one_gadget 1.6.2 → 1.7.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (66) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +141 -94
  3. data/bin/one_gadget +4 -3
  4. data/lib/one_gadget/abi.rb +42 -22
  5. data/lib/one_gadget/builds/libc-2.19-397c84e78c14cbffba39a48184db482211df9fb3.rb +38 -0
  6. data/lib/one_gadget/builds/libc-2.19-4eda8ff01be3fba1c7bdd442a8690c3dc7397b6a.rb +44 -0
  7. data/lib/one_gadget/builds/libc-2.19-509ee0c9616c4c3ed81951501a8950e1f529bbff.rb +38 -0
  8. data/lib/one_gadget/builds/libc-2.19-6aff6d091954955fe931bb720a17708513aabda7.rb +41 -0
  9. data/lib/one_gadget/builds/libc-2.19-8d935a42f2f2a1149aa52d3098b32b1d5012cb67.rb +38 -0
  10. data/lib/one_gadget/builds/libc-2.19-a820f849dda0b99ed06dd59bb88404969b3a5f88.rb +41 -0
  11. data/lib/one_gadget/builds/libc-2.19-d9a10b8ef90300628dd0a3a535106967714d7328.rb +47 -0
  12. data/lib/one_gadget/builds/libc-2.21-169a143e9c40cfd9d09695333e45fd67743cd2d6.rb +37 -0
  13. data/lib/one_gadget/builds/libc-2.21-2e9718e58257bda1dc0d751665a3ee233bf606f2.rb +37 -0
  14. data/lib/one_gadget/builds/libc-2.23-29e38445a740bba5a77b86691e3c51a7e48dc79b.rb +46 -0
  15. data/lib/one_gadget/builds/libc-2.23-679ad41a6bc9e718a11a36cf9879cac97197e565.rb +37 -0
  16. data/lib/one_gadget/builds/libc-2.23-b5381a457906d279073822a5ceb24c4bfef94ddb.rb +37 -0
  17. data/lib/one_gadget/builds/libc-2.23-d10fbfd9328f5ffaca50aa93562cb3bfb618fbcc.rb +43 -0
  18. data/lib/one_gadget/builds/libc-2.23-dd5192a769e33ed6ca68a6ab5740ff9e8ec678a7.rb +46 -0
  19. data/lib/one_gadget/builds/libc-2.24-1f7bdfb9a24714835cee6e6597ea7aa782821371.rb +46 -0
  20. data/lib/one_gadget/builds/libc-2.24-206b2bb216b6cdb6b1be565a6fcd29f3862db060.rb +49 -0
  21. data/lib/one_gadget/builds/libc-2.24-26e84118fee5788eb5d8dda66b7e7f029d2c7800.rb +43 -0
  22. data/lib/one_gadget/builds/libc-2.24-43adbb1e7368c94fba1ba9020d8ef0808bff5bc4.rb +37 -0
  23. data/lib/one_gadget/builds/libc-2.24-497931f8d2346a6d0e300a65d8fc6106c6c88c15.rb +37 -0
  24. data/lib/one_gadget/builds/libc-2.24-4fa7401566d6b3e2c7ee5df3b4d85a01f85b595c.rb +37 -0
  25. data/lib/one_gadget/builds/libc-2.24-568d20b7e0d08bc282fb42ae405c7054e4209ede.rb +37 -0
  26. data/lib/one_gadget/builds/libc-2.24-5b72576ff331e93852355123afecdec70fd247b5.rb +49 -0
  27. data/lib/one_gadget/builds/libc-2.24-a4c01d397b6584f7040ef266b16a5d4da0b7a087.rb +43 -0
  28. data/lib/one_gadget/builds/libc-2.24-b81a06f0ac241c4aa8860602d9abcc903adbb675.rb +46 -0
  29. data/lib/one_gadget/builds/libc-2.24-be6d412ecc4816c46eb49e750b02f714a9131c4e.rb +46 -0
  30. data/lib/one_gadget/builds/libc-2.24-d2a8a8ac188a6c3bafa4813a3d2789240ee49489.rb +46 -0
  31. data/lib/one_gadget/builds/libc-2.24-dff06414a29b97b865ef938e06a7751fe8b1b2d0.rb +46 -0
  32. data/lib/one_gadget/builds/libc-2.24-e5dc6c0caa39828fa10ed37e642723a581acdb6d.rb +37 -0
