-2.19-6aff6d091954955fe931bb720a17708513aabda7.rb +41 -0
  9. data/lib/one_gadget/builds/libc-2.19-8d935a42f2f2a1149aa52d3098b32b1d5012cb67.rb +38 -0
  10. data/lib/one_gadget/builds/libc-2.19-a820f849dda0b99ed06dd59bb88404969b3a5f88.rb +41 -0
  11. data/lib/one_gadget/builds/libc-2.19-d9a10b8ef90300628dd0a3a535106967714d7328.rb +47 -0
  12. data/lib/one_gadget/builds/libc-2.21-169a143e9c40cfd9d09695333e45fd67743cd2d6.rb +37 -0
  13. data/lib/one_gadget/builds/libc-2.21-2e9718e58257bda1dc0d751665a3ee233bf606f2.rb +37 -0
  14. data/lib/one_gadget/builds/libc-2.23-29e38445a740bba5a77b86691e3c51a7e48dc79b.rb +46 -0
  15. data/lib/one_gadget/builds/libc-2.23-679ad41a6bc9e718a11a36cf9879cac97197e565.rb +37 -0
  16. data/lib/one_gadget/builds/libc-2.23-b5381a457906d279073822a5ceb24c4bfef94ddb.rb +37 -0
  17. data/lib/one_gadget/builds/libc-2.23-d10fbfd9328f5ffaca50aa93562cb3bfb618fbcc.rb +43 -0
  18. data/lib/one_gadget/builds/libc-2.23-dd5192a769e33ed6ca68a6ab5740ff9e8ec678a7.rb +46 -0
  19. data/lib/one_gadget/builds/libc-2.24-1f7bdfb9a24714835cee6e6597ea7aa782821371.rb +46 -0
  20. data/lib/one_gadget/builds/libc-2.24-206b2bb216b6cdb6b1be565a6fcd29f3862db060.rb +49 -0
  21. data/lib/one_gadget/builds/libc-2.24-26e84118fee5788eb5d8dda66b7e7f029d2c7800.rb +43 -0
  22. data/lib/one_gadget/builds/libc-2.24-43adbb1e7368c94fba1ba9020d8ef0808bff5bc4.rb +37 -0
  23. data/lib/one_gadget/builds/libc-2.24-497931f8d2346a6d0e300a65d8fc6106c6c88c15.rb +37 -0
  24. data/lib/one_gadget/builds/libc-2.24-4fa7401566d6b3e2c7ee5df3b4d85a01f85b595c.rb +37 -0
  25. data/lib/one_gadget/builds/libc-2.24-568d20b7e0d08bc282fb42ae405c7054e4209ede.rb +37 -0
  26. data/lib/one_gadget/builds/libc-2.24-5b72576ff331e93852355123afecdec70fd247b5.rb +49 -0
  27. data/lib/one_gadget/builds/libc-2.24-a4c01d397b6584f7040ef266b16a5d4da0b7a087.rb +43 -0
  28. data/lib/one_gadget/builds/libc-2.24-b81a06f0ac241c4aa8860602d9abcc903adbb675.rb +46 -0
  29. data/lib/one_gadget/builds/libc-2.24-be6d412ecc4816c46eb49e750b02f714a9131c4e.rb +46 -0
  30. data/lib/one_gadget/builds/libc-2.24-d2a8a8ac188a6c3bafa4813a3d2789240ee49489.rb +46 -0
  31. data/lib/one_gadget/builds/libc-2.24-dff06414a29b97b865ef938e06a7751fe8b1b2d0.rb +46 -0
  32. data/lib/one_gadget/builds/libc-2.24-e5dc6c0caa39828fa10ed37e642723a581acdb6d.rb +37 -0
  33. data/lib/one_gadget/builds/libc-2.24-fd0655c4d2073eda4235084e1d0e558f0251be8a.rb +37 -0
  34. data/lib/one_gadget/builds/libc-2.25-e5eb6347f0629b37bf698200022a683b7efb10ed.rb +37 -0
  35. data/lib/one_gadget/builds/libc-2.26-1c39b3b3faa2a2cbb0fa0b6845b29332562262d3.rb +37 -0
  36. data/lib/one_gadget/builds/libc-2.26-499b381aaf00ce85ee5d4a12770ea369b30d2a41.rb +52 -0
  37. data/lib/one_gadget/builds/libc-2.26-4cc84abfe1fd26a485fc2b1b954c281ce9d358fd.rb +52 -0
