one_gadget 1.7.4 → 1.8.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (120) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +2 -1
  3. data/lib/one_gadget/abi.rb +2 -2
  4. data/lib/one_gadget/builds/libc-2.19-df559a150829d9f3cdd0b5ce1e5b4d512d20f55f.rb +1 -1
  5. data/lib/one_gadget/builds/libc-2.20-398115bd423958b1769317a6f7e4928df141eb57.rb +1 -1
  6. data/lib/one_gadget/builds/libc-2.20-f3063b7115d5a383189937852ce356f4c60fd190.rb +1 -1
  7. data/lib/one_gadget/builds/libc-2.21-9ac81172d5ff96f40d984fe7c10073a98f1a6b2e.rb +1 -1
  8. data/lib/one_gadget/builds/libc-2.21-f0c24219cbba0605e39e02123398437c5dbbb104.rb +1 -1
  9. data/lib/one_gadget/builds/libc-2.22-b916e3c1d80069d0209f6376b33e42b75ec49eda.rb +1 -1
  10. data/lib/one_gadget/builds/libc-2.23-18f761287ed46e213bec29c2e440e73fd72373be.rb +46 -0
  11. data/lib/one_gadget/builds/libc-2.23-30773be8cf5bfed9d910c8473dd44eaab2e705ab.rb +46 -0
  12. data/lib/one_gadget/builds/libc-2.23-635101aec7213fdc442419bf65a92047a862ff32.rb +46 -0
  13. data/lib/one_gadget/builds/libc-2.23-f2f2f2af4f3e8597cca1fdff1008a834c78de42b.rb +43 -0
  14. data/lib/one_gadget/builds/libc-2.24-349119af9e223829ea24f6b7226bdff0182e73f2.rb +49 -0
  15. data/lib/one_gadget/builds/libc-2.24-3fce81d490804af9759c70bf197380bc05a584c2.rb +46 -0
  16. data/lib/one_gadget/builds/libc-2.24-a51ace667ccae6a8887837efb18259a906704bed.rb +46 -0
  17. data/lib/one_gadget/builds/libc-2.24-deefae132c5a39ba892bc189edd91f73c1ea1f14.rb +37 -0
  18. data/lib/one_gadget/builds/libc-2.25-58c735bc7b19b0aeb395cce70cf63bd62ac75e4a.rb +9 -0
  19. data/lib/one_gadget/builds/libc-2.26-1c39b3b3faa2a2cbb0fa0b6845b29332562262d3.rb +9 -0
  20. data/lib/one_gadget/builds/libc-2.26-6d2b609f0c8e7b338f767b08c5ac712fac809d31.rb +9 -0
  21. data/lib/one_gadget/builds/libc-2.26-ddcc13122ddbfe5e5ef77d4ebe66d124ae5762c2.rb +9 -0
  22. data/lib/one_gadget/builds/libc-2.26-fb587bc4429e7d1b0de31a3b9ee8ae78ee797eb0.rb +9 -0
  23. data/lib/one_gadget/builds/libc-2.27-14cd15d2eb0bc25c89045873cf807f7533e4788d.rb +47 -0
  24. data/lib/one_gadget/builds/libc-2.27-71f0f3074a929e519e85f6a5c03a7d1fd976bfe4.rb +44 -0
  25. data/lib/one_gadget/builds/libc-2.27-73cd526a553b3b47c6dd0d6dc62175263cdc646e.rb +35 -0
  26. data/lib/one_gadget/builds/libc-2.27-9dd0bb57f81671704475d1e5163405f7b4d4b454.rb +3 -0
  27. data/lib/one_gadget/builds/libc-2.27-a5e88eb34369fb48113b9eda7a92e07b372f3cb7.rb +35 -0
  28. data/lib/one_gadget/builds/libc-2.27-ba63c4a5f5c2b51e6e7e5df94017dc98b20e397a.rb +47 -0
  29. data/lib/one_gadget/builds/libc-2.27-ce450eb01a5e5acc7ce7b8c2633b02cc1093339e.rb +44 -0
  30. data/lib/one_gadget/builds/libc-2.27-d1237c55f6778f53b369cf22ff81979b2fe340bb.rb +3 -0
  31. data/lib/one_gadget/builds/libc-2.27-d831493b564a8632d1da5cc0fe44af45713cfeb6.rb +47 -0
  32. data/lib/one_gadget/builds/libc-2.27-f4929d2a8af4629477103af6f1cfb3bebce80883.rb +47 -0
  33. data/lib/one_gadget/builds/libc-2.28-5b157f49586a3ca84d55837f97ff466767dd3445.rb +12 -0
  34. data/lib/one_gadget/builds/libc-2.28-65ed813688b116fdce9e866ad2fef2e734167337.rb +44 -0
  35. data/lib/one_gadget/builds/libc-2.28-6ee9454b96efa9e343f9e8105f2fa4529265ea05.rb +6 -0
  36. data/lib/one_gadget/builds/libc-2.29-5b7203920d3d786ac40af8e0d5104683335f11be.rb +50 -0
  37. data/lib/one_gadget/builds/libc-2.29-85d5020664b11fd2708859275de41d5ab9d104cf.rb +18 -0
  38. data/lib/one_gadget/builds/libc-2.29-a8af6c81cb28a37bf3a546970bf64224402f8bd4.rb +50 -0
  39. data/lib/one_gadget/builds/libc-2.29-c19c88c33b60742ca906e0f9f96fe31b8b79ea9c.rb +50 -0
  40. data/lib/one_gadget/builds/libc-2.29-d561ec515222887a1e004555981169199d841024.rb +27 -0
  41. data/lib/one_gadget/builds/libc-2.30-2155f455ad56bd871c8225bcca85ee25c1c197c4.rb +36 -0
  42. data/lib/one_gadget/builds/libc-2.30-33d1f350f13728651d74dd2a56bad1e4e4648f5e.rb +50 -0
  43. data/lib/one_gadget/builds/libc-2.30-7a1e2ae26cef50584af2c60a5ad3a7ae3e9b1446.rb +50 -0
  44. data/lib/one_gadget/builds/libc-2.30-cbe9cff3c43b979739af1681b61a3d585725577b.rb +36 -0
  45. data/lib/one_gadget/builds/libc-2.30-f07144cc3d0ac50415f3a2e061be6da672c914ba.rb +18 -0
  46. data/lib/one_gadget/builds/libc-2.30-f44469d65b4efd2e5951513ed7cbf773657f1283.rb +18 -0
  47. data/lib/one_gadget/builds/libc-2.31-012f3f1e614cb9c829b8d1590d228cc6a9506a03.rb +26 -0
  48. data/lib/one_gadget/builds/libc-2.31-099b9225bcb0d019d9d60884be583eb31bb5f44e.rb +80 -0
  49. data/lib/one_gadget/builds/libc-2.31-0d1b3211736c4ca528a32ea0d565d41a2ede3b58.rb +56 -0
  50. data/lib/one_gadget/builds/libc-2.31-12e412d1938ec3ff79751f0e85f31bc52f7e3722.rb +56 -0
  51. data/lib/one_gadget/builds/libc-2.31-2886817dc06a87bdeef50544c0d6c12de13a8148.rb +56 -0
  52. data/lib/one_gadget/builds/libc-2.31-4d4d0853eb075b8b0cfaee0aee7cdf4254a3e877.rb +56 -0
  53. data/lib/one_gadget/builds/libc-2.31-58a58f2fcdafddacb4a08439ea2ee163ff645d1d.rb +26 -0
  54. data/lib/one_gadget/builds/libc-2.31-634252e0c5f8b03957a2e529719d4101699a894a.rb +48 -0
  55. data/lib/one_gadget/builds/libc-2.31-6b143503744b9d6c22e479941488d6a9e6e3f1c5.rb +26 -0
  56. data/lib/one_gadget/builds/libc-2.31-6dbad1709854c527793f6401666e45a791b7c793.rb +56 -0
  57. data/lib/one_gadget/builds/libc-2.31-85d7bb2dad0f8172d1c02c0311a00c4695933beb.rb +26 -0
  58. data/lib/one_gadget/builds/libc-2.31-8629fa2eea681f639a0c18305d4548850dde3450.rb +26 -0
  59. data/lib/one_gadget/builds/libc-2.31-94761ae31db09ce9140ca55cb6986a5ea9110abc.rb +56 -0
