rubypwn 0.0.13 → 0.0.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/bin/patch_alarm +3 -0
- data/docs/source/elf.rst +32 -27
- data/docs/source/index.rst +11 -0
- data/docs/source/patch_alarm.rst +24 -0
- data/lib/exec.rb +9 -8
- data/lib/rubypwn.rb +1 -0
- data/lib/string_ext.rb +52 -0
- data/rubypwn.gemspec +1 -1
- metadata +3 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 56dfcaaf8da767fa6ba74aeeb8a084c59360fd97
|
|
4
|
+
data.tar.gz: 926d50b640796244b8857703f2fd9889f7e5121d
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: a4290e96160d31ed4380972a057cc008bbe4332731c6e065e8686fd03e5f435ac809115dcdbd59710149cde3781f5feb9452192b0ed25b182cf3807042e2fd79
|
|
7
|
+
data.tar.gz: bc7791e99a6806d6079ad961520a8406f66956bee8ea6f9f994c626f81a0a1866481b44fd8779ce4e4ce544c5d4bcbf36d5890633e6ebb177f9f8be628529b5d
|
data/bin/patch_alarm
CHANGED
|
@@ -15,6 +15,7 @@ e = Elf.new filename
|
|
|
15
15
|
off_dynstr = e.sections[".dynstr"]["offset"]
|
|
16
16
|
size = e.sections[".dynstr"]["size"]
|
|
17
17
|
|
|
18
|
+
# append .patch as new filename
|
|
18
19
|
new_filename = filename + ".patch"
|
|
19
20
|
|
|
20
21
|
binary = File.read(filename).force_encoding("binary")
|
|
@@ -28,6 +29,8 @@ if not off_alarm.nil?
|
|
|
28
29
|
File.open(new_filename, "w") do |fh|
|
|
29
30
|
fh.write binary
|
|
30
31
|
end
|
|
32
|
+
|
|
33
|
+
# remember to set executable for user
|
|
31
34
|
FileUtils.chmod "a+x", new_filename
|
|
32
35
|
puts "Done."
|
|
33
36
|
else
|
data/docs/source/elf.rst
CHANGED
|
@@ -36,30 +36,35 @@ Used to get some constant value from the binary::
|
|
|
36
36
|
"__sigsetjmp"=>134521268,
|
|
37
37
|
"exit"=>134521272},
|
|
38
38
|
@sections=
|
|
39
|
-
{""=>{"offset"=>0, "flag"=>"r--"},
|
|
40
|
-
".interp"=>{"
|
|
41
|
-
".note.ABI-tag"=>
|
|
42
|
-
|
|
43
|
-
".
|
|
44
|
-
".
|
|
45
|
-
".
|
|
46
|
-
".gnu.
|
|
47
|
-
|
|
48
|
-
".
|
|
49
|
-
|
|
50
|
-
".
|
|
51
|
-
".
|
|
52
|
-
".
|
|
53
|
-
".
|
|
54
|
-
".
|
|
55
|
-
".
|
|
56
|
-
".
|
|
57
|
-
".
|
|
58
|
-
|
|
59
|
-
".
|
|
60
|
-
|
|
61
|
-
".
|
|
62
|
-
".
|
|
63
|
-
".
|
|
64
|
-
".
|
|
65
|
-
".
