one_gadget 1.7.2 → 1.7.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8408e8896c26b1f1841de6d054d3535f557e9460d0cf888b11d9bf0e84794b92
-  data.tar.gz: 61f4578f7bc943a7bf2914807769285832870af127c615e45635b89dc1a66a19
+  metadata.gz: 8e18cc48cf48847c6303e01416f9c36fb7284bc926d30f63fb716ce993a569ad
+  data.tar.gz: 17288573c3302ee9a1e9773b1dfc71ec36a433694ae9742f56999e5e719396e4
 SHA512:
-  metadata.gz: 8e8462690bcbdfa1424cc9374f71a027423f544b956153507b9cb6bf0ee4d829656eb559d90016ec399595a4de32dc6475155347cb417b806d10e6b9bf78f010
-  data.tar.gz: 4180279e347d9f1623ece4cd1829da966c9f759062ac787d5910019e10b7eae0f7b46e75b419997e9d8cbf1df8fc4a1aa9f7e4e02ca0557d2fb8973e5a10f2b1
+  metadata.gz: 113e516e80c9ac3baf01505d8ddceb12c4c47db1c70e5b472baffa35b271f00ac38f46d9d4d0b5c81abfb91c23af7ab732ef89c873c50f512e35c166cb56b0aa
+  data.tar.gz: 650ca490c96910e5a12b2da59e707a7f23c2346b1beaeb5df7ef977d764e764e08f9615f6ac006d1525a04cbbe173b6d7a8cf2bc765f6c2dc38ea9eafd3457f8

data/README.md

@@ -56,6 +56,8 @@ $ one_gadget
 #     -s, --script exploit-script      Run exploit script with all possible gadgets.
 #                                      The script will be run as 'exploit-script $offset'.
 #         --info BuildID               Show version information given BuildID.
+#         --base BASE_ADDRESS          The base address of libc.
+#                                      Default: 0
 #         --version                    Current gem version.
 
 ```
@@ -64,6 +66,7 @@ $ one_gadget
 $ one_gadget /lib/x86_64-linux-gnu/libc.so.6
 # 0x4f2c5 execve("/bin/sh", rsp+0x40, environ)
 # constraints:
+#   rsp & 0xf == 0
 #   rcx == NULL
 #
 # 0x4f322 execve("/bin/sh", rsp+0x40, environ)
@@ -105,7 +108,7 @@ $ one_gadget -b aad7dbe330f23ea00ca63daf793b766b51aceb5d
 
 Consider this scenario when exploiting:
 1. Able to write on GOT (Global Offset Table)
-2. Libc base address is unknown
+2. Base address of libc is *unknown*
 
 In this scenario you can choose to write two low-byte on a GOT entry with one-gadget's two low-byte.
 If the function offset on GOT is close enough with the one-gadget,
@@ -120,6 +123,7 @@ $ one_gadget /lib/x86_64-linux-gnu/libc.so.6 --near exit,mkdir
 # [OneGadget] Gadgets near exit(0x43120):
 # 0x4f2c5 execve("/bin/sh", rsp+0x40, environ)
 # constraints:
+#   rsp & 0xf == 0
 #   rcx == NULL
 #
 # 0x4f322 execve("/bin/sh", rsp+0x40, environ)
@@ -141,6 +145,7 @@ $ one_gadget /lib/x86_64-linux-gnu/libc.so.6 --near exit,mkdir
 #
 # 0x4f2c5 execve("/bin/sh", rsp+0x40, environ)
 # constraints:
+#   rsp & 0xf == 0
 #   rcx == NULL
 #
 
@@ -194,6 +199,7 @@ Use option `--level 1` to show all gadgets found instead of only those with high
 $ one_gadget /lib/x86_64-linux-gnu/libc.so.6 --level 1
 # 0x4f2c5 execve("/bin/sh", rsp+0x40, environ)
 # constraints:
+#   rsp & 0xf == 0
 #   rcx == NULL
 #
 # 0x4f322 execve("/bin/sh", rsp+0x40, environ)

data/lib/one_gadget/builds/libc-2.23-b5381a457906d279073822a5ceb24c4bfef94ddb.rb

@@ -1,5 +1,5 @@
 require 'one_gadget/gadget'
-# Ubuntu 16.04
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.23-0ubuntu10_amd64/lib/x86_64-linux-gnu/libc-2.23.so