  60. data/lib/one_gadget/builds/libc-2.31-9fdb74e7b217d06c93172a8243f8547f947ee6d1.rb +80 -0
  61. data/lib/one_gadget/builds/libc-2.31-c9d56de82ddd00d822d6100034f3075ef1709cd2.rb +80 -0
  62. data/lib/one_gadget/builds/libc-2.31-e67e80e70619717709e3180e552a11a285036a54.rb +56 -0
  63. data/lib/one_gadget/builds/libc-2.31-eb3c5cf73a0a6b7f2b3895a56dbc443806700971.rb +30 -0
  64. data/lib/one_gadget/builds/libc-2.31-fb7626dd8b8a50f7685920487e992528834f6775.rb +26 -0
  65. data/lib/one_gadget/builds/libc-2.32-1e3fb06b8c86b5e282e3e11bd207d399fb4952e2.rb +83 -0
  66. data/lib/one_gadget/builds/libc-2.32-7ec3e74da842ca3c6a9ba20b21303ce1bc7a45af.rb +51 -0
  67. data/lib/one_gadget/builds/libc-2.32-7fba7abef941659c229c2636aa0905c28652ee3f.rb +56 -0
  68. data/lib/one_gadget/builds/libc-2.32-82f6b69e698bb579baefb35a3fb0346632fa2c4d.rb +83 -0
  69. data/lib/one_gadget/builds/libc-2.32-87f011a7e4cc3fc60a54d0d3dd690e7438decc8d.rb +56 -0
  70. data/lib/one_gadget/builds/libc-2.32-92199dd358616182fb49c992330fb05e42eaa423.rb +26 -0
  71. data/lib/one_gadget/builds/libc-2.32-9d60d4bd625a7fe2439db781a5fc91bb69684903.rb +26 -0
  72. data/lib/one_gadget/builds/libc-2.32-ac287babd169c70013b752da2713dfb96d9a503f.rb +83 -0
  73. data/lib/one_gadget/builds/libc-2.32-aebd80372a00285a5c486ef72917f935eb8f91be.rb +26 -0
  74. data/lib/one_gadget/builds/libc-2.32-bd0e9dc4e27475b5ab7dc59141daaa2626b8a760.rb +26 -0
  75. data/lib/one_gadget/builds/libc-2.32-bddeb6374fc99723cef3b3baafe48ac78fce13b4.rb +26 -0
  76. data/lib/one_gadget/builds/libc-2.32-cb91dd613d38b806a16bed1b364c084ad63d1a1f.rb +56 -0
  77. data/lib/one_gadget/builds/libc-2.32-d3f1cf7f55b985fd6d989880ec3599724fe40a26.rb +26 -0
  78. data/lib/one_gadget/builds/libc-2.32-e13b24f94b260dd6394bdb2433d2a78e37078d5c.rb +30 -0
  79. data/lib/one_gadget/builds/libc-2.32-e1596c76d0d93d8a36378ba976f034f140618d59.rb +56 -0
  80. data/lib/one_gadget/builds/libc-2.32-f45b67ab28af1581cba8e4713e0fd3b2bc004b2e.rb +56 -0
  81. data/lib/one_gadget/builds/libc-2.33-18edf6b683a2f9768cc0ee9cc64ae6fbb545deb2.rb +83 -0
  82. data/lib/one_gadget/builds/libc-2.33-1c943bf313b5b4546e47b830e70de6bbd6a0ba57.rb +26 -0
  83. data/lib/one_gadget/builds/libc-2.33-2b48299781548c9bc452eac6df39902547c884ed.rb +83 -0
  84. data/lib/one_gadget/builds/libc-2.33-37169e68b33cad12e272bb4896d71fd0d4fd98bb.rb +56 -0
  85. data/lib/one_gadget/builds/libc-2.33-54a6e404e7dc1de7c1434a00b7b1ad325b81f22a.rb +56 -0
  86. data/lib/one_gadget/builds/libc-2.33-7983d313db4a441a3762c8861ca405aa0331c0c8.rb +56 -0
  87. data/lib/one_gadget/builds/libc-2.33-8fdc2b2c65f3d782e52c01b546399eee8aa466dc.rb +26 -0
  88. data/lib/one_gadget/builds/libc-2.33-9143da129b44b931a1c180e2b103e993dd2474fd.rb +26 -0
  89. data/lib/one_gadget/builds/libc-2.33-97c8d90bd86bc698d156630e8803de433a640090.rb +83 -0
  90. data/lib/one_gadget/builds/libc-2.33-9bf4c513db255ab7248cef9f0f96b4403df29852.rb +56 -0
  91. data/lib/one_gadget/builds/libc-2.33-9e592d3efa165bc2bab8b40426370bd50cb0b027.rb +56 -0
  92. data/lib/one_gadget/builds/libc-2.33-abf3b2a9815c0cd6e4280cd99474d34102804eb2.rb +56 -0
  93. data/lib/one_gadget/builds/libc-2.33-b046eecd056a0c30995703f6cfca7a8e3a9ef5fa.rb +56 -0
  94. data/lib/one_gadget/builds/libc-2.33-b2262bfa6f1bffd1e9ddc845276dfaebb7c8f0b9.rb +26 -0
  95. data/lib/one_gadget/builds/libc-2.33-f462ab2b79c7f29fb866da6e087e45261570a09c.rb +26 -0
  96. data/lib/one_gadget/builds/libc-2.33-f4af69206091c7f14a941f2dd77a79a7682a1184.rb +26 -0
  97. data/lib/one_gadget/builds/libc-2.34-140609514178a4bb96a3cd44ffdfede398a77610.rb +26 -0
  98. data/lib/one_gadget/builds/libc-2.34-25594d4b6cbecda86ec968fa940c6c09937db70f.rb +50 -0
  99. data/lib/one_gadget/builds/libc-2.34-387920279e1c7892042ff27d76315d55e4651db9.rb +26 -0
  100. data/lib/one_gadget/builds/libc-2.34-7e46fbc4d85f5df8b6f18630787ad281786a3512.rb +26 -0
  101. data/lib/one_gadget/builds/libc-2.34-8d631c824a37b236d1dc9686b224a573fd6048b4.rb +26 -0
  102. data/lib/one_gadget/builds/libc-2.34-b8037b6260865346802321dd2256b8ad1d857e63.rb +68 -0
  103. data/lib/one_gadget/builds/libc-2.34-ba4777827fe1fb729ca35acd99c8013936172a0d.rb +50 -0
  104. data/lib/one_gadget/builds/libc-2.34-f0fc29165cbe6088c0e1adf03b0048fbecbc003a.rb +68 -0
  105. data/lib/one_gadget/builds/libc-2.35-89c3cb85f9e55046776471fed05ec441581d1969.rb +62 -0
  106. data/lib/one_gadget/builds/libc-2.35-ab265082cac9486923c709d48ee5dde080e243ff.rb +41 -0
  107. data/lib/one_gadget/builds/libc-2.35-c376d41cff4473142a97ac1ff1eab433859dc3d4.rb +26 -0
  108. data/lib/one_gadget/builds/libc-2.35-dfca8b65dd2d2ca67f70dc7a556a6cfa8ba96ed8.rb +26 -0
  109. data/lib/one_gadget/cli.rb +1 -1
  110. data/lib/one_gadget/emulators/aarch64.rb +7 -8
  111. data/lib/one_gadget/emulators/amd64.rb +3 -0
  112. data/lib/one_gadget/emulators/lambda.rb +12 -4
  113. data/lib/one_gadget/emulators/processor.rb +9 -1
  114. data/lib/one_gadget/emulators/x86.rb +42 -19
  115. data/lib/one_gadget/fetchers/amd64.rb +2 -1
  116. data/lib/one_gadget/fetchers/base.rb +65 -34
  117. data/lib/one_gadget/gadget.rb +9 -5
  118. data/lib/one_gadget/update.rb +2 -2
  119. data/lib/one_gadget/version.rb +1 -1
  120. metadata +91 -5
@@ -0,0 +1,26 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/david942j/libcdb/blob/master/libc/libc6_2.31-0ubuntu9.2_i386/lib/i386-linux-gnu/libc-2.31.so
3
+ #
4
+ # Intel 80386
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.31-0ubuntu9.2) stable release version 2.31.