  33. data/lib/one_gadget/builds/libc-2.24-fd0655c4d2073eda4235084e1d0e558f0251be8a.rb +37 -0
  34. data/lib/one_gadget/builds/libc-2.25-e5eb6347f0629b37bf698200022a683b7efb10ed.rb +37 -0
  35. data/lib/one_gadget/builds/libc-2.26-1c39b3b3faa2a2cbb0fa0b6845b29332562262d3.rb +37 -0
  36. data/lib/one_gadget/builds/libc-2.26-499b381aaf00ce85ee5d4a12770ea369b30d2a41.rb +52 -0
  37. data/lib/one_gadget/builds/libc-2.26-4cc84abfe1fd26a485fc2b1b954c281ce9d358fd.rb +52 -0
  38. data/lib/one_gadget/builds/libc-2.26-4ea852c9d6a5084b8b58509b3b3d37d3d8cddb90.rb +52 -0
  39. data/lib/one_gadget/builds/libc-2.26-6d2b609f0c8e7b338f767b08c5ac712fac809d31.rb +49 -0
  40. data/lib/one_gadget/builds/libc-2.26-fb587bc4429e7d1b0de31a3b9ee8ae78ee797eb0.rb +37 -0
  41. data/lib/one_gadget/builds/libc-2.27-0e188ec5f09c187a7a92784d4b97aa251b15a93c.rb +47 -0
  42. data/lib/one_gadget/builds/libc-2.27-53f40c1d2f3739ae017dcdcef1a17314786e3709.rb +38 -0
  43. data/lib/one_gadget/builds/libc-2.27-9dd0bb57f81671704475d1e5163405f7b4d4b454.rb +32 -0
  44. data/lib/one_gadget/builds/libc-2.28-44f5a3efb0e5733fa9d97e690cb36cd4c682bcdb.rb +41 -0
  45. data/lib/one_gadget/builds/libc-2.28-5784a31a1c26f6d2157e585205ebb63dd19ff90f.rb +41 -0
  46. data/lib/one_gadget/builds/libc-2.28-5b157f49586a3ca84d55837f97ff466767dd3445.rb +38 -0
  47. data/lib/one_gadget/builds/libc-2.28-6ee9454b96efa9e343f9e8105f2fa4529265ea05.rb +38 -0
  48. data/lib/one_gadget/emulators/aarch64.rb +176 -0
  49. data/lib/one_gadget/emulators/amd64.rb +1 -1
  50. data/lib/one_gadget/emulators/i386.rb +1 -1
  51. data/lib/one_gadget/emulators/instruction.rb +36 -7
  52. data/lib/one_gadget/emulators/lambda.rb +36 -25
  53. data/lib/one_gadget/emulators/processor.rb +94 -6
  54. data/lib/one_gadget/emulators/x86.rb +43 -95
  55. data/lib/one_gadget/error.rb +15 -3
  56. data/lib/one_gadget/fetcher.rb +3 -1
  57. data/lib/one_gadget/fetchers/aarch64.rb +41 -0
  58. data/lib/one_gadget/fetchers/amd64.rb +4 -2
  59. data/lib/one_gadget/fetchers/base.rb +35 -11
  60. data/lib/one_gadget/fetchers/i386.rb +2 -2
  61. data/lib/one_gadget/fetchers/x86.rb +23 -0
  62. data/lib/one_gadget/gadget.rb +63 -11
  63. data/lib/one_gadget/helper.rb +282 -203
  64. data/lib/one_gadget/one_gadget.rb +12 -4
  65. data/lib/one_gadget/version.rb +1 -1
  66. metadata +57 -6
data/lib/one_gadget/builds/libc-2.23-d10fbfd9328f5ffaca50aa93562cb3bfb618fbcc.rb ADDED
@@ -0,0 +1,43 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-amd64_2.23-0ubuntu10_i386/lib64/libc-2.23.so
3
+ #
4
+ # Advanced Micro Devices X86-64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.23-0ubuntu10) stable release version 2.23, by Roland McGrath et al.
7
+ # Copyright (C) 2016 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 5.4.0 20160609.