 # 
 # Advanced Micro Devices X86-64
 # 
@@ -25,6 +25,12 @@ OneGadget::Gadget.add(build_id, 283158,
 OneGadget::Gadget.add(build_id, 283242,
                       constraints: ["[rsp+0x30] == NULL"],
                       effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
+OneGadget::Gadget.add(build_id, 839923,
+                      constraints: ["[rcx] == NULL || rcx == NULL", "[r12] == NULL || r12 == NULL"],
+                      effect: "execve(\"/bin/sh\", rcx, r12)")
+OneGadget::Gadget.add(build_id, 840136,
+                      constraints: ["[rax] == NULL || rax == NULL", "[r12] == NULL || r12 == NULL"],
+                      effect: "execve(\"/bin/sh\", rax, r12)")
 OneGadget::Gadget.add(build_id, 983716,
                       constraints: ["[rsp+0x50] == NULL"],
                       effect: "execve(\"/bin/sh\", rsp+0x50, environ)")
@@ -34,4 +40,7 @@ OneGadget::Gadget.add(build_id, 983728,
 OneGadget::Gadget.add(build_id, 987463,
                       constraints: ["[rsp+0x70] == NULL"],
                       effect: "execve(\"/bin/sh\", rsp+0x70, environ)")
+OneGadget::Gadget.add(build_id, 1009392,
+                      constraints: ["[rcx] == NULL || rcx == NULL", "[[rbp-0xf8]] == NULL || [rbp-0xf8] == NULL"],
+                      effect: "execve(\"/bin/sh\", rcx, [rbp-0xf8])")
 

data/lib/one_gadget/builds/libc-2.23-dd5192a769e33ed6ca68a6ab5740ff9e8ec678a7.rb

@@ -1,5 +1,5 @@
 require 'one_gadget/gadget'
-# Ubuntu 16.04
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.23-0ubuntu10_i386/lib/i386-linux-gnu/libc-2.23.so
 # 
 # Intel 80386
 # 

data/lib/one_gadget/builds/libc-2.24-0f523a27b7460f50befd3d281238c6f189c92d84.rb

@@ -1,5 +1,5 @@
 require 'one_gadget/gadget'
-# ubuntu17.04-lib32-libc-2.24.so
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-i386_2.24-9ubuntu2.2_amd64/lib32/libc-2.24.so
 # 
 # Intel 80386
 # 

data/lib/one_gadget/builds/libc-2.24-aad7dbe330f23ea00ca63daf793b766b51aceb5d.rb

@@ -1,5 +1,5 @@
 require 'one_gadget/gadget'
-# ubuntu17.04-lib-x86_64-linux-gnu-libc-2.24.so
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.24-9ubuntu2.2_amd64/lib/x86_64-linux-gnu/libc-2.24.so
 # 
 # Advanced Micro Devices X86-64
 # 

data/lib/one_gadget/builds/libc-2.24-fd0655c4d2073eda4235084e1d0e558f0251be8a.rb

@@ -1,5 +1,5 @@
 require 'one_gadget/gadget'
-# spec/data/aarch64-libc-2.24.so
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/aarch64-linux-gnu-glibc-2.24-1-any.pkg.tar/usr/aarch64-linux-gnu/lib/libc-2.24.so
 # 
 # AArch64
 # 

data/lib/one_gadget/builds/libc-2.26-ddcc13122ddbfe5e5ef77d4ebe66d124ae5762c2.rb

@@ -1,5 +1,5 @@
 require 'one_gadget/gadget'
-# ubuntu17.10-libc-2.26.so
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.26-0ubuntu2.1_amd64/lib/x86_64-linux-gnu/libc-2.26.so
 # 
 # Advanced Micro Devices X86-64
 # 

data/lib/one_gadget/builds/libc-2.26-f65648a832414f2144ce795d75b6045a1ec2e252.rb

@@ -1,5 +1,5 @@
 require 'one_gadget/gadget'
-# ubuntu17.10-libc-2.26.so