7
+ # Copyright (C) 2020 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 9.3.0.
12
+ # libc ABIs: UNIQUE IFUNC ABSOLUTE
13
+ # For bug reporting instructions, please see:
14
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
15
+
16
+ build_id = File.basename(__FILE__, '.rb').split('-').last
17
+ OneGadget::Gadget.add(build_id, 842827,
18
+ constraints: ["ebx is the GOT address of libc", "writable: ebp-0x20", "[[ebp-0x2c]] == NULL || [ebp-0x2c] == NULL", "[esi] == NULL || esi == NULL"],
19
+ effect: "execve(\"/bin/sh\", [ebp-0x2c], esi)")
20
+ OneGadget::Gadget.add(build_id, 1345531,
21
+ constraints: ["ebp is the GOT address of libc", "eax == NULL"],
22
+ effect: "execl(\"/bin/sh\", eax)")
23
+ OneGadget::Gadget.add(build_id, 1345532,
24
+ constraints: ["ebp is the GOT address of libc", "[esp] == NULL"],
25
+ effect: "execl(\"/bin/sh\", [esp])")
26
+
@@ -0,0 +1,83 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/david942j/libcdb/blob/master/libc/libc6_2.32-0ubuntu6_amd64/lib/x86_64-linux-gnu/libc-2.32.so
3
+ #
4
+ # Advanced Micro Devices X86-64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.32-0ubuntu6) stable release version 2.32.
7
+ # Copyright (C) 2020 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 10.2.1 20201207.
12
+ # libc ABIs: UNIQUE IFUNC ABSOLUTE
13
+ # For bug reporting instructions, please see:
14
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
15
+
16
+ build_id = File.basename(__FILE__, '.rb').split('-').last
17
+ OneGadget::Gadget.add(build_id, 327023,
18
+ constraints: ["rsp & 0xf == 0", "rcx == NULL", "rbp == NULL || (u16)[rbp] == NULL"],
19
+ effect: "posix_spawn(rsp+0xc, \"/bin/sh\", 0, rbp, rsp+0x50, environ)")
20
+ OneGadget::Gadget.add(build_id, 327035,
21
+ constraints: ["rsp & 0xf == 0", "(u64)xmm0 == NULL", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rbp == NULL || (u16)[rbp] == NULL"],
22
+ effect: "posix_spawn(rsp+0xc, \"/bin/sh\", rdx, rbp, rsp+0x50, environ)")
23
+ OneGadget::Gadget.add(build_id, 327056,
24
+ constraints: ["rsp & 0xf == 0", "[r8] == NULL", "[[rax]] == NULL || [rax] == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rbp == NULL || (u16)[rbp] == NULL"],
25
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, rbp, r8, [rax])")
26
+ OneGadget::Gadget.add(build_id, 327064,
27
+ constraints: ["rsp & 0xf == 0", "[r8] == NULL", "[[rax]] == NULL || [rax] == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rcx == NULL || (u16)[rcx] == NULL"],
28
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, rcx, r8, [rax])")
29
+ OneGadget::Gadget.add(build_id, 526547,
30
+ constraints: ["rsp & 0xf == 0", "rcx == NULL", "rbx+0xe0 == NULL || writable: rbx+0xe0", "r12 == NULL || (s32)[r12+0x4] <= 0"],
31
+ effect: "posix_spawn(rbx+0xe0, \"/bin/sh\", r12, 0, rsp+0x60, environ)")
32
+ OneGadget::Gadget.add(build_id, 526560,
33
+ constraints: ["rsp & 0xf == 0", "rcx == NULL", "rbx+0xe0 == NULL || writable: rbx+0xe0", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
34
+ effect: "posix_spawn(rbx+0xe0, \"/bin/sh\", rdx, 0, rsp+0x60, environ)")
35
+ OneGadget::Gadget.add(build_id, 526572,
36
+ constraints: ["rsp & 0xf == 0", "(u64)xmm0 == NULL", "[[rax]] == NULL || [rax] == NULL", "rbx+0xe0 == NULL || writable: rbx+0xe0", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
37
+ effect: "posix_spawn(rbx+0xe0, \"/bin/sh\", rdx, 0, rsp+0x60, [rax])")
38
+ OneGadget::Gadget.add(build_id, 526585,
39
+ constraints: ["rsp & 0xf == 0", "(u64)xmm0 == NULL", "[[rax]] == NULL || [rax] == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rcx == NULL || (u16)[rcx] == NULL"],
40
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, rcx, rsp+0x60, [rax])")
41
+ OneGadget::Gadget.add(build_id, 914284,
42
+ constraints: ["[r15] == NULL || r15 == NULL", "[r12] == NULL || r12 == NULL"],
43
+ effect: "execve(\"/bin/sh\", r15, r12)")
44
+ OneGadget::Gadget.add(build_id, 914287,
45
+ constraints: ["[r15] == NULL || r15 == NULL", "[rdx] == NULL || rdx == NULL"],
46
+ effect: "execve(\"/bin/sh\", r15, rdx)")
47
+ OneGadget::Gadget.add(build_id, 914290,
48
+ constraints: ["[rsi] == NULL || rsi == NULL", "[rdx] == NULL || rdx == NULL"],
49
+ effect: "execve(\"/bin/sh\", rsi, rdx)")
50
+ OneGadget::Gadget.add(build_id, 914773,
51
+ constraints: ["writable: rbp-0x78", "[r10] == NULL || r10 == NULL", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL"],
52
+ effect: "execve(\"/bin/sh\", r10, [rbp-0x70])")
53
+ OneGadget::Gadget.add(build_id, 914777,
54
+ constraints: ["writable: rbp-0x78", "[r10] == NULL || r10 == NULL", "[rdx] == NULL || rdx == NULL"],
55
+ effect: "execve(\"/bin/sh\", r10, rdx)")
56
+ OneGadget::Gadget.add(build_id, 914886,
57
+ constraints: ["writable: rbp-0x48", "[rbp-0x50] == NULL || rbp-0x50 == NULL", "[r12] == NULL || r12 == NULL"],
58
+ effect: "execve(\"/bin/sh\", rbp-0x50, r12)")
59
+ OneGadget::Gadget.add(build_id, 914893,
60
+ constraints: ["writable: rbp-0x50", "[rbp-0x50] == NULL || rbp-0x50 == NULL", "[r12] == NULL || r12 == NULL"],
61
+ effect: "execve(\"/bin/sh\", rbp-0x50, r12)")
62
+ OneGadget::Gadget.add(build_id, 914955,
63
+ constraints: ["writable: rbp-0x48", "[rbp-0x50] == NULL || rbp-0x50 == NULL", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL"],
64
+ effect: "execve(\"/bin/sh\", rbp-0x50, [rbp-0x70])")
65
+ OneGadget::Gadget.add(build_id, 914962,
66
+ constraints: ["writable: rbp-0x50", "[rbp-0x50] == NULL || rbp-0x50 == NULL", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL"],
67
+ effect: "execve(\"/bin/sh\", rbp-0x50, [rbp-0x70])")
68
+ OneGadget::Gadget.add(build_id, 914966,
69
+ constraints: ["writable: r10+0x10", "writable: rbp-0x50", "[r10] == NULL || r10 == NULL", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL"],
70
+ effect: "execve(\"/bin/sh\", r10, [rbp-0x70])")
71
+ OneGadget::Gadget.add(build_id, 1056410,
72
+ constraints: ["[rsp+0x70] == NULL", "[[rsp+0xf0]] == NULL || [rsp+0xf0] == NULL", "[rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] <= 0"],
73
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", [rsp+0x38], 0, rsp+0x70, [rsp+0xf0])")
74
