one_gadget 1.3.7 → 1.3.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 33da33103c5c21696048389d2e3d0bf28518d5c7
-  data.tar.gz: f9db6d8f8492fb3333e64c32e465117e12b8316f
+  metadata.gz: e47c77be5fc1a63c461fad7c0cecc0017540da61
+  data.tar.gz: 44c7d81b31fc80f8596a747d93f9aa1793a4518a
 SHA512:
-  metadata.gz: 2e6812ce5a3014b3b0decf022ee10091c1c5ef0ece3fcf95b9633ed2c1cfaeb8711022dba8115d7c2ce8fb131da0687e921d5ff4d6fdf5570566a7a187d1be58
-  data.tar.gz: 25fa9d3d24bc875c1fff2c96d125d650ade69cf5099433e5d8801cab90eeaf942071bcecdc65b0469902de27b88abd3effe726f9e8ed8a604eb9fd9bb64e485e
+  metadata.gz: b85a66bdb6a16879fce76720e7b26afd3a0de0f2fb22a5ff86d0c24de49a440ab1fe6f248ee873f05f3e9427a3a39171183f26c38875a5fea23bfd77e56fdc53
+  data.tar.gz: 495b9930e3b6200e29efe0c3b1c7a8d858abdf99503acce96f92175dd3b80b095385ecc34fdc8c29b1fe6c54c65637e77aebf9c19662ac4e7de26608157c0a52

data/README.md

@@ -11,9 +11,9 @@
 When playing ctf pwn challenges we usually need the one-gadget RCE (remote code execution),
 which leads to call `execve('/bin/sh', NULL, NULL)`.
 
-This gem provides such gadgets finder, no need to use IDA-pro every time like a fool.
+This gem provides such gadgets finder, no need to use objdump or IDA-pro every time like a fool :wink:
 
-This work provides the command-line tool `one_gadget` for easy usage.
+To use this tool, just type `one_gadget /path/to/libc` in command line and enjoy the magic :laughing:
 
 Note: Supports amd64 and i386!
 
@@ -24,15 +24,17 @@ Available on RubyGems.org!
 gem install one_gadget
 ```
 
+Note: require ruby version >= 2.1.0, you can use `ruby --version` to check.
+
 ## Implementation
 
 OneGadget use simple self-implement symbolic execution to find the constraints of gadgets.
 
-The article introducing how I developed this tool can be found [here](https://david942j.blogspot.com/2017/02/project-one-gadget-in-glibc.html).
+The article introducing how I develop this tool can be found [here](https://david942j.blogspot.com/2017/02/project-one-gadget-in-glibc.html).
 
 ## Usage
 
-### Command Line Tool
+### Command Line Interface
 
 ```bash
 one_gadget
@@ -42,34 +44,35 @@ one_gadget
 #     -r, --[no-]raw                   Output gadgets offset only, split with one space.
 #     -s, --script exploit-script      Run exploit script with all possible gadgets.
 #                                      The script will be run as 'exploit-script $offset'.
+#         --version                    Current gem version.
 
 one_gadget -b 60131540dadc6796cab33388349e6e4e68692053
 # 0x4526a execve("/bin/sh", rsp+0x30, environ)
 # constraints:
 #   [rsp+0x30] == NULL
-# 
+#
+# 0xcc543 execve("/bin/sh", rcx, r12)
+# constraints:
+#   [rcx] == NULL || rcx == NULL
+#   [r12] == NULL || r12 == NULL
+#
+# 0xcc618 execve("/bin/sh", rax, r12)
+# constraints:
+#   [rax] == NULL || rax == NULL
+#   [r12] == NULL || r12 == NULL
+#
 # 0xef6c4 execve("/bin/sh", rsp+0x50, environ)
 # constraints:
 #   [rsp+0x50] == NULL
-# 
+#
 # 0xf0567 execve("/bin/sh", rsp+0x70, environ)
 # constraints:
 #   [rsp+0x70] == NULL
-# 
-# 0xcc543 execve("/bin/sh", rcx, r12)
-# constraints:
-#   rcx == NULL || [rcx] == NULL
-#   r12 == NULL || [r12] == NULL
-# 
-# 0xcc618 execve("/bin/sh", rax, r12)
-# constraints:
-#   rax == NULL || [rax] == NULL
-#   r12 == NULL || [r12] == NULL
-# 
+#
 # 0xf5b10 execve("/bin/sh", rcx, [rbp-0xf8])
 # constraints:
-#   [rbp-0xf8] == NULL || [[rbp-0xf8]] == NULL
-#   rcx == NULL || [rcx] == NULL
+#   [rcx] == NULL || rcx == NULL
+#   [[rbp-0xf8]] == NULL || [rbp-0xf8] == NULL
 