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-i386_2.26-0ubuntu2.1_amd64/lib32/libc-2.26.so
 # 
 # Intel 80386
 # 

data/lib/one_gadget/builds/libc-2.27-63b3d43ad45e1b0f601848c65b067f9e9b40528b.rb

@@ -1,5 +1,5 @@
 require 'one_gadget/gadget'
-# spec/data/libc-2.27-63b3d43ad45e1b0f601848c65b067f9e9b40528b.so
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-i386_2.27-3ubuntu1_amd64/lib32/libc-2.27.so
 # 
 # Intel 80386
 # 

data/lib/one_gadget/builds/libc-2.27-b417c0ba7cc5cf06d1d1bed6652cedb9253c60d0.rb

@@ -1,5 +1,5 @@
 require 'one_gadget/gadget'
-# spec/data/libc-2.27-b417c0ba7cc5cf06d1d1bed6652cedb9253c60d0.so
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.27-3ubuntu1_amd64/lib/x86_64-linux-gnu/libc-2.27.so
 # 
 # Advanced Micro Devices X86-64
 # 
@@ -15,7 +15,7 @@ require 'one_gadget/gadget'
 
 build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 324293,
-                      constraints: ["rcx == NULL"],
+                      constraints: ["rsp & 0xf == 0", "rcx == NULL"],
                       effect: "execve(\"/bin/sh\", rsp+0x40, environ)")
 OneGadget::Gadget.add(build_id, 324386,
                       constraints: ["[rsp+0x40] == NULL"],

data/lib/one_gadget/builds/libc-2.28-5b157f49586a3ca84d55837f97ff466767dd3445.rb

@@ -15,7 +15,7 @@ require 'one_gadget/gadget'
 
 build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 328070,
-                      constraints: ["rcx == NULL"],
+                      constraints: ["rsp & 0xf == 0", "rcx == NULL"],
                       effect: "execve(\"/bin/sh\", rsp+0x40, environ)")
 OneGadget::Gadget.add(build_id, 328163,
                       constraints: ["[rsp+0x40] == NULL"],

data/lib/one_gadget/cli.rb

@@ -12,7 +12,7 @@ module OneGadget
     # Help message.
     USAGE = 'Usage: one_gadget <FILE|-b BuildID> [options]'
     # Default options.
-    DEFAULT_OPTIONS = { raw: false, force_file: false, level: 0 }.freeze
+    DEFAULT_OPTIONS = { raw: false, force_file: false, level: 0, base: 0 }.freeze
 
     module_function
 
@@ -53,6 +53,7 @@ module OneGadget
                 else # libc_file
                   OneGadget.gadgets(file: libc_file, details: true, force_file: @options[:force_file], level: level)
                 end
+      gadgets.each { |g| g.base = @options[:base] }
       handle_gadgets(gadgets, libc_file)
     end
 
@@ -136,6 +137,10 @@ module OneGadget
           @options[:info] = b
         end
 
+        opts.on('--base BASE_ADDRESS', Integer, 'The base address of libc.', 'Default: 0') do |b|
+          @options[:base] = b
+        end
+
         opts.on('--version', 'Current gem version.') do |v|
           @options[:version] = v
         end
@@ -176,7 +181,7 @@ module OneGadget
     # @return [true]
     def display_gadgets(gadgets, raw)
       if raw
-        show(gadgets.map(&:offset).join(' '))
+        show(gadgets.map(&:value).join(' '))
       else
         show(gadgets.map(&:inspect).join("\n"))
       end

data/lib/one_gadget/emulators/lambda.rb

@@ -38,20 +38,20 @@ module OneGadget
         ret
       end
 
-      # Implement substract with +Numeric+.