+ OneGadget::Gadget.add(build_id, 1056418,
75
+ constraints: ["[rsp+0x70] == NULL", "[r9] == NULL || r9 == NULL", "[rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] <= 0"],
76
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", [rsp+0x38], 0, rsp+0x70, r9)")
77
+ OneGadget::Gadget.add(build_id, 1056423,
78
+ constraints: ["[rsp+0x70] == NULL", "[r9] == NULL || r9 == NULL", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
79
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", rdx, 0, rsp+0x70, r9)")
80
+ OneGadget::Gadget.add(build_id, 1056433,
81
+ constraints: ["[r8] == NULL", "[r9] == NULL || r9 == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
82
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, 0, r8, r9)")
83
+
@@ -14,6 +14,30 @@ require 'one_gadget/gadget'
14
14
  # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
15
15
 
16
16
  build_id = File.basename(__FILE__, '.rb').split('-').last
17
+ OneGadget::Gadget.add(build_id, 327503,
18
+ constraints: ["rsp & 0xf == 0", "rcx == NULL", "rbp == NULL || (u16)[rbp] == NULL"],
19
+ effect: "posix_spawn(rsp+0xc, \"/bin/sh\", 0, rbp, rsp+0x50, environ)")
20
+ OneGadget::Gadget.add(build_id, 327515,
21
+ constraints: ["rsp & 0xf == 0", "(u64)xmm0 == NULL", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rbp == NULL || (u16)[rbp] == NULL"],
22
+ effect: "posix_spawn(rsp+0xc, \"/bin/sh\", rdx, rbp, rsp+0x50, environ)")
23
+ OneGadget::Gadget.add(build_id, 327536,
24
+ constraints: ["rsp & 0xf == 0", "[r8] == NULL", "[[rax]] == NULL || [rax] == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rbp == NULL || (u16)[rbp] == NULL"],
25
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, rbp, r8, [rax])")
26
+ OneGadget::Gadget.add(build_id, 327544,
27
+ constraints: ["rsp & 0xf == 0", "[r8] == NULL", "[[rax]] == NULL || [rax] == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rcx == NULL || (u16)[rcx] == NULL"],
28
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, rcx, r8, [rax])")
29
+ OneGadget::Gadget.add(build_id, 527027,
30
+ constraints: ["rsp & 0xf == 0", "rcx == NULL", "rbx+0xe0 == NULL || writable: rbx+0xe0", "r12 == NULL || (s32)[r12+0x4] <= 0"],
31
+ effect: "posix_spawn(rbx+0xe0, \"/bin/sh\", r12, 0, rsp+0x60, environ)")
32
+ OneGadget::Gadget.add(build_id, 527040,
33
+ constraints: ["rsp & 0xf == 0", "rcx == NULL", "rbx+0xe0 == NULL || writable: rbx+0xe0", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
34
+ effect: "posix_spawn(rbx+0xe0, \"/bin/sh\", rdx, 0, rsp+0x60, environ)")
35
+ OneGadget::Gadget.add(build_id, 527052,
36
+ constraints: ["rsp & 0xf == 0", "(u64)xmm0 == NULL", "[[rax]] == NULL || [rax] == NULL", "rbx+0xe0 == NULL || writable: rbx+0xe0", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
37
+ effect: "posix_spawn(rbx+0xe0, \"/bin/sh\", rdx, 0, rsp+0x60, [rax])")
38
+ OneGadget::Gadget.add(build_id, 527065,
39
+ constraints: ["rsp & 0xf == 0", "(u64)xmm0 == NULL", "[[rax]] == NULL || [rax] == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rcx == NULL || (u16)[rcx] == NULL"],
40
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, rcx, rsp+0x60, [rax])")
17
41
  OneGadget::Gadget.add(build_id, 914764,
18
42
  constraints: ["[r15] == NULL || r15 == NULL", "[r12] == NULL || r12 == NULL"],
19
43
  effect: "execve(\"/bin/sh\", r15, r12)")
@@ -29,4 +53,31 @@ OneGadget::Gadget.add(build_id, 915253,
29
53
  OneGadget::Gadget.add(build_id, 915257,
30
54
  constraints: ["writable: rbp-0x78", "[r10] == NULL || r10 == NULL", "[rdx] == NULL || rdx == NULL"],
31
55
  effect: "execve(\"/bin/sh\", r10, rdx)")
56
+ OneGadget::Gadget.add(build_id, 915366,
57
+ constraints: ["writable: rbp-0x48", "[rbp-0x50] == NULL || rbp-0x50 == NULL", "[r12] == NULL || r12 == NULL"],
58
+ effect: "execve(\"/bin/sh\", rbp-0x50, r12)")
59
+ OneGadget::Gadget.add(build_id, 915373,
60
+ constraints: ["writable: rbp-0x50", "[rbp-0x50] == NULL || rbp-0x50 == NULL", "[r12] == NULL || r12 == NULL"],
61
+ effect: "execve(\"/bin/sh\", rbp-0x50, r12)")
62
+ OneGadget::Gadget.add(build_id, 915435,
63
+ constraints: ["writable: rbp-0x48", "[rbp-0x50] == NULL || rbp-0x50 == NULL", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL"],
64
+ effect: "execve(\"/bin/sh\", rbp-0x50, [rbp-0x70])")
65
+ OneGadget::Gadget.add(build_id, 915442,
66
+ constraints: ["writable: rbp-0x50", "[rbp-0x50] == NULL || rbp-0x50 == NULL", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL"],
67
+ effect: "execve(\"/bin/sh\", rbp-0x50, [rbp-0x70])")
68
+ OneGadget::Gadget.add(build_id, 915446,
69
+ constraints: ["writable: r10+0x10", "writable: rbp-0x50", "[r10] == NULL || r10 == NULL", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL"],
70
+ effect: "execve(\"/bin/sh\", r10, [rbp-0x70])")
71
+ OneGadget::Gadget.add(build_id, 1056890,
72
+ constraints: ["[rsp+0x70] == NULL", "[[rsp+0xf0]] == NULL || [rsp+0xf0] == NULL", "[rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] <= 0"],
73
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", [rsp+0x38], 0, rsp+0x70, [rsp+0xf0])")
74
+ OneGadget::Gadget.add(build_id, 1056898,
75
+ constraints: ["[rsp+0x70] == NULL", "[r9] == NULL || r9 == NULL", "[rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] <= 0"],
76
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", [rsp+0x38], 0, rsp+0x70, r9)")
77
+ OneGadget::Gadget.add(build_id, 1056903,
78
+ constraints: ["[rsp+0x70] == NULL", "[r9] == NULL || r9 == NULL", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
79
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", rdx, 0, rsp+0x70, r9)")
80
+ OneGadget::Gadget.add(build_id, 1056913,
81
+ constraints: ["[r8] == NULL", "[r9] == NULL || r9 == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
82
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, 0, r8, r9)")
32
83
 
@@ -0,0 +1,56 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/david942j/libcdb/blob/master/libc/libc6-amd64_2.32-0ubuntu3.1_i386/lib64/libc-2.32.so
3
+ #
4
+ # Advanced Micro Devices X86-64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.32-0ubuntu3.1) release release version 2.32.