  38. data/lib/one_gadget/builds/libc-2.26-4ea852c9d6a5084b8b58509b3b3d37d3d8cddb90.rb +52 -0
  39. data/lib/one_gadget/builds/libc-2.26-6d2b609f0c8e7b338f767b08c5ac712fac809d31.rb +49 -0
  40. data/lib/one_gadget/builds/libc-2.26-fb587bc4429e7d1b0de31a3b9ee8ae78ee797eb0.rb +37 -0
  41. data/lib/one_gadget/builds/libc-2.27-0e188ec5f09c187a7a92784d4b97aa251b15a93c.rb +47 -0
  42. data/lib/one_gadget/builds/libc-2.27-53f40c1d2f3739ae017dcdcef1a17314786e3709.rb +38 -0
  43. data/lib/one_gadget/builds/libc-2.27-9dd0bb57f81671704475d1e5163405f7b4d4b454.rb +32 -0
  44. data/lib/one_gadget/builds/libc-2.28-44f5a3efb0e5733fa9d97e690cb36cd4c682bcdb.rb +41 -0
  45. data/lib/one_gadget/builds/libc-2.28-5784a31a1c26f6d2157e585205ebb63dd19ff90f.rb +41 -0
  46. data/lib/one_gadget/builds/libc-2.28-5b157f49586a3ca84d55837f97ff466767dd3445.rb +38 -0
  47. data/lib/one_gadget/builds/libc-2.28-6ee9454b96efa9e343f9e8105f2fa4529265ea05.rb +38 -0
  48. data/lib/one_gadget/emulators/aarch64.rb +176 -0
  49. data/lib/one_gadget/emulators/amd64.rb +1 -1
  50. data/lib/one_gadget/emulators/i386.rb +1 -1
  51. data/lib/one_gadget/emulators/instruction.rb +36 -7
  52. data/lib/one_gadget/emulators/lambda.rb +36 -25
  53. data/lib/one_gadget/emulators/processor.rb +94 -6
  54. data/lib/one_gadget/emulators/x86.rb +43 -95
  55. data/lib/one_gadget/error.rb +15 -3
  56. data/lib/one_gadget/fetcher.rb +3 -1
  57. data/lib/one_gadget/fetchers/aarch64.rb +41 -0
  58. data/lib/one_gadget/fetchers/amd64.rb +4 -2
  59. data/lib/one_gadget/fetchers/base.rb +35 -11
  60. data/lib/one_gadget/fetchers/i386.rb +2 -2
  61. data/lib/one_gadget/fetchers/x86.rb +23 -0
  62. data/lib/one_gadget/gadget.rb +63 -11
  63. data/lib/one_gadget/helper.rb +282 -203
  64. data/lib/one_gadget/one_gadget.rb +12 -4
  65. data/lib/one_gadget/version.rb +1 -1
  66. metadata +57 -6
data/lib/one_gadget/builds/libc-2.19-4eda8ff01be3fba1c7bdd442a8690c3dc7397b6a.rb ADDED
@@ -0,0 +1,44 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-amd64_2.19-0ubuntu6.14_i386/lib64/libc-2.19.so
3
+ #
4
+ # Advanced Micro Devices X86-64
5
+ #
6
+ # GNU C Library (Ubuntu EGLIBC 2.19-0ubuntu6.14) stable release version 2.19, by Roland McGrath et al.
7
+ # Copyright (C) 2014 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 4.8.4.
12
+ # Compiled on a Linux 3.13.11 system on 2018-01-15.
13
+ # Available extensions:
14
+ # crypt add-on version 2.1 by Michael Glad and others
15
+ # GNU Libidn by Simon Josefsson
16
+ # Native POSIX Threads Library by Ulrich Drepper et al
17
+ # BIND-8.2.3-T5B
18
+ # libc ABIs: UNIQUE IFUNC
19
+ # For bug reporting instructions, please see:
20
+ # <https://bugs.launchpad.net/ubuntu/+source/eglibc/+bugs>.