|
|
39
|
+
{""=>{"addr"=>0, "offset"=>0, "size"=>0, "flag"=>"r--"},
|
|
40
|
+
".interp"=>{"addr"=>134512948, "offset"=>308, "size"=>19, "flag"=>"r--"},
|
|
41
|
+
".note.ABI-tag"=>
|
|
42
|
+
{"addr"=>134512968, "offset"=>328, "size"=>32, "flag"=>"r--"},
|
|
43
|
+
".hash"=>{"addr"=>134513000, "offset"=>360, "size"=>160, "flag"=>"r--"},
|
|
44
|
+
".dynsym"=>{"addr"=>134513160, "offset"=>520, "size"=>336, "flag"=>"r--"},
|
|
45
|
+
".dynstr"=>{"addr"=>134513496, "offset"=>856, "size"=>232, "flag"=>"r--"},
|
|
46
|
+
".gnu.version"=>
|
|
47
|
+
{"addr"=>134513728, "offset"=>1088, "size"=>42, "flag"=>"r--"},
|
|
48
|
+
".gnu.version_r"=>
|
|
49
|
+
{"addr"=>134513772, "offset"=>1132, "size"=>48, "flag"=>"r--"},
|
|
50
|
+
".rel.dyn"=>{"addr"=>134513820, "offset"=>1180, "size"=>24, "flag"=>"r--"},
|
|
51
|
+
".rel.plt"=>{"addr"=>134513844, "offset"=>1204, "size"=>136, "flag"=>"r--"},
|
|
52
|
+
".init"=>{"addr"=>134513980, "offset"=>1340, "size"=>48, "flag"=>"r-x"},
|
|
53
|
+
".plt"=>{"addr"=>134514028, "offset"=>1388, "size"=>288, "flag"=>"r-x"},
|
|
54
|
+
".text"=>{"addr"=>134514320, "offset"=>1680, "size"=>1612, "flag"=>"r-x"},
|
|
55
|
+
".fini"=>{"addr"=>134515932, "offset"=>3292, "size"=>28, "flag"=>"r-x"},
|
|
56
|
+
".rodata"=>{"addr"=>134515960, "offset"=>3320, "size"=>445, "flag"=>"r--"},
|
|
57
|
+
".eh_frame_hdr"=>
|
|
58
|
+
{"addr"=>134516408, "offset"=>3768, "size"=>100, "flag"=>"r--"},
|
|
59
|
+
".eh_frame"=>
|
|
60
|
+
{"addr"=>134516508, "offset"=>3868, "size"=>368, "flag"=>"r--"},
|
|
61
|
+
".ctors"=>{"addr"=>134520972, "offset"=>4236, "size"=>8, "flag"=>"rw-"},
|
|
62
|
+
".dtors"=>{"addr"=>134520980, "offset"=>4244, "size"=>8, "flag"=>"rw-"},
|
|
63
|
+
".jcr"=>{"addr"=>134520988, "offset"=>4252, "size"=>4, "flag"=>"rw-"},
|
|
64
|
+
".dynamic"=>{"addr"=>134520992, "offset"=>4256, "size"=>200, "flag"=>"rw-"},
|
|
65
|
+
".got"=>{"addr"=>134521192, "offset"=>4456, "size"=>4, "flag"=>"rw-"},
|
|
66
|
+
".got.plt"=>{"addr"=>134521196, "offset"=>4460, "size"=>80, "flag"=>"rw-"},
|
|
67
|
+
".data"=>{"addr"=>134521276, "offset"=>4540, "size"=>8, "flag"=>"rw-"},
|
|
68
|
+
".bss"=>{"addr"=>134521312, "offset"=>4548, "size"=>16812, "flag"=>"rw-"},
|
|
69
|
+
".comment"=>{"addr"=>0, "offset"=>4548, "size"=>61, "flag"=>"r--"},
|
|
70
|
+
".shstrtab"=>{"addr"=>0, "offset"=>4609, "size"=>213, "flag"=>"r--"}}>
|
data/docs/source/index.rst
CHANGED
|
@@ -26,6 +26,17 @@ All documented module in rubypwn.
|
|
|
26
26
|
asm
|
|
27
27
|
elf
|
|
28
28
|
|
|
29
|
+
Executable Index
|
|
30
|
+
-----------------
|
|
31
|
+
|
|
32
|
+
All documented executable binary in rubypwn
|
|
33
|
+
|
|
34
|
+
.. toctree::
|
|
35
|
+
:maxdepth: 1
|
|
36
|
+
:glob:
|
|
37
|
+
|
|
38
|
+
patch_alarm
|
|
39
|
+
|
|
29
40
|
Indices and tables
|
|
30
41
|
==================
|
|
31
42
|
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
patch_alarm
|
|
2
|
+
====================================
|
|
3
|
+
|
|
4
|
+
Patch alarm() to isnan().