7
+ # Copyright (C) 2020 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 10.2.0.
12
+ # libc ABIs: UNIQUE IFUNC ABSOLUTE
13
+ # For bug reporting instructions, please see:
14
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
15
+
16
+ build_id = File.basename(__FILE__, '.rb').split('-').last
17
+ OneGadget::Gadget.add(build_id, 305881,
18
+ constraints: ["rax == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rcx == NULL || (u16)[rcx] == NULL"],
19
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, rcx, rsp+0x50, environ)")
20
+ OneGadget::Gadget.add(build_id, 305903,
21
+ constraints: ["[r8] == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rcx == NULL || (u16)[rcx] == NULL"],
22
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, rcx, r8, environ)")
23
+ OneGadget::Gadget.add(build_id, 490458,
24
+ constraints: ["[r8] == NULL", "rbx+0xe0 == NULL || writable: rbx+0xe0", "r12 == NULL || (s32)[r12+0x4] <= 0"],
25
+ effect: "posix_spawn(rbx+0xe0, \"/bin/sh\", r12, 0, r8, environ)")
26
+ OneGadget::Gadget.add(build_id, 490475,
27
+ constraints: ["[r8] == NULL", "rbx+0xe0 == NULL || writable: rbx+0xe0", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rcx == NULL || (u16)[rcx] == NULL"],
28
+ effect: "posix_spawn(rbx+0xe0, \"/bin/sh\", rdx, rcx, r8, environ)")
29
+ OneGadget::Gadget.add(build_id, 846702,
30
+ constraints: ["[r13] == NULL || r13 == NULL", "[r12] == NULL || r12 == NULL"],
31
+ effect: "execve(\"/bin/sh\", r13, r12)")
32
+ OneGadget::Gadget.add(build_id, 846705,
33
+ constraints: ["[r13] == NULL || r13 == NULL", "[rdx] == NULL || rdx == NULL"],
34
+ effect: "execve(\"/bin/sh\", r13, rdx)")
35
+ OneGadget::Gadget.add(build_id, 846708,
36
+ constraints: ["[rsi] == NULL || rsi == NULL", "[rdx] == NULL || rdx == NULL"],
37
+ effect: "execve(\"/bin/sh\", rsi, rdx)")
38
+ OneGadget::Gadget.add(build_id, 846798,
39
+ constraints: ["writable: rbp-0x38", "[rbp-0x40] == NULL || rbp-0x40 == NULL", "[r12] == NULL || r12 == NULL"],
40
+ effect: "execve(\"/bin/sh\", rbp-0x40, r12)")
41
+ OneGadget::Gadget.add(build_id, 846805,
42
+ constraints: ["writable: rbp-0x40", "[rbp-0x40] == NULL || rbp-0x40 == NULL", "[r12] == NULL || r12 == NULL"],
43
+ effect: "execve(\"/bin/sh\", rbp-0x40, r12)")
44
+ OneGadget::Gadget.add(build_id, 968906,
45
+ constraints: ["[rsp+0x70] == NULL", "[[rsp+0xf0]] == NULL || [rsp+0xf0] == NULL", "[rsp+0x40] == NULL || (s32)[[rsp+0x40]+0x4] <= 0"],
46
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", [rsp+0x40], 0, rsp+0x70, [rsp+0xf0])")
47
+ OneGadget::Gadget.add(build_id, 968914,
48
+ constraints: ["[rsp+0x70] == NULL", "[r9] == NULL || r9 == NULL", "[rsp+0x40] == NULL || (s32)[[rsp+0x40]+0x4] <= 0"],
49
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", [rsp+0x40], 0, rsp+0x70, r9)")
50
+ OneGadget::Gadget.add(build_id, 968919,
51
+ constraints: ["[rsp+0x70] == NULL", "[r9] == NULL || r9 == NULL", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
52
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", rdx, 0, rsp+0x70, r9)")
53
+ OneGadget::Gadget.add(build_id, 968929,
54
+ constraints: ["[r8] == NULL", "[r9] == NULL || r9 == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
55
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, 0, r8, r9)")
56
+
@@ -0,0 +1,83 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/david942j/libcdb/blob/master/libc/libc6_2.32-0ubuntu3.2_amd64/lib/x86_64-linux-gnu/libc-2.32.so
3
+ #
4
+ # Advanced Micro Devices X86-64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.32-0ubuntu3.2) release release version 2.32.
7
+ # Copyright (C) 2020 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 10.2.0.
12
+ # libc ABIs: UNIQUE IFUNC ABSOLUTE
13
+ # For bug reporting instructions, please see:
14
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
15
+
16
+ build_id = File.basename(__FILE__, '.rb').split('-').last
17
+ OneGadget::Gadget.add(build_id, 327503,
18
+ constraints: ["rsp & 0xf == 0", "rcx == NULL", "rbp == NULL || (u16)[rbp] == NULL"],
19
+ effect: "posix_spawn(rsp+0xc, \"/bin/sh\", 0, rbp, rsp+0x50, environ)")
20
+ OneGadget::Gadget.add(build_id, 327515,
21
+ constraints: ["rsp & 0xf == 0", "(u64)xmm0 == NULL", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rbp == NULL || (u16)[rbp] == NULL"],
22
+ effect: "posix_spawn(rsp+0xc, \"/bin/sh\", rdx, rbp, rsp+0x50, environ)")
23
+ OneGadget::Gadget.add(build_id, 327536,
24
+ constraints: ["rsp & 0xf == 0", "[r8] == NULL", "[[rax]] == NULL || [rax] == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rbp == NULL || (u16)[rbp] == NULL"],
25
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, rbp, r8, [rax])")
26
+ OneGadget::Gadget.add(build_id, 327544,
27
+ constraints: ["rsp & 0xf == 0", "[r8] == NULL", "[[rax]] == NULL || [rax] == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rcx == NULL || (u16)[rcx] == NULL"],
28
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, rcx, r8, [rax])")
29
+ OneGadget::Gadget.add(build_id, 527027,
30
+ constraints: ["rsp & 0xf == 0", "rcx == NULL", "rbx+0xe0 == NULL || writable: rbx+0xe0", "r12 == NULL || (s32)[r12+0x4] <= 0"],
31
+ effect: "posix_spawn(rbx+0xe0, \"/bin/sh\", r12, 0, rsp+0x60, environ)")
32
+ OneGadget::Gadget.add(build_id, 527040,
33
+ constraints: ["rsp & 0xf == 0", "rcx == NULL", "rbx+0xe0 == NULL || writable: rbx+0xe0", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
34
+ effect: "posix_spawn(rbx+0xe0, \"/bin/sh\", rdx, 0, rsp+0x60, environ)")
35
+ OneGadget::Gadget.add(build_id, 527052,
36
+ constraints: ["rsp & 0xf == 0", "(u64)xmm0 == NULL", "[[rax]] == NULL || [rax] == NULL", "rbx+0xe0 == NULL || writable: rbx+0xe0", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
37
+ effect: "posix_spawn(rbx+0xe0, \"/bin/sh\", rdx, 0, rsp+0x60, [rax])")
38
+ OneGadget::Gadget.add(build_id, 527065,
39
+ constraints: ["rsp & 0xf == 0", "(u64)xmm0 == NULL", "[[rax]] == NULL || [rax] == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rcx == NULL || (u16)[rcx] == NULL"],
40
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, rcx, rsp+0x60, [rax])")
41
+ OneGadget::Gadget.add(build_id, 914764,
42
+ constraints: ["[r15] == NULL || r15 == NULL", "[r12] == NULL || r12 == NULL"],
43
+ effect: "execve(\"/bin/sh\", r15, r12)")
44
+ OneGadget::Gadget.add(build_id, 914767,
45
+ constraints: ["[r15] == NULL || r15 == NULL", "[rdx] == NULL || rdx == NULL"],
46
+ effect: "execve(\"/bin/sh\", r15, rdx)")
47
+ OneGadget::Gadget.add(build_id, 914770,
48