12
+ # Available extensions:
13
+ # crypt add-on version 2.1 by Michael Glad and others
14
+ # GNU Libidn by Simon Josefsson
15
+ # Native POSIX Threads Library by Ulrich Drepper et al
16
+ # BIND-8.2.3-T5B
17
+ # libc ABIs: UNIQUE IFUNC
18
+ # For bug reporting instructions, please see:
19
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
+
21
+ build_id = File.basename(__FILE__, '.rb').split('-').last
22
+ OneGadget::Gadget.add(build_id, 259254,
23
+ constraints: ["rax == NULL"],
24
+ effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
25
+ OneGadget::Gadget.add(build_id, 259338,
26
+ constraints: ["[rsp+0x30] == NULL"],
27
+ effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
28
+ OneGadget::Gadget.add(build_id, 753703,
29
+ constraints: ["[rsi] == NULL || rsi == NULL", "[r12] == NULL || r12 == NULL"],
30
+ effect: "execve(\"/bin/sh\", rsi, r12)")
31
+ OneGadget::Gadget.add(build_id, 753912,
32
+ constraints: ["[[rbp-0x40]] == NULL || [rbp-0x40] == NULL", "[r12] == NULL || r12 == NULL"],
33
+ effect: "execve(\"/bin/sh\", [rbp-0x40], r12)")
34
+ OneGadget::Gadget.add(build_id, 875047,
35
+ constraints: ["[rsp+0x70] == NULL"],
36
+ effect: "execve(\"/bin/sh\", rsp+0x70, environ)")
37
+ OneGadget::Gadget.add(build_id, 875059,
38
+ constraints: ["[rsi] == NULL || rsi == NULL", "[[rax]] == NULL || [rax] == NULL"],
39
+ effect: "execve(\"/bin/sh\", rsi, [rax])")
40
+ OneGadget::Gadget.add(build_id, 889809,
41
+ constraints: ["[r9] == NULL || r9 == NULL", "[rdx] == NULL || rdx == NULL"],
42
+ effect: "execve(\"/bin/sh\", r9, rdx)")
43
+
data/lib/one_gadget/builds/libc-2.23-dd5192a769e33ed6ca68a6ab5740ff9e8ec678a7.rb ADDED
@@ -0,0 +1,46 @@
1
+ require 'one_gadget/gadget'
2
+ # Ubuntu 16.04
3
+ #
4
+ # Intel 80386
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.23-0ubuntu10) stable release version 2.23, by Roland McGrath et al.
7
+ # Copyright (C) 2016 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 5.4.0 20160609.
12
+ # Available extensions:
13
+ # crypt add-on version 2.1 by Michael Glad and others
14
+ # GNU Libidn by Simon Josefsson
15
+ # Native POSIX Threads Library by Ulrich Drepper et al
16
+ # BIND-8.2.3-T5B
17
+ # libc ABIs: UNIQUE IFUNC
18
+ # For bug reporting instructions, please see:
19
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
+
21
+ build_id = File.basename(__FILE__, '.rb').split('-').last
22
+ OneGadget::Gadget.add(build_id, 240732,
23
+ constraints: ["esi is the GOT address of libc", "[esp+0x28] == NULL"],
24
+ effect: "execve(\"/bin/sh\", esp+0x28, environ)")
25
+ OneGadget::Gadget.add(build_id, 240734,
26
+ constraints: ["esi is the GOT address of libc", "[esp+0x2c] == NULL"],
27
+ effect: "execve(\"/bin/sh\", esp+0x2c, environ)")
28
+ OneGadget::Gadget.add(build_id, 240738,
29
+ constraints: ["esi is the GOT address of libc", "[esp+0x30] == NULL"],
30
+ effect: "execve(\"/bin/sh\", esp+0x30, environ)")
31
+ OneGadget::Gadget.add(build_id, 240745,
32
+ constraints: ["esi is the GOT address of libc", "[esp+0x34] == NULL"],
33
+ effect: "execve(\"/bin/sh\", esp+0x34, environ)")
34
+ OneGadget::Gadget.add(build_id, 240780,
35
+ constraints: ["esi is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp]] == NULL || [esp] == NULL"],
36
+ effect: "execve(\"/bin/sh\", eax, [esp])")
37
+ OneGadget::Gadget.add(build_id, 240781,
38
+ constraints: ["esi is the GOT address of libc", "[[esp]] == NULL || [esp] == NULL", "[[esp+0x4]] == NULL || [esp+0x4] == NULL"],
39
+ effect: "execve(\"/bin/sh\", [esp], [esp+0x4])")
40
+ OneGadget::Gadget.add(build_id, 392133,
41
+ constraints: ["esi is the GOT address of libc", "eax == NULL"],
42
+ effect: "execl(\"/bin/sh\", eax)")
43
+ OneGadget::Gadget.add(build_id, 392134,
44
+ constraints: ["esi is the GOT address of libc", "[esp] == NULL"],
45
+ effect: "execl(\"/bin/sh\", [esp])")
46
+
data/lib/one_gadget/builds/libc-2.24-1f7bdfb9a24714835cee6e6597ea7aa782821371.rb ADDED
@@ -0,0 +1,46 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-i386_2.24-3ubuntu2.2_amd64/lib32/libc-2.24.so
3
+ #
4
+ # Intel 80386
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.24-3ubuntu2.2) stable release version 2.24, by Roland McGrath et al.