21
+
22
+ build_id = File.basename(__FILE__, '.rb').split('-').last
23
+ OneGadget::Gadget.add(build_id, 274192,
24
+ constraints: ["rax == NULL"],
25
+ effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
26
+ OneGadget::Gadget.add(build_id, 274276,
27
+ constraints: ["[rsp+0x30] == NULL"],
28
+ effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
29
+ OneGadget::Gadget.add(build_id, 764189,
30
+ constraints: ["[rsi] == NULL || rsi == NULL", "[r12] == NULL || r12 == NULL"],
31
+ effect: "execve(\"/bin/sh\", rsi, r12)")
32
+ OneGadget::Gadget.add(build_id, 764268,
33
+ constraints: ["[[rbp-0x48]] == NULL || [rbp-0x48] == NULL", "[r12] == NULL || r12 == NULL"],
34
+ effect: "execve(\"/bin/sh\", [rbp-0x48], r12)")
35
+ OneGadget::Gadget.add(build_id, 878784,
36
+ constraints: ["[r9] == NULL || r9 == NULL", "[rdx] == NULL || rdx == NULL"],
37
+ effect: "execve(\"/bin/sh\", r9, rdx)")
38
+ OneGadget::Gadget.add(build_id, 883528,
39
+ constraints: ["[rsp+0x70] == NULL"],
40
+ effect: "execve(\"/bin/sh\", rsp+0x70, environ)")
41
+ OneGadget::Gadget.add(build_id, 883540,
42
+ constraints: ["[rsi] == NULL || rsi == NULL", "[[rax]] == NULL || [rax] == NULL"],
43
+ effect: "execve(\"/bin/sh\", rsi, [rax])")
44
+
data/lib/one_gadget/builds/libc-2.19-509ee0c9616c4c3ed81951501a8950e1f529bbff.rb ADDED
@@ -0,0 +1,38 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-2.19-12/lib/aarch64-linux-gnu/libc-2.19.so
3
+ #
4
+ # AArch64
5
+ #
6
+ # GNU C Library (Debian GLIBC 2.19-12) stable release version 2.19, by Roland McGrath et al.
7
+ # Copyright (C) 2014 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 4.8.3.
12
+ # Compiled on a Linux 3.16.5 system on 2014-10-25.
13
+ # Available extensions:
14
+ # crypt add-on version 2.1 by Michael Glad and others
15
+ # GNU Libidn by Simon Josefsson
16
+ # Native POSIX Threads Library by Ulrich Drepper et al
17
+ # BIND-8.2.3-T5B
18
+ # libc ABIs: UNIQUE
19
+ # For bug reporting instructions, please see:
20
+ # <http://www.debian.org/Bugs/>.
21
+
22
+ build_id = File.basename(__FILE__, '.rb').split('-').last
23
+ OneGadget::Gadget.add(build_id, 261532,
24
+ constraints: ["writable: x21+0x2d8", "x3+0x6c0 == NULL"],
25
+ effect: "execve(\"/bin/sh\", sp+0x68, environ)")
26
+ OneGadget::Gadget.add(build_id, 261540,
27
+ constraints: ["writable: x20", "writable: x21+0x2d8", "[x20] == NULL || x20 == NULL"],
28
+ effect: "execve(\"/bin/sh\", x20, environ)")
29
+ OneGadget::Gadget.add(build_id, 261616,
30
+ constraints: ["writable: x21+0x2d8", "writable: x24+0x4", "[x20] == NULL || x20 == NULL"],
31
+ effect: "execve(\"/bin/sh\", x20, environ)")
32
+ OneGadget::Gadget.add(build_id, 261628,
33
+ constraints: ["writable: x21+0x2d8", "writable: x24+0x4", "[x1] == NULL || x1 == NULL", "[[x0]] == NULL || [x0] == NULL"],
34
+ effect: "execve(\"/bin/sh\", x1, [x0])")
35
+ OneGadget::Gadget.add(build_id, 261632,
36
+ constraints: ["writable: x21+0x2d8", "writable: x24+0x4", "[x1] == NULL || x1 == NULL", "[x2] == NULL || x2 == NULL"],
37
+ effect: "execve(\"/bin/sh\", x1, x2)")
38
+
data/lib/one_gadget/builds/libc-2.19-6aff6d091954955fe931bb720a17708513aabda7.rb ADDED
@@ -0,0 +1,41 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-i386_2.19-0ubuntu6.14_amd64/lib32/libc-2.19.so
3
+ #
4
+ # Intel 80386
5
+ #
6
+ # GNU C Library (Ubuntu EGLIBC 2.19-0ubuntu6.14) stable release version 2.19, by Roland McGrath et al.