+      # Implement subtract with +Numeric+.
       # @param [Numeric] other Value to substract.
       # @return [Lambda] The result.
       def -(other)
         self.+(-other)
       end
 
-      # Increase dreference count with 1.
+      # Increase dereference count with 1.
       # @return [void]
       def deref!
         @deref_count += 1
       end
 
-      # Decrease dreference count with 1.
+      # Decrease dereference count with 1.
       # @return [self]
       # @raise [Error::InstrutionArgumentError] When this object cannot be referenced anymore.
       def ref!
@@ -102,7 +102,7 @@ module OneGadget
         # Target: parse string like <tt>[rsp+0x50]</tt> into a {Lambda} object.
         # @param [String] argument
         # @param [Hash{String => Lambda}] predefined
-        #   Predfined values.
+        #   Predefined values.
         # @return [OneGadget::Emulators::Lambda, Integer]
         #   If +argument+ contains number only, returns the value.
         #   Otherwise, returns a {Lambda} object.

data/lib/one_gadget/emulators/processor.rb

@@ -83,9 +83,15 @@ module OneGadget
       def constraints
         return [] if @constraints.empty?
 
-        # currently only ':writable' type
-        cons = @constraints.uniq { |_type, obj| obj.deref_count.zero? ? obj.obj.to_s : obj.to_s }
-        cons.map { |_type, obj| "writable: #{obj}" }.sort
+        # we have these types:
+        # * :writable
+        # * :raw
+        cons = @constraints.uniq do |type, obj|
+          next obj unless type == :writable
+
+          obj.deref_count.zero? ? obj.obj.to_s : obj.to_s
+        end
+        cons.map { |type, obj| type == :writable ? "writable: #{obj}" : obj }.sort
       end
 
       private

data/lib/one_gadget/emulators/x86.rb

@@ -70,15 +70,15 @@ module OneGadget
       # This instruction moves 128bits.
       def inst_movaps(dst, src)
         # XXX: here we only support `movaps [sp+*], xmm*`
-        # TODO: This need an extra constraint: sp & 0xf == 0
         src, dst = check_xmm_sp(src, dst) { raise_unsupported('movaps', dst, src) }
         off = dst.evaluate(eval_dict)
+        @constraints << [:raw, "#{sp} & 0xf == #{0x10 - off & 0xf}"]
         (128 / self.class.bits).times do |i|
           stack[off + i * size_t] = src[i]
         end
       end
 
-      # Mov *src to dst[:64]
+      # Move *src to dst[:64]
       def inst_movq(dst, src)
         # XXX: here we only support `movq xmm*, [sp+*]`
         dst, src = check_xmm_sp(dst, src) { raise_unsupported('movq', dst, src) }

data/lib/one_gadget/error.rb

@@ -15,7 +15,7 @@ module OneGadget
     class UnsupportedInstructionError < UnsupportedError
     end
 
-    # Raises when arguments form of an instrution is invalid.
+    # Raises when arguments form of an instruction is invalid.
     class InstructionArgumentError < Error
     end
 

data/lib/one_gadget/fetchers/i386.rb

@@ -35,7 +35,7 @@ module OneGadget
         res = super
         return if res.nil?
 
-        # unshift got constraint into cons
+        # unshift GOT constraint into cons
         res[:constraints].unshift("#{@base_reg} is the GOT address of libc")
         res
       end

data/lib/one_gadget/gadget.rb

@@ -9,6 +9,8 @@ module OneGadget
   module Gadget
     # Information of a gadget.
     class Gadget
+      # @return [Integer] Base address of libc. Default: 0.