7
+ # Copyright (C) 2016 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 6.2.0 20161005.
12
+ # Available extensions:
13
+ # crypt add-on version 2.1 by Michael Glad and others
14
+ # GNU Libidn by Simon Josefsson
15
+ # Native POSIX Threads Library by Ulrich Drepper et al
16
+ # BIND-8.2.3-T5B
17
+ # libc ABIs: UNIQUE IFUNC
18
+ # For bug reporting instructions, please see:
19
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
+
21
+ build_id = File.basename(__FILE__, '.rb').split('-').last
22
+ OneGadget::Gadget.add(build_id, 239484,
23
+ constraints: ["esi is the GOT address of libc", "[esp+0x28] == NULL"],
24
+ effect: "execve(\"/bin/sh\", esp+0x28, environ)")
25
+ OneGadget::Gadget.add(build_id, 239486,
26
+ constraints: ["esi is the GOT address of libc", "[esp+0x2c] == NULL"],
27
+ effect: "execve(\"/bin/sh\", esp+0x2c, environ)")
28
+ OneGadget::Gadget.add(build_id, 239490,
29
+ constraints: ["esi is the GOT address of libc", "[esp+0x30] == NULL"],
30
+ effect: "execve(\"/bin/sh\", esp+0x30, environ)")
31
+ OneGadget::Gadget.add(build_id, 239497,
32
+ constraints: ["esi is the GOT address of libc", "[esp+0x34] == NULL"],
33
+ effect: "execve(\"/bin/sh\", esp+0x34, environ)")
34
+ OneGadget::Gadget.add(build_id, 239532,
35
+ constraints: ["esi is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp]] == NULL || [esp] == NULL"],
36
+ effect: "execve(\"/bin/sh\", eax, [esp])")
37
+ OneGadget::Gadget.add(build_id, 239533,
38
+ constraints: ["esi is the GOT address of libc", "[[esp]] == NULL || [esp] == NULL", "[[esp+0x4]] == NULL || [esp+0x4] == NULL"],
39
+ effect: "execve(\"/bin/sh\", [esp], [esp+0x4])")
40
+ OneGadget::Gadget.add(build_id, 391205,
41
+ constraints: ["esi is the GOT address of libc", "eax == NULL"],
42
+ effect: "execl(\"/bin/sh\", eax)")
43
+ OneGadget::Gadget.add(build_id, 391206,
44
+ constraints: ["esi is the GOT address of libc", "[esp] == NULL"],
45
+ effect: "execl(\"/bin/sh\", [esp])")
46
+
data/lib/one_gadget/builds/libc-2.24-206b2bb216b6cdb6b1be565a6fcd29f3862db060.rb ADDED
@@ -0,0 +1,49 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.24-3ubuntu2.2_amd64/lib/x86_64-linux-gnu/libc-2.24.so
3
+ #
4
+ # Advanced Micro Devices X86-64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.24-3ubuntu2.2) stable release version 2.24, by Roland McGrath et al.
7
+ # Copyright (C) 2016 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 6.2.0 20161005.