7
+ # Copyright (C) 2014 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 4.8.4.
12
+ # Compiled on a Linux 3.13.11 system on 2018-01-15.
13
+ # Available extensions:
14
+ # crypt add-on version 2.1 by Michael Glad and others
15
+ # GNU Libidn by Simon Josefsson
16
+ # Native POSIX Threads Library by Ulrich Drepper et al
17
+ # BIND-8.2.3-T5B
18
+ # libc ABIs: UNIQUE IFUNC
19
+ # For bug reporting instructions, please see:
20
+ # <https://bugs.launchpad.net/ubuntu/+source/eglibc/+bugs>.
21
+
22
+ build_id = File.basename(__FILE__, '.rb').split('-').last
23
+ OneGadget::Gadget.add(build_id, 261415,
24
+ constraints: ["ebx is the GOT address of libc", "[esp+0x34] == NULL"],
25
+ effect: "execve(\"/bin/sh\", esp+0x34, environ)")
26
+ OneGadget::Gadget.add(build_id, 261451,
27
+ constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
28
+ effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
29
+ OneGadget::Gadget.add(build_id, 261455,
30
+ constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
31
+ effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
32
+ OneGadget::Gadget.add(build_id, 412772,
33
+ constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
34
+ effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")
35
+ OneGadget::Gadget.add(build_id, 412778,
36
+ constraints: ["ebx is the GOT address of libc", "eax == NULL"],
37
+ effect: "execl(\"/bin/sh\", eax)")
38
+ OneGadget::Gadget.add(build_id, 412782,
39
+ constraints: ["ebx is the GOT address of libc", "[esp+0x4] == NULL"],
40
+ effect: "execl(\"/bin/sh\", [esp+0x4])")
41
+
data/lib/one_gadget/builds/libc-2.19-8d935a42f2f2a1149aa52d3098b32b1d5012cb67.rb ADDED
@@ -0,0 +1,38 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.19-10ubuntu2.3_arm64/lib/aarch64-linux-gnu/libc-2.19.so
3
+ #
4
+ # AArch64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.19-10ubuntu2.3) stable release version 2.19, by Roland McGrath et al.
7
+ # Copyright (C) 2014 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 4.8.3.
12
+ # Compiled on a Linux 3.16.7 system on 2015-02-25.
13
+ # Available extensions:
14
+ # crypt add-on version 2.1 by Michael Glad and others
15
+ # GNU Libidn by Simon Josefsson
16
+ # Native POSIX Threads Library by Ulrich Drepper et al
17
+ # BIND-8.2.3-T5B
18
+ # libc ABIs: UNIQUE
19
+ # For bug reporting instructions, please see:
20
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
21
+
22
+ build_id = File.basename(__FILE__, '.rb').split('-').last
23
+ OneGadget::Gadget.add(build_id, 261724,
24
+ constraints: ["writable: x21+0x2e0", "x3+0x3b0 == NULL"],
25
+ effect: "execve(\"/bin/sh\", sp+0x68, environ)")
26
+ OneGadget::Gadget.add(build_id, 261732,
27
+ constraints: ["writable: x20", "writable: x21+0x2e0", "[x20] == NULL || x20 == NULL"],
28
+ effect: "execve(\"/bin/sh\", x20, environ)")
29
+ OneGadget::Gadget.add(build_id, 261808,
30
+ constraints: ["writable: x21+0x2e0", "writable: x24+0x4", "[x20] == NULL || x20 == NULL"],
31
+ effect: "execve(\"/bin/sh\", x20, environ)")
32
+ OneGadget::Gadget.add(build_id, 261820,
33
+ constraints: ["writable: x21+0x2e0", "writable: x24+0x4", "[x1] == NULL || x1 == NULL", "[[x0]] == NULL || [x0] == NULL"],
34
+ effect: "execve(\"/bin/sh\", x1, [x0])")
35
+ OneGadget::Gadget.add(build_id, 261824,
36
+ constraints: ["writable: x21+0x2e0", "writable: x24+0x4", "[x1] == NULL || x1 == NULL", "[x2] == NULL || x2 == NULL"],
37
+ effect: "execve(\"/bin/sh\", x1, x2)")
38
+
data/lib/one_gadget/builds/libc-2.19-a820f849dda0b99ed06dd59bb88404969b3a5f88.rb ADDED
@@ -0,0 +1,41 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.19-0ubuntu6.14_i386/lib/i386-linux-gnu/libc-2.19.so
3
+ #
4
+ # Intel 80386
5
+ #
6
+ # GNU C Library (Ubuntu EGLIBC 2.19-0ubuntu6.14) stable release version 2.19, by Roland McGrath et al.