+ constraints: ["[rsi] == NULL || rsi == NULL", "[rdx] == NULL || rdx == NULL"],
49
+ effect: "execve(\"/bin/sh\", rsi, rdx)")
50
+ OneGadget::Gadget.add(build_id, 915253,
51
+ constraints: ["writable: rbp-0x78", "[r10] == NULL || r10 == NULL", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL"],
52
+ effect: "execve(\"/bin/sh\", r10, [rbp-0x70])")
53
+ OneGadget::Gadget.add(build_id, 915257,
54
+ constraints: ["writable: rbp-0x78", "[r10] == NULL || r10 == NULL", "[rdx] == NULL || rdx == NULL"],
55
+ effect: "execve(\"/bin/sh\", r10, rdx)")
56
+ OneGadget::Gadget.add(build_id, 915366,
57
+ constraints: ["writable: rbp-0x48", "[rbp-0x50] == NULL || rbp-0x50 == NULL", "[r12] == NULL || r12 == NULL"],
58
+ effect: "execve(\"/bin/sh\", rbp-0x50, r12)")
59
+ OneGadget::Gadget.add(build_id, 915373,
60
+ constraints: ["writable: rbp-0x50", "[rbp-0x50] == NULL || rbp-0x50 == NULL", "[r12] == NULL || r12 == NULL"],
61
+ effect: "execve(\"/bin/sh\", rbp-0x50, r12)")
62
+ OneGadget::Gadget.add(build_id, 915435,
63
+ constraints: ["writable: rbp-0x48", "[rbp-0x50] == NULL || rbp-0x50 == NULL", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL"],
64
+ effect: "execve(\"/bin/sh\", rbp-0x50, [rbp-0x70])")
65
+ OneGadget::Gadget.add(build_id, 915442,
66
+ constraints: ["writable: rbp-0x50", "[rbp-0x50] == NULL || rbp-0x50 == NULL", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL"],
67
+ effect: "execve(\"/bin/sh\", rbp-0x50, [rbp-0x70])")
68
+ OneGadget::Gadget.add(build_id, 915446,
69
+ constraints: ["writable: r10+0x10", "writable: rbp-0x50", "[r10] == NULL || r10 == NULL", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL"],
70
+ effect: "execve(\"/bin/sh\", r10, [rbp-0x70])")
71
+ OneGadget::Gadget.add(build_id, 1056890,
72
+ constraints: ["[rsp+0x70] == NULL", "[[rsp+0xf0]] == NULL || [rsp+0xf0] == NULL", "[rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] <= 0"],
73
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", [rsp+0x38], 0, rsp+0x70, [rsp+0xf0])")
74
+ OneGadget::Gadget.add(build_id, 1056898,
75
+ constraints: ["[rsp+0x70] == NULL", "[r9] == NULL || r9 == NULL", "[rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] <= 0"],
76
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", [rsp+0x38], 0, rsp+0x70, r9)")
77
+ OneGadget::Gadget.add(build_id, 1056903,
78
+ constraints: ["[rsp+0x70] == NULL", "[r9] == NULL || r9 == NULL", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
79
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", rdx, 0, rsp+0x70, r9)")
80
+ OneGadget::Gadget.add(build_id, 1056913,
81
+ constraints: ["[r8] == NULL", "[r9] == NULL || r9 == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
82
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, 0, r8, r9)")
83
+
@@ -0,0 +1,56 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/david942j/libcdb/blob/master/libc/glibc-2.32-5-x86_64.pkg.tar/usr/lib/libc-2.32.so
3
+ #
4
+ # Advanced Micro Devices X86-64
5
+ #
6
+ # GNU C Library (GNU libc) release release version 2.32.
7
+ # Copyright (C) 2020 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 10.2.0.
12
+ # libc ABIs: UNIQUE IFUNC ABSOLUTE
13
+ # For bug reporting instructions, please see:
14
+ # <https://bugs.archlinux.org/>.
15
+
16
+ build_id = File.basename(__FILE__, '.rb').split('-').last
17
+ OneGadget::Gadget.add(build_id, 304089,
18
+ constraints: ["rax == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rcx == NULL || (u16)[rcx] == NULL"],
19
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, rcx, rsp+0x50, environ)")
20
+ OneGadget::Gadget.add(build_id, 304111,
21
+ constraints: ["[r8] == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rcx == NULL || (u16)[rcx] == NULL"],
22
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, rcx, r8, environ)")
23
+ OneGadget::Gadget.add(build_id, 487578,
24
+ constraints: ["[r8] == NULL", "rbx+0xe0 == NULL || writable: rbx+0xe0", "r12 == NULL || (s32)[r12+0x4] <= 0"],
25
+ effect: "posix_spawn(rbx+0xe0, \"/bin/sh\", r12, 0, r8, environ)")
26
+ OneGadget::Gadget.add(build_id, 487595,
27
+ constraints: ["[r8] == NULL", "rbx+0xe0 == NULL || writable: rbx+0xe0", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rcx == NULL || (u16)[rcx] == NULL"],
28
+ effect: "posix_spawn(rbx+0xe0, \"/bin/sh\", rdx, rcx, r8, environ)")
29
+ OneGadget::Gadget.add(build_id, 842330,
30
+ constraints: ["[r12] == NULL || r12 == NULL", "[r13] == NULL || r13 == NULL"],
31
+ effect: "execve(\"/bin/sh\", r12, r13)")
32
+ OneGadget::Gadget.add(build_id, 842333,
33
+ constraints: ["[r12] == NULL || r12 == NULL", "[rdx] == NULL || rdx == NULL"],
34
+ effect: "execve(\"/bin/sh\", r12, rdx)")
35
+ OneGadget::Gadget.add(build_id, 842336,
36
+ constraints: ["[rsi] == NULL || rsi == NULL", "[rdx] == NULL || rdx == NULL"],
37
+ effect: "execve(\"/bin/sh\", rsi, rdx)")
38
+ OneGadget::Gadget.add(build_id, 842426,
39
+ constraints: ["writable: rbp-0x38", "[rbp-0x40] == NULL || rbp-0x40 == NULL", "[r13] == NULL || r13 == NULL"],
40
+ effect: "execve(\"/bin/sh\", rbp-0x40, r13)")
41
+ OneGadget::Gadget.add(build_id, 842433,
42
+ constraints: ["writable: rbp-0x40", "[rbp-0x40] == NULL || rbp-0x40 == NULL", "[r13] == NULL || r13 == NULL"],
43
+ effect: "execve(\"/bin/sh\", rbp-0x40, r13)")
44
+ OneGadget::Gadget.add(build_id, 963114,
45
+ constraints: ["[rsp+0x70] == NULL", "[[rsp+0xf0]] == NULL || [rsp+0xf0] == NULL", "[rsp+0x40] == NULL || (s32)[[rsp+0x40]+0x4] <= 0"],
46
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", [rsp+0x40], 0, rsp+0x70, [rsp+0xf0])")
47
+ OneGadget::Gadget.add(build_id, 963122,
48
+ constraints: ["[rsp+0x70] == NULL", "[r9] == NULL || r9 == NULL", "[rsp+0x40] == NULL || (s32)[[rsp+0x40]+0x4] <= 0"],
49
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", [rsp+0x40], 0, rsp+0x70, r9)")
50
+ OneGadget::Gadget.add(build_id, 963127,
51
+ constraints: ["[rsp+0x70] == NULL", "[r9] == NULL || r9 == NULL", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
52
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", rdx, 0, rsp+0x70, r9)")
53
+ OneGadget::Gadget.add(build_id, 963137,
54
+ constraints: ["[r8] == NULL", "[r9] == NULL || r9 == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
55
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, 0, r8, r9)")
56
+
@@ -0,0 +1,26 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/david942j/libcdb/blob/master/libc/libc6-i386_2.32-0ubuntu3.2_amd64/lib32/libc-2.32.so
3
+ #
4
+ # Intel 80386
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.32-0ubuntu3.2) release release version 2.32.