12
+ # Available extensions:
13
+ # crypt add-on version 2.1 by Michael Glad and others
14
+ # GNU Libidn by Simon Josefsson
15
+ # Native POSIX Threads Library by Ulrich Drepper et al
16
+ # BIND-8.2.3-T5B
17
+ # libc ABIs: UNIQUE IFUNC
18
+ # For bug reporting instructions, please see:
19
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
+
21
+ build_id = File.basename(__FILE__, '.rb').split('-').last
22
+ OneGadget::Gadget.add(build_id, 283990,
23
+ constraints: ["rax == NULL"],
24
+ effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
25
+ OneGadget::Gadget.add(build_id, 284074,
26
+ constraints: ["[rsp+0x30] == NULL"],
27
+ effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
28
+ OneGadget::Gadget.add(build_id, 843370,
29
+ constraints: ["[r15] == NULL || r15 == NULL", "[r13] == NULL || r13 == NULL"],
30
+ effect: "execve(\"/bin/sh\", r15, r13)")
31
+ OneGadget::Gadget.add(build_id, 844053,
32
+ constraints: ["[[rbp-0x78]] == NULL || [rbp-0x78] == NULL", "[[rbp-0x50]] == NULL || [rbp-0x50] == NULL"],
33
+ effect: "execve(\"/bin/sh\", [rbp-0x78], [rbp-0x50])")
34
+ OneGadget::Gadget.add(build_id, 844057,
35
+ constraints: ["[r9] == NULL || r9 == NULL", "[[rbp-0x50]] == NULL || [rbp-0x50] == NULL"],
36
+ effect: "execve(\"/bin/sh\", r9, [rbp-0x50])")
37
+ OneGadget::Gadget.add(build_id, 844061,
38
+ constraints: ["[r9] == NULL || r9 == NULL", "[rdx] == NULL || rdx == NULL"],
39
+ effect: "execve(\"/bin/sh\", r9, rdx)")
40
+ OneGadget::Gadget.add(build_id, 988817,
41
+ constraints: ["[rsp+0x50] == NULL"],
42
+ effect: "execve(\"/bin/sh\", rsp+0x50, environ)")
43
+ OneGadget::Gadget.add(build_id, 988829,
44
+ constraints: ["[rsi] == NULL || rsi == NULL", "[[rax]] == NULL || [rax] == NULL"],
45
+ effect: "execve(\"/bin/sh\", rsi, [rax])")
46
+ OneGadget::Gadget.add(build_id, 992537,
47
+ constraints: ["[rsp+0x70] == NULL"],
48
+ effect: "execve(\"/bin/sh\", rsp+0x70, environ)")
49
+
data/lib/one_gadget/builds/libc-2.24-26e84118fee5788eb5d8dda66b7e7f029d2c7800.rb ADDED
@@ -0,0 +1,43 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.24-9ubuntu2_arm64/lib/aarch64-linux-gnu/libc-2.24.so
3
+ #
4
+ # AArch64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.24-9ubuntu2) stable release version 2.24, by Roland McGrath et al.
7
+ # Copyright (C) 2016 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 6.3.0 20170321.
12
+ # Available extensions:
13
+ # crypt add-on version 2.1 by Michael Glad and others
14
+ # GNU Libidn by Simon Josefsson
15
+ # Native POSIX Threads Library by Ulrich Drepper et al
16
+ # BIND-8.2.3-T5B
17
+ # libc ABIs: UNIQUE
18
+ # For bug reporting instructions, please see:
19
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
+
21
+ build_id = File.basename(__FILE__, '.rb').split('-').last
22
+ OneGadget::Gadget.add(build_id, 248400,
23
+ constraints: ["writable: x19+0x258", "x3+0x9f8 == NULL"],
24
+ effect: "execve(\"/bin/sh\", sp+0x68, environ)")
25
+ OneGadget::Gadget.add(build_id, 248404,
26
+ constraints: ["writable: x19+0x258", "x3 == NULL"],
27
+ effect: "execve(\"/bin/sh\", sp+0x68, environ)")
28
+ OneGadget::Gadget.add(build_id, 248440,
29
+ constraints: ["writable: x19+0x258", "writable: x20+0x4", "[sp+0x68] == NULL"],
30
+ effect: "execve(\"/bin/sh\", sp+0x68, environ)")
31
+ OneGadget::Gadget.add(build_id, 248476,
32
+ constraints: ["writable: x19+0x258", "writable: x20+0x4", "[x21] == NULL || x21 == NULL"],
33
+ effect: "execve(\"/bin/sh\", x21, environ)")
34
+ OneGadget::Gadget.add(build_id, 398984,
35
+ constraints: ["x2+0xa00 == NULL"],
36
+ effect: "execl(\"/bin/sh\", \"sh\", x2+0xa00)")
37
+ OneGadget::Gadget.add(build_id, 398996,
38
+ constraints: ["x1+0x9f8 == NULL"],
39
+ effect: "execl(\"/bin/sh\", x1+0x9f8)")
40
+ OneGadget::Gadget.add(build_id, 399004,
41
+ constraints: ["x1 == NULL"],
42
+ effect: "execl(\"/bin/sh\", x1)")
43
+
data/lib/one_gadget/builds/libc-2.24-43adbb1e7368c94fba1ba9020d8ef0808bff5bc4.rb ADDED
@@ -0,0 +1,37 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-amd64_2.24-3ubuntu2.2_i386/lib64/libc-2.24.so
3
+ #
4
+ # Advanced Micro Devices X86-64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.24-3ubuntu2.2) stable release version 2.24, by Roland McGrath et al.