7
+ # Copyright (C) 2014 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 4.8.4.
12
+ # Compiled on a Linux 3.13.11 system on 2018-01-15.
13
+ # Available extensions:
14
+ # crypt add-on version 2.1 by Michael Glad and others
15
+ # GNU Libidn by Simon Josefsson
16
+ # Native POSIX Threads Library by Ulrich Drepper et al
17
+ # BIND-8.2.3-T5B
18
+ # libc ABIs: UNIQUE IFUNC
19
+ # For bug reporting instructions, please see:
20
+ # <https://bugs.launchpad.net/ubuntu/+source/eglibc/+bugs>.
21
+
22
+ build_id = File.basename(__FILE__, '.rb').split('-').last
23
+ OneGadget::Gadget.add(build_id, 262579,
24
+ constraints: ["ebx is the GOT address of libc", "[esp+0x34] == NULL"],
25
+ effect: "execve(\"/bin/sh\", esp+0x34, environ)")
26
+ OneGadget::Gadget.add(build_id, 262615,
27
+ constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
28
+ effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
29
+ OneGadget::Gadget.add(build_id, 262619,
30
+ constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
31
+ effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
32
+ OneGadget::Gadget.add(build_id, 415385,
33
+ constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
34
+ effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")
35
+ OneGadget::Gadget.add(build_id, 415391,
36
+ constraints: ["ebx is the GOT address of libc", "eax == NULL"],
37
+ effect: "execl(\"/bin/sh\", eax)")
38
+ OneGadget::Gadget.add(build_id, 415395,
39
+ constraints: ["ebx is the GOT address of libc", "[esp+0x4] == NULL"],
40
+ effect: "execl(\"/bin/sh\", [esp+0x4])")
41
+
data/lib/one_gadget/builds/libc-2.19-d9a10b8ef90300628dd0a3a535106967714d7328.rb ADDED
@@ -0,0 +1,47 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.19-0ubuntu6.14_amd64/lib/x86_64-linux-gnu/libc-2.19.so
3
+ #
4
+ # Advanced Micro Devices X86-64
5
+ #
6
+ # GNU C Library (Ubuntu EGLIBC 2.19-0ubuntu6.14) stable release version 2.19, by Roland McGrath et al.
7
+ # Copyright (C) 2014 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 4.8.4.
12
+ # Compiled on a Linux 3.13.11 system on 2018-01-15.
13
+ # Available extensions:
14
+ # crypt add-on version 2.1 by Michael Glad and others
15
+ # GNU Libidn by Simon Josefsson
16
+ # Native POSIX Threads Library by Ulrich Drepper et al
17
+ # BIND-8.2.3-T5B
18
+ # libc ABIs: UNIQUE IFUNC
19
+ # For bug reporting instructions, please see:
20
+ # <https://bugs.launchpad.net/ubuntu/+source/eglibc/+bugs>.