 one_gadget /lib/i386-linux-gnu/libc.so.6
 # 0x3ac69 execve("/bin/sh", esp+0x34, environ)
@@ -104,18 +107,19 @@ one_gadget ./spec/data/libc-2.19.so -s 'echo "offset ->"'
 require 'one_gadget'
 OneGadget.gadgets(file: '/lib/x86_64-linux-gnu/libc.so.6')
 # => [283242, 980676, 984423, 836931, 837144, 1006352]
+
 # or in shorter way
-one_gadget(file: '/lib/x86_64-linux-gnu/libc.so.6')
+one_gadget('/lib/x86_64-linux-gnu/libc.so.6')
 # => [283242, 980676, 984423, 836931, 837144, 1006352]
 
 # from build id
-one_gadget(build_id: '60131540dadc6796cab33388349e6e4e68692053')
+one_gadget('60131540dadc6796cab33388349e6e4e68692053')
 # => [283242, 980676, 984423, 836931, 837144, 1006352]
 ```
 
 ## Screenshots
 
-### Search gadgets from file
+### Search gadgets in libc
 
 #### 64 bit
 ![from file](https://github.com/david942j/one_gadget/blob/master/examples/from_file.png?raw=true)
@@ -126,3 +130,8 @@ one_gadget(build_id: '60131540dadc6796cab33388349e6e4e68692053')
 ### Fetch gadgets from database
 ![build id](https://github.com/david942j/one_gadget/blob/master/examples/from_build_id.png?raw=true)
 
+## Make OneGadget Better
+Any suggestion or feature request is welcome! Feel free to send a pull request.
+
+Please let me know if you find any libc that make OneGadget fail to find gadgets.
+And, if you like this work, I'll be happy to be [stared](https://github.com/david942j/one_gadget/stargazers) :grimacing:

data/lib/one_gadget.rb

@@ -1,6 +1,8 @@
 # OneGadget - To find the execve(/bin/sh, 0, 0) in glibc.
 #
 # @author david942j
+
+# Main module.
 module OneGadget
   class << self
     # The man entry of gem +one_gadget+.
@@ -38,12 +40,25 @@ module OneGadget
 end
 
 # Shorter way to use one gadget.
-# @param [Mixed] args
-#   See {OneGadget#gadgets} for more information.
+# @param [String?] arg
+#   Can be either +build_id+ or path to libc.
+# @param [Mixed] options
+#   See {OneGadget#gadgets} for ore information.
 # @return [Array<OneGadget::Gadget::Gadget>, Array<Integer>]
 #   The gadgets found.
-def one_gadget(*args)
-  OneGadget.gadgets(*args)
+# @example
+#   one_gadget('./libc.so.6')
+#   one_gadget('cbfa941a8eb7a11e4f90e81b66fcd5a820995d7c')
+#   one_gadget('./libc.so.6', details: true)
+def one_gadget(arg = nil, **options)
+  unless arg.nil?
+    if arg =~ /\A#{OneGadget::Helper::BUILD_ID_FORMAT}\Z/
+      options[:build_id] = arg
+    else
+      options[:file] = arg
+    end
+  end
+  OneGadget.gadgets(**options)
 end
 
 require 'one_gadget/fetcher'

data/lib/one_gadget/fetcher.rb

@@ -1,7 +1,7 @@
-require 'one_gadget/helper'
 require 'one_gadget/fetchers/amd64'
 require 'one_gadget/fetchers/i386'
 require 'one_gadget/gadget'
+require 'one_gadget/helper'
 
 module OneGadget
   # To find gadgets.

data/lib/one_gadget/fetchers/amd64.rb

@@ -1,5 +1,6 @@
-require 'one_gadget/fetchers/base'
 require 'one_gadget/emulators/amd64'
+require 'one_gadget/fetchers/base'
+
 module OneGadget