7
+ # Copyright (C) 2016 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 6.2.0 20161005.
12
+ # Available extensions:
13
+ # crypt add-on version 2.1 by Michael Glad and others
14
+ # GNU Libidn by Simon Josefsson
15
+ # Native POSIX Threads Library by Ulrich Drepper et al
16
+ # BIND-8.2.3-T5B
17
+ # libc ABIs: UNIQUE IFUNC
18
+ # For bug reporting instructions, please see:
19
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
+
21
+ build_id = File.basename(__FILE__, '.rb').split('-').last
22
+ OneGadget::Gadget.add(build_id, 258966,
23
+ constraints: ["rax == NULL"],
24
+ effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
25
+ OneGadget::Gadget.add(build_id, 259050,
26
+ constraints: ["[rsp+0x30] == NULL"],
27
+ effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
28
+ OneGadget::Gadget.add(build_id, 757064,
29
+ constraints: ["[r13] == NULL || r13 == NULL", "[r12] == NULL || r12 == NULL"],
30
+ effect: "execve(\"/bin/sh\", r13, r12)")
31
+ OneGadget::Gadget.add(build_id, 879333,
32
+ constraints: ["[rsp+0x70] == NULL"],
33
+ effect: "execve(\"/bin/sh\", rsp+0x70, environ)")
34
+ OneGadget::Gadget.add(build_id, 879345,
35
+ constraints: ["[rsi] == NULL || rsi == NULL", "[[rax]] == NULL || [rax] == NULL"],
36
+ effect: "execve(\"/bin/sh\", rsi, [rax])")
37
+
data/lib/one_gadget/builds/libc-2.24-497931f8d2346a6d0e300a65d8fc6106c6c88c15.rb ADDED
@@ -0,0 +1,37 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.24-3ubuntu2.2_arm64/lib/aarch64-linux-gnu/libc-2.24.so
3
+ #
4
+ # AArch64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.24-3ubuntu2.2) stable release version 2.24, by Roland McGrath et al.
7
+ # Copyright (C) 2016 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 6.2.0 20161005.
12
+ # Available extensions:
13
+ # crypt add-on version 2.1 by Michael Glad and others
14
+ # GNU Libidn by Simon Josefsson
15
+ # Native POSIX Threads Library by Ulrich Drepper et al
16
+ # BIND-8.2.3-T5B
17
+ # libc ABIs: UNIQUE
18
+ # For bug reporting instructions, please see:
19
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
+
21
+ build_id = File.basename(__FILE__, '.rb').split('-').last
22
+ OneGadget::Gadget.add(build_id, 248288,
23
+ constraints: ["writable: x19+0x258", "writable: x20+0x4", "x4+0x3a8 == NULL"],
24
+ effect: "execve(\"/bin/sh\", sp+0x58, environ)")
25
+ OneGadget::Gadget.add(build_id, 248300,
26
+ constraints: ["writable: x19+0x258", "writable: x20+0x4", "x4 == NULL"],
27
+ effect: "execve(\"/bin/sh\", sp+0x58, environ)")
28
+ OneGadget::Gadget.add(build_id, 248360,
29
+ constraints: ["writable: x20+0x4", "[x22] == NULL || x22 == NULL"],
30
+ effect: "execve(\"/bin/sh\", x22, environ)")
31
+ OneGadget::Gadget.add(build_id, 398708,
32
+ constraints: ["x2+0x3b0 == NULL"],
33
+ effect: "execl(\"/bin/sh\", \"sh\", x2+0x3b0)")
34
+ OneGadget::Gadget.add(build_id, 398712,
35
+ constraints: ["x1+0x3a8 == NULL"],
36
+ effect: "execl(\"/bin/sh\", x1+0x3a8)")
37
+
data/lib/one_gadget/builds/libc-2.24-4fa7401566d6b3e2c7ee5df3b4d85a01f85b595c.rb ADDED
@@ -0,0 +1,37 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.24-3ubuntu1_arm64/lib/aarch64-linux-gnu/libc-2.24.so
3
+ #
4
+ # AArch64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.24-3ubuntu1) stable release version 2.24, by Roland McGrath et al.
7
+ # Copyright (C) 2016 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 6.2.0 20160927.