+      attr_accessor :base
       # @return [Integer] The gadget's address offset.
       attr_reader :offset
       # @return [Array<String>] The constraints need for this gadget.
@@ -23,6 +25,7 @@ module OneGadget
       # @example
       #   OneGadget::Gadget::Gadget.new(0x12345, constraints: ['rax == 0'])
       def initialize(offset, **options)
+        @base = 0
         @offset = offset
         @constraints = options[:constraints] || []
         @effect = options[:effect]
@@ -30,7 +33,7 @@ module OneGadget
 
       # Show gadget in a pretty way.
       def inspect
-        str = OneGadget::Helper.hex(offset)
+        str = OneGadget::Helper.hex(value)
         str += effect ? " #{effect}\n" : "\n"
         unless constraints.empty?
           str += "#{OneGadget::Helper.colorize('constraints')}:\n  "
@@ -43,6 +46,12 @@ module OneGadget
         str + "\n"
       end
 
+      # @return [Integer]
+      #   Returns +base+ plus +offset+.
+      def value
+        base + offset
+      end
+
       # @return [Float]
       #   The success probability of the constraints.
       def score
@@ -58,16 +67,21 @@ module OneGadget
       # Expr: <REG> is the GOT address of libc
       # Expr: writable: <Identity>
       # Expr: <Identity> == NULL
+      # Expr: <REG> & 0xf == <IMM>
       # Expr: <Expr> || <Expr>
       def calculate_score(cons)
         return cons.split(' || ').map(&method(:calculate_score)).max if cons.include?(' || ')
-        return 0.9 if cons.include?('GOT address')
-        return 0.81 if cons.include?('writable')
 
-        expr = cons.gsub(' == NULL', ' == 0')
-        # raise Error::ArgumentError, cons unless expr.end_with?(' == 0')
+        case cons
+        when / & 0xf/ then 0.95
+        when /GOT address/ then 0.9
+        when /^writable/ then 0.81
+        when / == NULL$/ then calculate_null_score(cons)
+        end
+      end
 
-        identity = expr.slice(0...expr.rindex(' == 0'))
+      def calculate_null_score(cons)
+        identity = cons.slice(0...cons.rindex(' == NULL'))
         # Thank God we are already able to parse this
         lmda = OneGadget::Emulators::Lambda.parse(identity)
         # raise Error::ArgumentError, cons unless OneGadget::ABI.all.include?(lmda.obj)

data/lib/one_gadget/helper.rb

@@ -187,7 +187,7 @@ module OneGadget
       nil
     end
 
-    # Fetch the ELF archiecture of +file+.
+    # Fetch the ELF architecture of +file+.
     # @param [String] file The target ELF filename.
     # @return [Symbol]
     #   Currently supports amd64, i386, arm, aarch64, and mips.

data/lib/one_gadget/one_gadget.rb

@@ -59,7 +59,7 @@ module OneGadget
       OneGadget::Fetcher.from_build_id(build_id, remote: false)
     end
 
-    # Remove hard-to-reach-constrains gadgets according to level
+    # Remove hard-to-reach-constraints gadgets according to level
     def refine_gadgets(gadgets, level)
       return [] if gadgets.empty?
       return gadgets if level.positive? # currently only supports level > 0 or not

data/lib/one_gadget/version.rb

@@ -2,5 +2,5 @@
 
 module OneGadget
   # Current gem version.
-  VERSION = '1.7.2'
+  VERSION = '1.7.3'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: one_gadget
 version: !ruby/object:Gem::Version
-  version: 1.7.2
+  version: 1.7.3
 platform: ruby
 authors:
 - david942j
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-05-05 00:00:00.000000000 Z
+date: 2019-10-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: elftools
@@ -36,14 +36,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12.3'
+        version: '13.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12.3'
+        version: '13.0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -78,14 +78,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.16.1
+        version: 0.17.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.16.1
+        version: 0.17.0
 - !ruby/object:Gem::Dependency
   name: yard
   requirement: !ruby/object:Gem::Requirement