21
+
22
+ build_id = File.basename(__FILE__, '.rb').split('-').last
23
+ OneGadget::Gadget.add(build_id, 287784,
24
+ constraints: ["rax == NULL"],
25
+ effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
26
+ OneGadget::Gadget.add(build_id, 287868,
27
+ constraints: ["[rsp+0x30] == NULL"],
28
+ effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
29
+ OneGadget::Gadget.add(build_id, 809715,
30
+ constraints: ["[rsi] == NULL || rsi == NULL", "[r12] == NULL || r12 == NULL"],
31
+ effect: "execve(\"/bin/sh\", rsi, r12)")
32
+ OneGadget::Gadget.add(build_id, 809794,
33
+ constraints: ["[[rbp-0x48]] == NULL || [rbp-0x48] == NULL", "[r12] == NULL || r12 == NULL"],
34
+ effect: "execve(\"/bin/sh\", [rbp-0x48], r12)")
35
+ OneGadget::Gadget.add(build_id, 951832,
36
+ constraints: ["[rsi] == NULL || rsi == NULL", "[[rbp-0xf0]] == NULL || [rbp-0xf0] == NULL"],
37
+ effect: "execve(\"/bin/sh\", rsi, [rbp-0xf0])")
38
+ OneGadget::Gadget.add(build_id, 955413,
39
+ constraints: ["[rsp+0x50] == NULL"],
40
+ effect: "execve(\"/bin/sh\", rsp+0x50, environ)")
41
+ OneGadget::Gadget.add(build_id, 955425,
42
+ constraints: ["[rsi] == NULL || rsi == NULL", "[[rax]] == NULL || [rax] == NULL"],
43
+ effect: "execve(\"/bin/sh\", rsi, [rax])")
44
+ OneGadget::Gadget.add(build_id, 959341,
45
+ constraints: ["[rsp+0x70] == NULL"],
46
+ effect: "execve(\"/bin/sh\", rsp+0x70, environ)")
47
+
data/lib/one_gadget/builds/libc-2.21-169a143e9c40cfd9d09695333e45fd67743cd2d6.rb ADDED
@@ -0,0 +1,37 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.21-0ubuntu4_arm64/lib/aarch64-linux-gnu/libc-2.21.so
3
+ #
4
+ # AArch64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.21-0ubuntu4) stable release version 2.21, by Roland McGrath et al.
7
+ # Copyright (C) 2015 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 4.9.2.
12
+ # Available extensions:
13
+ # crypt add-on version 2.1 by Michael Glad and others
14
+ # GNU Libidn by Simon Josefsson
15
+ # Native POSIX Threads Library by Ulrich Drepper et al
16
+ # BIND-8.2.3-T5B
17
+ # libc ABIs: UNIQUE
18
+ # For bug reporting instructions, please see:
19
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
+
21
+ build_id = File.basename(__FILE__, '.rb').split('-').last
22
+ OneGadget::Gadget.add(build_id, 252900,
23
+ constraints: ["writable: x19+0x2a0", "writable: x20+0x4", "x4+0x9d8 == NULL"],
24
+ effect: "execve(\"/bin/sh\", sp+0x58, environ)")
25
+ OneGadget::Gadget.add(build_id, 252908,
26
+ constraints: ["writable: x19+0x2a0", "writable: x20+0x4", "x4 == NULL"],
27
+ effect: "execve(\"/bin/sh\", sp+0x58, environ)")
28
+ OneGadget::Gadget.add(build_id, 252976,
29
+ constraints: ["writable: x20+0x4", "[sp+0x58] == NULL"],
30
+ effect: "execve(\"/bin/sh\", sp+0x58, environ)")
31
+ OneGadget::Gadget.add(build_id, 408244,
32
+ constraints: ["x2+0x9e0 == NULL"],
33
+ effect: "execl(\"/bin/sh\", \"sh\", x2+0x9e0)")
34
+ OneGadget::Gadget.add(build_id, 408248,
35
+ constraints: ["x1+0x9d8 == NULL"],
36
+ effect: "execl(\"/bin/sh\", x1+0x9d8)")
37
+
data/lib/one_gadget/builds/libc-2.21-2e9718e58257bda1dc0d751665a3ee233bf606f2.rb ADDED
@@ -0,0 +1,37 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.21-0ubuntu4.3_arm64/lib/aarch64-linux-gnu/libc-2.21.so
3
+ #
4
+ # AArch64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.21-0ubuntu4.3) stable release version 2.21, by Roland McGrath et al.
7
+ # Copyright (C) 2015 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 4.9.3.