12
+ # Available extensions:
13
+ # crypt add-on version 2.1 by Michael Glad and others
14
+ # GNU Libidn by Simon Josefsson
15
+ # Native POSIX Threads Library by Ulrich Drepper et al
16
+ # BIND-8.2.3-T5B
17
+ # libc ABIs: UNIQUE
18
+ # For bug reporting instructions, please see:
19
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
+
21
+ build_id = File.basename(__FILE__, '.rb').split('-').last
22
+ OneGadget::Gadget.add(build_id, 248480,
23
+ constraints: ["writable: x19+0x258", "writable: x20+0x4", "x4+0xc48 == NULL"],
24
+ effect: "execve(\"/bin/sh\", sp+0x58, environ)")
25
+ OneGadget::Gadget.add(build_id, 248492,
26
+ constraints: ["writable: x19+0x258", "writable: x20+0x4", "x4 == NULL"],
27
+ effect: "execve(\"/bin/sh\", sp+0x58, environ)")
28
+ OneGadget::Gadget.add(build_id, 248552,
29
+ constraints: ["writable: x20+0x4", "[x22] == NULL || x22 == NULL"],
30
+ effect: "execve(\"/bin/sh\", x22, environ)")
31
+ OneGadget::Gadget.add(build_id, 399116,
32
+ constraints: ["x2+0xc50 == NULL"],
33
+ effect: "execl(\"/bin/sh\", \"sh\", x2+0xc50)")
34
+ OneGadget::Gadget.add(build_id, 399120,
35
+ constraints: ["x1+0xc48 == NULL"],
36
+ effect: "execl(\"/bin/sh\", x1+0xc48)")
37
+
data/lib/one_gadget/builds/libc-2.24-568d20b7e0d08bc282fb42ae405c7054e4209ede.rb ADDED
@@ -0,0 +1,37 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-amd64_2.24-9ubuntu2_i386/lib64/libc-2.24.so
3
+ #
4
+ # Advanced Micro Devices X86-64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.24-9ubuntu2) stable release version 2.24, by Roland McGrath et al.
7
+ # Copyright (C) 2016 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 6.3.0 20170321.
12
+ # Available extensions:
13
+ # crypt add-on version 2.1 by Michael Glad and others
14
+ # GNU Libidn by Simon Josefsson
15
+ # Native POSIX Threads Library by Ulrich Drepper et al
16
+ # BIND-8.2.3-T5B
17
+ # libc ABIs: UNIQUE IFUNC
18
+ # For bug reporting instructions, please see:
19
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
+
21
+ build_id = File.basename(__FILE__, '.rb').split('-').last
22
+ OneGadget::Gadget.add(build_id, 258950,
23
+ constraints: ["rax == NULL"],
24
+ effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
25
+ OneGadget::Gadget.add(build_id, 259034,
26
+ constraints: ["[rsp+0x30] == NULL"],
27
+ effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
28
+ OneGadget::Gadget.add(build_id, 756607,
29
+ constraints: ["[r13] == NULL || r13 == NULL", "[r12] == NULL || r12 == NULL"],
30
+ effect: "execve(\"/bin/sh\", r13, r12)")
31
+ OneGadget::Gadget.add(build_id, 878847,
32
+ constraints: ["[rsp+0x60] == NULL"],
33
+ effect: "execve(\"/bin/sh\", rsp+0x60, environ)")
34
+ OneGadget::Gadget.add(build_id, 878859,
35
+ constraints: ["[rsi] == NULL || rsi == NULL", "[[rax]] == NULL || [rax] == NULL"],
36
+ effect: "execve(\"/bin/sh\", rsi, [rax])")
37
+
data/lib/one_gadget/builds/libc-2.24-5b72576ff331e93852355123afecdec70fd247b5.rb ADDED
@@ -0,0 +1,49 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.24-9ubuntu2_amd64/lib/x86_64-linux-gnu/libc-2.24.so
3
+ #
4
+ # Advanced Micro Devices X86-64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.24-9ubuntu2) stable release version 2.24, by Roland McGrath et al.
7
+ # Copyright (C) 2016 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 6.3.0 20170321.