7
+ # Copyright (C) 2020 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 10.2.0.
12
+ # libc ABIs: UNIQUE IFUNC ABSOLUTE
13
+ # For bug reporting instructions, please see:
14
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
15
+
16
+ build_id = File.basename(__FILE__, '.rb').split('-').last
17
+ OneGadget::Gadget.add(build_id, 843715,
18
+ constraints: ["ebx is the GOT address of libc", "writable: ebp-0x20", "[ebp-0x28] == NULL || ebp-0x28 == NULL", "[[ebp-0x2c]] == NULL || [ebp-0x2c] == NULL"],
19
+ effect: "execve(\"/bin/sh\", ebp-0x28, [ebp-0x2c])")
20
+ OneGadget::Gadget.add(build_id, 1358307,
21
+ constraints: ["ebp is the GOT address of libc", "eax == NULL"],
22
+ effect: "execl(\"/bin/sh\", eax)")
23
+ OneGadget::Gadget.add(build_id, 1358308,
24
+ constraints: ["ebp is the GOT address of libc", "[esp] == NULL"],
25
+ effect: "execl(\"/bin/sh\", [esp])")
26
+
@@ -0,0 +1,26 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/david942j/libcdb/blob/master/libc/libc6-i386_2.32-0ubuntu3.1_amd64/lib32/libc-2.32.so
3
+ #
4
+ # Intel 80386
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.32-0ubuntu3.1) release release version 2.32.
7
+ # Copyright (C) 2020 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 10.2.0.
12
+ # libc ABIs: UNIQUE IFUNC ABSOLUTE
13
+ # For bug reporting instructions, please see:
14
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
15
+
16
+ build_id = File.basename(__FILE__, '.rb').split('-').last
17
+ OneGadget::Gadget.add(build_id, 843715,
18
+ constraints: ["ebx is the GOT address of libc", "writable: ebp-0x20", "[ebp-0x28] == NULL || ebp-0x28 == NULL", "[[ebp-0x2c]] == NULL || [ebp-0x2c] == NULL"],
19
+ effect: "execve(\"/bin/sh\", ebp-0x28, [ebp-0x2c])")
20
+ OneGadget::Gadget.add(build_id, 1358307,
21
+ constraints: ["ebp is the GOT address of libc", "eax == NULL"],
22
+ effect: "execl(\"/bin/sh\", eax)")
23
+ OneGadget::Gadget.add(build_id, 1358308,
24
+ constraints: ["ebp is the GOT address of libc", "[esp] == NULL"],
25
+ effect: "execl(\"/bin/sh\", [esp])")
26
+
@@ -0,0 +1,83 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/david942j/libcdb/blob/master/libc/libc6_2.32-0ubuntu3.1_amd64/lib/x86_64-linux-gnu/libc-2.32.so
3
+ #
4
+ # Advanced Micro Devices X86-64
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.32-0ubuntu3.1) release release version 2.32.
7
+ # Copyright (C) 2020 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 10.2.0.
12
+ # libc ABIs: UNIQUE IFUNC ABSOLUTE
13
+ # For bug reporting instructions, please see:
14
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
15
+
16
+ build_id = File.basename(__FILE__, '.rb').split('-').last
17
+ OneGadget::Gadget.add(build_id, 327503,
18
+ constraints: ["rsp & 0xf == 0", "rcx == NULL", "rbp == NULL || (u16)[rbp] == NULL"],
19
+ effect: "posix_spawn(rsp+0xc, \"/bin/sh\", 0, rbp, rsp+0x50, environ)")
20
+ OneGadget::Gadget.add(build_id, 327515,
21
+ constraints: ["rsp & 0xf == 0", "(u64)xmm0 == NULL", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rbp == NULL || (u16)[rbp] == NULL"],
22
+ effect: "posix_spawn(rsp+0xc, \"/bin/sh\", rdx, rbp, rsp+0x50, environ)")
23
+ OneGadget::Gadget.add(build_id, 327536,
24
+ constraints: ["rsp & 0xf == 0", "[r8] == NULL", "[[rax]] == NULL || [rax] == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rbp == NULL || (u16)[rbp] == NULL"],
25
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, rbp, r8, [rax])")
26
+ OneGadget::Gadget.add(build_id, 327544,
27
+ constraints: ["rsp & 0xf == 0", "[r8] == NULL", "[[rax]] == NULL || [rax] == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rcx == NULL || (u16)[rcx] == NULL"],
28
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, rcx, r8, [rax])")
29
+ OneGadget::Gadget.add(build_id, 527027,
30
+ constraints: ["rsp & 0xf == 0", "rcx == NULL", "rbx+0xe0 == NULL || writable: rbx+0xe0", "r12 == NULL || (s32)[r12+0x4] <= 0"],
31
+ effect: "posix_spawn(rbx+0xe0, \"/bin/sh\", r12, 0, rsp+0x60, environ)")
32
+ OneGadget::Gadget.add(build_id, 527040,
33
+ constraints: ["rsp & 0xf == 0", "rcx == NULL", "rbx+0xe0 == NULL || writable: rbx+0xe0", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
34
+ effect: "posix_spawn(rbx+0xe0, \"/bin/sh\", rdx, 0, rsp+0x60, environ)")
35
+ OneGadget::Gadget.add(build_id, 527052,
36
+ constraints: ["rsp & 0xf == 0", "(u64)xmm0 == NULL", "[[rax]] == NULL || [rax] == NULL", "rbx+0xe0 == NULL || writable: rbx+0xe0", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
37
+ effect: "posix_spawn(rbx+0xe0, \"/bin/sh\", rdx, 0, rsp+0x60, [rax])")
38
+ OneGadget::Gadget.add(build_id, 527065,
39
+ constraints: ["rsp & 0xf == 0", "(u64)xmm0 == NULL", "[[rax]] == NULL || [rax] == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0", "rcx == NULL || (u16)[rcx] == NULL"],
40
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, rcx, rsp+0x60, [rax])")
41
+ OneGadget::Gadget.add(build_id, 914764,
42
+ constraints: ["[r15] == NULL || r15 == NULL", "[r12] == NULL || r12 == NULL"],
43
+ effect: "execve(\"/bin/sh\", r15, r12)")
44
+ OneGadget::Gadget.add(build_id, 914767,
45
+ constraints: ["[r15] == NULL || r15 == NULL", "[rdx] == NULL || rdx == NULL"],
46
+ effect: "execve(\"/bin/sh\", r15, rdx)")
47
+ OneGadget::Gadget.add(build_id, 914770,
48
+ constraints: ["[rsi] == NULL || rsi == NULL", "[rdx] == NULL || rdx == NULL"],
49
+ effect: "execve(\"/bin/sh\", rsi, rdx)")
50
+ OneGadget::Gadget.add(build_id, 915253,
51
+ constraints: ["writable: rbp-0x78", "[r10] == NULL || r10 == NULL", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL"],
52
+ effect: "execve(\"/bin/sh\", r10, [rbp-0x70])")
53
+ OneGadget::Gadget.add(build_id, 915257,
54
+ constraints: ["writable: rbp-0x78", "[r10] == NULL || r10 == NULL", "[rdx] == NULL || rdx == NULL"],
55