   module Fetcher
     # Fetcher for amd64.

data/lib/one_gadget/fetchers/i386.rb

@@ -1,7 +1,8 @@
-require 'one_gadget/fetchers/base'
-require 'one_gadget/emulators/i386'
 require 'elftools'
 
+require 'one_gadget/emulators/i386'
+require 'one_gadget/fetchers/base'
+
 module OneGadget
   module Fetcher
     # Fetcher for i386.

data/lib/one_gadget/helper.rb

@@ -65,10 +65,8 @@ module OneGadget
       # Fetch the latest release version's tag name.
       # @return [String] The tag name, in form +vx.x.x+.
       def latest_tag
-        releases_url = 'https://github.com/david942j/one_gadget/releases'
-        @latest_tag ||= 'v' + url_request(releases_url).scan(%r{/tree/v([\d.]+)"}).map do |tag|
-          Gem::Version.new(tag.first)
-        end.max.to_s
+        releases_url = 'https://github.com/david942j/one_gadget/releases/latest'
+        @latest_tag ||= url_request(releases_url).split('/').last
       end
 
       # Get the url which can fetch +filename+ from remote repo.
@@ -76,7 +74,7 @@ module OneGadget
       # @return [String] The url.
       def url_of_file(filename)
         raw_file_url = 'https://raw.githubusercontent.com/david942j/one_gadget/@tag/@file'
-        raw_file_url.gsub('@tag', latest_tag).gsub('@file', filename)
+        raw_file_url.sub('@tag', latest_tag).sub('@file', filename)
       end
 
       # Download the latest version of +file+ in +lib/one_gadget/builds/+ from remote repo.
@@ -99,7 +97,9 @@ module OneGadget
 
       # Get request.
       # @param [String] url The url.
-      # @return [String] The request response body.
+      # @return [String]
+      #   The request response body.
+      #   If the response is '302 Found', return the location in header.
       def url_request(url)
         uri = URI.parse(url)
         http = Net::HTTP.new(uri.host, uri.port)
@@ -109,8 +109,8 @@ module OneGadget
         request = Net::HTTP::Get.new(uri.request_uri)
 
         response = http.request(request)
-        raise ArgumentError, "Fail to get response of #{url}" unless response.code == '200'
-        response.body
+        raise ArgumentError, "Fail to get response of #{url}" unless %w(200 302).include?(response.code)
+        response.code == '302' ? response['location'] : response.body
       rescue NoMethodError, SocketError, ArgumentError => e
         p e
         nil

data/lib/one_gadget/logger.rb

@@ -1,4 +1,5 @@
 require 'logger'
+
 require 'one_gadget/helper'
 
 module OneGadget

data/lib/one_gadget/version.rb

@@ -1,4 +1,4 @@
 module OneGadget
   # Current gem version.
-  VERSION = '1.3.7'.freeze
+  VERSION = '1.3.8'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: one_gadget
 version: !ruby/object:Gem::Version
-  version: 1.3.7
+  version: 1.3.8
 platform: ruby
 authors:
 - david942j
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-04-04 00:00:00.000000000 Z
+date: 2017-05-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: elftools