12
+ # Available extensions:
13
+ # crypt add-on version 2.1 by Michael Glad and others
14
+ # GNU Libidn by Simon Josefsson
15
+ # Native POSIX Threads Library by Ulrich Drepper et al
16
+ # BIND-8.2.3-T5B
17
+ # libc ABIs: UNIQUE IFUNC
18
+ # For bug reporting instructions, please see:
19
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
+
21
+ build_id = File.basename(__FILE__, '.rb').split('-').last
22
+ OneGadget::Gadget.add(build_id, 283942,
23
+ constraints: ["rax == NULL"],
24
+ effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
25
+ OneGadget::Gadget.add(build_id, 284026,
26
+ constraints: ["[rsp+0x30] == NULL"],
27
+ effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
28
+ OneGadget::Gadget.add(build_id, 840257,
29
+ constraints: ["[r15] == NULL || r15 == NULL", "[r13] == NULL || r13 == NULL"],
30
+ effect: "execve(\"/bin/sh\", r15, r13)")
31
+ OneGadget::Gadget.add(build_id, 840929,
32
+ constraints: ["[[rbp-0x78]] == NULL || [rbp-0x78] == NULL", "[[rbp-0x50]] == NULL || [rbp-0x50] == NULL"],
33
+ effect: "execve(\"/bin/sh\", [rbp-0x78], [rbp-0x50])")
34
+ OneGadget::Gadget.add(build_id, 840933,
35
+ constraints: ["[r9] == NULL || r9 == NULL", "[[rbp-0x50]] == NULL || [rbp-0x50] == NULL"],
36
+ effect: "execve(\"/bin/sh\", r9, [rbp-0x50])")
37
+ OneGadget::Gadget.add(build_id, 840937,
38
+ constraints: ["[r9] == NULL || r9 == NULL", "[rdx] == NULL || rdx == NULL"],
39
+ effect: "execve(\"/bin/sh\", r9, rdx)")
40
+ OneGadget::Gadget.add(build_id, 985681,
41
+ constraints: ["[rsp+0x40] == NULL"],
42
+ effect: "execve(\"/bin/sh\", rsp+0x40, environ)")
43
+ OneGadget::Gadget.add(build_id, 985693,
44
+ constraints: ["[rsi] == NULL || rsi == NULL", "[[rax]] == NULL || [rax] == NULL"],
45
+ effect: "execve(\"/bin/sh\", rsi, [rax])")
46
+ OneGadget::Gadget.add(build_id, 989387,
47
+ constraints: ["[rsp+0x60] == NULL"],
48
+ effect: "execve(\"/bin/sh\", rsp+0x60, environ)")
49
+
data/lib/one_gadget/builds/libc-2.24-a4c01d397b6584f7040ef266b16a5d4da0b7a087.rb ADDED
@@ -0,0 +1,43 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.24-9ubuntu2.2_arm64/lib/aarch64-linux-gnu/libc-2.24.so
3
+ #
4
+ # AArch64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.24-9ubuntu2.2) stable release version 2.24, by Roland McGrath et al.
7
+ # Copyright (C) 2016 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 6.3.0 20170406.
12
+ # Available extensions:
13
+ # crypt add-on version 2.1 by Michael Glad and others
14
+ # GNU Libidn by Simon Josefsson
15
+ # Native POSIX Threads Library by Ulrich Drepper et al
16
+ # BIND-8.2.3-T5B
17
+ # libc ABIs: UNIQUE
18
+ # For bug reporting instructions, please see:
19
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
+
21
+ build_id = File.basename(__FILE__, '.rb').split('-').last
22
+ OneGadget::Gadget.add(build_id, 248400,
23
+ constraints: ["writable: x19+0x258", "x3+0xbb8 == NULL"],
24
+ effect: "execve(\"/bin/sh\", sp+0x68, environ)")
25
+ OneGadget::Gadget.add(build_id, 248404,
26
+ constraints: ["writable: x19+0x258", "x3 == NULL"],
27
+ effect: "execve(\"/bin/sh\", sp+0x68, environ)")
28
+ OneGadget::Gadget.add(build_id, 248440,
29
+ constraints: ["writable: x19+0x258", "writable: x20+0x4", "[sp+0x68] == NULL"],
30
+ effect: "execve(\"/bin/sh\", sp+0x68, environ)")
31
+ OneGadget::Gadget.add(build_id, 248476,
32
+ constraints: ["writable: x19+0x258", "writable: x20+0x4", "[x21] == NULL || x21 == NULL"],
33
+ effect: "execve(\"/bin/sh\", x21, environ)")
34
+ OneGadget::Gadget.add(build_id, 398984,
35
+ constraints: ["x2+0xbc0 == NULL"],
36
+ effect: "execl(\"/bin/sh\", \"sh\", x2+0xbc0)")
37
+ OneGadget::Gadget.add(build_id, 398996,
38
+ constraints: ["x1+0xbb8 == NULL"],
39
+ effect: "execl(\"/bin/sh\", x1+0xbb8)")
40
+ OneGadget::Gadget.add(build_id, 399004,
41
+ constraints: ["x1 == NULL"],
42
+ effect: "execl(\"/bin/sh\", x1)")
43
+