12
+ # Available extensions:
13
+ # crypt add-on version 2.1 by Michael Glad and others
14
+ # GNU Libidn by Simon Josefsson
15
+ # Native POSIX Threads Library by Ulrich Drepper et al
16
+ # BIND-8.2.3-T5B
17
+ # libc ABIs: UNIQUE
18
+ # For bug reporting instructions, please see:
19
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
+
21
+ build_id = File.basename(__FILE__, '.rb').split('-').last
22
+ OneGadget::Gadget.add(build_id, 252900,
23
+ constraints: ["writable: x19+0x2a0", "writable: x20+0x4", "x4+0x5d8 == NULL"],
24
+ effect: "execve(\"/bin/sh\", sp+0x58, environ)")
25
+ OneGadget::Gadget.add(build_id, 252908,
26
+ constraints: ["writable: x19+0x2a0", "writable: x20+0x4", "x4 == NULL"],
27
+ effect: "execve(\"/bin/sh\", sp+0x58, environ)")
28
+ OneGadget::Gadget.add(build_id, 252976,
29
+ constraints: ["writable: x20+0x4", "[sp+0x58] == NULL"],
30
+ effect: "execve(\"/bin/sh\", sp+0x58, environ)")
31
+ OneGadget::Gadget.add(build_id, 408388,
32
+ constraints: ["x2+0x5e0 == NULL"],
33
+ effect: "execl(\"/bin/sh\", \"sh\", x2+0x5e0)")
34
+ OneGadget::Gadget.add(build_id, 408392,
35
+ constraints: ["x1+0x5d8 == NULL"],
36
+ effect: "execl(\"/bin/sh\", x1+0x5d8)")
37
+
data/lib/one_gadget/builds/libc-2.23-29e38445a740bba5a77b86691e3c51a7e48dc79b.rb ADDED
@@ -0,0 +1,46 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-i386_2.23-0ubuntu10_amd64/lib32/libc-2.23.so
3
+ #
4
+ # Intel 80386
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.23-0ubuntu10) stable release version 2.23, by Roland McGrath et al.
7
+ # Copyright (C) 2016 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 5.4.0 20160609.
12
+ # Available extensions:
13
+ # crypt add-on version 2.1 by Michael Glad and others
14
+ # GNU Libidn by Simon Josefsson
15
+ # Native POSIX Threads Library by Ulrich Drepper et al
16
+ # BIND-8.2.3-T5B
17
+ # libc ABIs: UNIQUE IFUNC
18
+ # For bug reporting instructions, please see:
19
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
+
21
+ build_id = File.basename(__FILE__, '.rb').split('-').last
22
+ OneGadget::Gadget.add(build_id, 239628,
23
+ constraints: ["esi is the GOT address of libc", "[esp+0x28] == NULL"],
24
+ effect: "execve(\"/bin/sh\", esp+0x28, environ)")
25
+ OneGadget::Gadget.add(build_id, 239630,
26
+ constraints: ["esi is the GOT address of libc", "[esp+0x2c] == NULL"],
27
+ effect: "execve(\"/bin/sh\", esp+0x2c, environ)")
28
+ OneGadget::Gadget.add(build_id, 239634,
29
+ constraints: ["esi is the GOT address of libc", "[esp+0x30] == NULL"],
30
+ effect: "execve(\"/bin/sh\", esp+0x30, environ)")
31
+ OneGadget::Gadget.add(build_id, 239641,
32
+ constraints: ["esi is the GOT address of libc", "[esp+0x34] == NULL"],
33
+ effect: "execve(\"/bin/sh\", esp+0x34, environ)")
34
+ OneGadget::Gadget.add(build_id, 239676,
35
+ constraints: ["esi is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp]] == NULL || [esp] == NULL"],
36
+ effect: "execve(\"/bin/sh\", eax, [esp])")
37
+ OneGadget::Gadget.add(build_id, 239677,
38
+ constraints: ["esi is the GOT address of libc", "[[esp]] == NULL || [esp] == NULL", "[[esp+0x4]] == NULL || [esp+0x4] == NULL"],
39
+ effect: "execve(\"/bin/sh\", [esp], [esp+0x4])")
40
+ OneGadget::Gadget.add(build_id, 389221,
41
+ constraints: ["esi is the GOT address of libc", "eax == NULL"],
42
+ effect: "execl(\"/bin/sh\", eax)")
43
+ OneGadget::Gadget.add(build_id, 389222,
44
+ constraints: ["esi is the GOT address of libc", "[esp] == NULL"],
45
+ effect: "execl(\"/bin/sh\", [esp])")
46
+
data/lib/one_gadget/builds/libc-2.23-679ad41a6bc9e718a11a36cf9879cac97197e565.rb ADDED
@@ -0,0 +1,37 @@
1
+ require 'one_gadget/gadget'
2
+ # spec/data/aarch64-libc-2.23.so
3
+ #
4
+ # AArch64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.23-0ubuntu10) stable release version 2.23, by Roland McGrath et al.