+ effect: "execve(\"/bin/sh\", r10, rdx)")
56
+ OneGadget::Gadget.add(build_id, 915366,
57
+ constraints: ["writable: rbp-0x48", "[rbp-0x50] == NULL || rbp-0x50 == NULL", "[r12] == NULL || r12 == NULL"],
58
+ effect: "execve(\"/bin/sh\", rbp-0x50, r12)")
59
+ OneGadget::Gadget.add(build_id, 915373,
60
+ constraints: ["writable: rbp-0x50", "[rbp-0x50] == NULL || rbp-0x50 == NULL", "[r12] == NULL || r12 == NULL"],
61
+ effect: "execve(\"/bin/sh\", rbp-0x50, r12)")
62
+ OneGadget::Gadget.add(build_id, 915435,
63
+ constraints: ["writable: rbp-0x48", "[rbp-0x50] == NULL || rbp-0x50 == NULL", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL"],
64
+ effect: "execve(\"/bin/sh\", rbp-0x50, [rbp-0x70])")
65
+ OneGadget::Gadget.add(build_id, 915442,
66
+ constraints: ["writable: rbp-0x50", "[rbp-0x50] == NULL || rbp-0x50 == NULL", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL"],
67
+ effect: "execve(\"/bin/sh\", rbp-0x50, [rbp-0x70])")
68
+ OneGadget::Gadget.add(build_id, 915446,
69
+ constraints: ["writable: r10+0x10", "writable: rbp-0x50", "[r10] == NULL || r10 == NULL", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL"],
70
+ effect: "execve(\"/bin/sh\", r10, [rbp-0x70])")
71
+ OneGadget::Gadget.add(build_id, 1056890,
72
+ constraints: ["[rsp+0x70] == NULL", "[[rsp+0xf0]] == NULL || [rsp+0xf0] == NULL", "[rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] <= 0"],
73
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", [rsp+0x38], 0, rsp+0x70, [rsp+0xf0])")
74
+ OneGadget::Gadget.add(build_id, 1056898,
75
+ constraints: ["[rsp+0x70] == NULL", "[r9] == NULL || r9 == NULL", "[rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] <= 0"],
76
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", [rsp+0x38], 0, rsp+0x70, r9)")
77
+ OneGadget::Gadget.add(build_id, 1056903,
78
+ constraints: ["[rsp+0x70] == NULL", "[r9] == NULL || r9 == NULL", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
79
+ effect: "posix_spawn(rsp+0x64, \"/bin/sh\", rdx, 0, rsp+0x70, r9)")
80
+ OneGadget::Gadget.add(build_id, 1056913,
81
+ constraints: ["[r8] == NULL", "[r9] == NULL || r9 == NULL", "rdi == NULL || writable: rdi", "rdx == NULL || (s32)[rdx+0x4] <= 0"],
82
+ effect: "posix_spawn(rdi, \"/bin/sh\", rdx, 0, r8, r9)")
83
+
@@ -0,0 +1,26 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/david942j/libcdb/blob/master/libc/libc6-i386_2.32-0ubuntu6_amd64/lib32/libc-2.32.so
3
+ #
4
+ # Intel 80386
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.32-0ubuntu6) stable release version 2.32.
7
+ # Copyright (C) 2020 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 10.2.1 20201207.
12
+ # libc ABIs: UNIQUE IFUNC ABSOLUTE
13
+ # For bug reporting instructions, please see:
14
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
15
+
16
+ build_id = File.basename(__FILE__, '.rb').split('-').last
17
+ OneGadget::Gadget.add(build_id, 843331,
18
+ constraints: ["ebx is the GOT address of libc", "writable: ebp-0x20", "[ebp-0x28] == NULL || ebp-0x28 == NULL", "[[ebp-0x2c]] == NULL || [ebp-0x2c] == NULL"],
19
+ effect: "execve(\"/bin/sh\", ebp-0x28, [ebp-0x2c])")
20
+ OneGadget::Gadget.add(build_id, 1357923,
21
+ constraints: ["ebp is the GOT address of libc", "eax == NULL"],
22
+ effect: "execl(\"/bin/sh\", eax)")
23
+ OneGadget::Gadget.add(build_id, 1357924,
24
+ constraints: ["ebp is the GOT address of libc", "[esp] == NULL"],
25
+ effect: "execl(\"/bin/sh\", [esp])")
26
+
@@ -0,0 +1,26 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/david942j/libcdb/blob/master/libc/libc6_2.32-0ubuntu6_i386/lib/i386-linux-gnu/libc-2.32.so
3
+ #
4
+ # Intel 80386
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.32-0ubuntu6) stable release version 2.32.
7
+ # Copyright (C) 2020 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 10.2.1 20201207.
12
+ # libc ABIs: UNIQUE IFUNC ABSOLUTE
13
+ # For bug reporting instructions, please see:
14
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
15
+
16
+ build_id = File.basename(__FILE__, '.rb').split('-').last
17
+ OneGadget::Gadget.add(build_id, 848499,
18
+ constraints: ["ebx is the GOT address of libc", "writable: ebp-0x20", "[ebp-0x28] == NULL || ebp-0x28 == NULL", "[[ebp-0x2c]] == NULL || [ebp-0x2c] == NULL"],
19
+ effect: "execve(\"/bin/sh\", ebp-0x28, [ebp-0x2c])")
20
+ OneGadget::Gadget.add(build_id, 1370571,
21
+ constraints: ["ebp is the GOT address of libc", "eax == NULL"],
22
+ effect: "execl(\"/bin/sh\", eax)")
23
+ OneGadget::Gadget.add(build_id, 1370572,
24
+ constraints: ["ebp is the GOT address of libc", "[esp] == NULL"],
25
+ effect: "execl(\"/bin/sh\", [esp])")
26
+
@@ -0,0 +1,26 @@
1
+ require 'one_gadget/gadget'
2
+ # https://gitlab.com/david942j/libcdb/blob/master/libc/libc6_2.32-0ubuntu3.2_i386/lib/i386-linux-gnu/libc-2.32.so
3
+ #
4
+ # Intel 80386
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.32-0ubuntu3.2) release release version 2.32.
7
+ # Copyright (C) 2020 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 10.2.0.
12
+ # libc ABIs: UNIQUE IFUNC ABSOLUTE
13
+ # For bug reporting instructions, please see:
14
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
15
+
16
+ build_id = File.basename(__FILE__, '.rb').split('-').last
17
+ OneGadget::Gadget.add(build_id, 848883,
18
+ constraints: ["ebx is the GOT address of libc", "writable: ebp-0x20", "[ebp-0x28] == NULL || ebp-0x28 == NULL", "[[ebp-0x2c]] == NULL || [ebp-0x2c] == NULL"],
19
+ effect: "execve(\"/bin/sh\", ebp-0x28, [ebp-0x2c])")
20
+ OneGadget::Gadget.add(build_id, 1370955,
21
+ constraints: ["ebp is the GOT address of libc", "eax == NULL"],
22
+ effect: "execl(\"/bin/sh\", eax)")
23
+ OneGadget::Gadget.add(build_id, 1370956,
24
+ constraints: ["ebp is the GOT address of libc", "[esp] == NULL"],
25
+ effect: "execl(\"/bin/sh\", [esp])")
26
+