7
+ # Copyright (C) 2016 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 5.4.0 20160609.
12
+ # Available extensions:
13
+ # crypt add-on version 2.1 by Michael Glad and others
14
+ # GNU Libidn by Simon Josefsson
15
+ # Native POSIX Threads Library by Ulrich Drepper et al
16
+ # BIND-8.2.3-T5B
17
+ # libc ABIs: UNIQUE
18
+ # For bug reporting instructions, please see:
19
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
+
21
+ build_id = File.basename(__FILE__, '.rb').split('-').last
22
+ OneGadget::Gadget.add(build_id, 251600,
23
+ constraints: ["writable: x19+0x260", "writable: x20+0x4", "x4+0x990 == NULL"],
24
+ effect: "execve(\"/bin/sh\", sp+0x58, environ)")
25
+ OneGadget::Gadget.add(build_id, 251612,
26
+ constraints: ["writable: x19+0x260", "writable: x20+0x4", "x4 == NULL"],
27
+ effect: "execve(\"/bin/sh\", sp+0x58, environ)")
28
+ OneGadget::Gadget.add(build_id, 251672,
29
+ constraints: ["writable: x20+0x4", "[x22] == NULL || x22 == NULL"],
30
+ effect: "execve(\"/bin/sh\", x22, environ)")
31
+ OneGadget::Gadget.add(build_id, 396316,
32
+ constraints: ["x2+0x998 == NULL"],
33
+ effect: "execl(\"/bin/sh\", \"sh\", x2+0x998)")
34
+ OneGadget::Gadget.add(build_id, 396320,
35
+ constraints: ["x1+0x990 == NULL"],
36
+ effect: "execl(\"/bin/sh\", x1+0x990)")
37
+
data/lib/one_gadget/builds/libc-2.23-b5381a457906d279073822a5ceb24c4bfef94ddb.rb ADDED
@@ -0,0 +1,37 @@
1
+ require 'one_gadget/gadget'
2
+ # Ubuntu 16.04
3
+ #
4
+ # Advanced Micro Devices X86-64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.23-0ubuntu10) stable release version 2.23, by Roland McGrath et al.
7
+ # Copyright (C) 2016 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 5.4.0 20160609.
12
+ # Available extensions:
13
+ # crypt add-on version 2.1 by Michael Glad and others
14
+ # GNU Libidn by Simon Josefsson
15
+ # Native POSIX Threads Library by Ulrich Drepper et al
16
+ # BIND-8.2.3-T5B
17
+ # libc ABIs: UNIQUE IFUNC
18
+ # For bug reporting instructions, please see:
19
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
+
21
+ build_id = File.basename(__FILE__, '.rb').split('-').last
22
+ OneGadget::Gadget.add(build_id, 283158,
23
+ constraints: ["rax == NULL"],
24
+ effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
25
+ OneGadget::Gadget.add(build_id, 283242,
26
+ constraints: ["[rsp+0x30] == NULL"],
27
+ effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
28
+ OneGadget::Gadget.add(build_id, 983716,
29
+ constraints: ["[rsp+0x50] == NULL"],
30
+ effect: "execve(\"/bin/sh\", rsp+0x50, environ)")
31
+ OneGadget::Gadget.add(build_id, 983728,
32
+ constraints: ["[rsi] == NULL || rsi == NULL", "[[rax]] == NULL || [rax] == NULL"],
33
+ effect: "execve(\"/bin/sh\", rsi, [rax])")
34
+ OneGadget::Gadget.add(build_id, 987463,
35
+ constraints: ["[rsp+0x70] == NULL"],
36
+ effect: "execve(\"/bin/sh\", rsp+0x70, environ)")
37
+