|
|
5
|
+
|
|
6
|
+
How to use? ::
|
|
7
|
+
|
|
8
|
+
$ cat test.c && make test
|
|
9
|
+
#include <unistd.h>
|
|
10
|
+
main() {
|
|
11
|
+
alarm(0);
|
|
12
|
+
}
|
|
13
|
+
cc test.c -o test
|
|
14
|
+
|
|
15
|
+
$ patch_alarm ./test
|
|
16
|
+
Done.
|
|
17
|
+
|
|
18
|
+
$ patch_alarm ./test.patch
|
|
19
|
+
No "alarm" found.
|
|
20
|
+
|
|
21
|
+
$ ltrace ./test.patch
|
|
22
|
+
__libc_start_main(0x40052d, 1, 0x7ffe3ca9a1b8, 0x400540 <unfinished ...>
|
|
23
|
+
isnan(0, 0x7ffe3ca9a1b8, 0x7ffe3ca9a1c8, 0) = 0
|
|
24
|
+
+++ exited (status 0) +++
|
data/lib/exec.rb
CHANGED
|
@@ -4,24 +4,24 @@ class Exec
|
|
|
4
4
|
public
|
|
5
5
|
def initialize(cmd)
|
|
6
6
|
handle_exception
|
|
7
|
-
|
|
7
|
+
@i, @o, s = Open3.popen2(cmd)
|
|
8
8
|
end
|
|
9
9
|
|
|
10
10
|
def read(size)
|
|
11
|
-
data =
|
|
11
|
+
data = @o.read size
|
|
12
12
|
write_flush $stdout, data
|
|
13
13
|
data
|
|
14
14
|
end
|
|
15
15
|
|
|
16
16
|
def readpartial(size)
|
|
17
|
-
data =
|
|
17
|
+
data = @o.readpartial size
|
|
18
18
|
write_flush $stdout, data
|
|
19
19
|
data
|
|
20
20
|
end
|
|
21
21
|
|
|
22
22
|
def write(data)
|
|
23
23
|
write_flush $stdout, data
|
|
24
|
-
write_flush
|
|
24
|
+
write_flush @i, data
|
|
25
25
|
end
|
|
26
26
|
|
|
27
27
|
def puts(data)
|
|
@@ -35,7 +35,7 @@ class Exec
|
|
|
35
35
|
def read_until(str)
|
|
36
36
|
result = ""
|
|
37
37
|
loop do
|
|
38
|
-
result <<
|
|
38
|
+
result << @o.read(1)
|
|
39
39
|
if result.end_with? str
|
|
40
40
|
write_flush $stdout, result
|
|
41
41
|
return result
|
|
@@ -45,11 +45,12 @@ class Exec
|
|
|
45
45
|
|
|
46
46
|
def interactive
|
|
47
47
|
loop do
|
|
48
|
-
|
|
49
|
-
|
|
48
|
+
fail "Server disconnected." if @o.eof?
|
|
49
|
+
r = IO.select [@o, $stdin]
|
|
50
|
+
if r[0].include? @o
|
|
50
51
|
read 1
|
|
51
52
|
elsif r[0].include? $stdin
|
|
52
|
-
|
|
53
|
+
@i.write $stdin.read(1)
|
|
53
54
|
end
|
|
54
55
|
end
|
|
55
56
|
end
|
data/lib/rubypwn.rb
CHANGED
data/lib/string_ext.rb
ADDED
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
class String
|
|
2
|
+
require 'pp'
|
|
3
|
+
def fmtstr(value, index, **options)
|
|
4
|
+
# initialize
|
|
5
|
+
bytes = 1
|
|
6
|
+
@fmt_size = 0 unless defined? @fmt_size
|
|
7
|
+
# set by user input
|
|
8
|
+
bytes = options[:bytes] if options.has_key? :bytes
|
|
9
|
+
@fmt_size = options[:fmt_size] if options.has_key? :fmt_size
|
|
10
|
+
|
|
11
|
+
fail "Invalid size." if bytes == 3 or bytes > 4 or bytes == 0
|
|
12
|
+
|
|
13
|
+
result = self
|
|
14
|
+
times = (value.size / bytes.to_f).ceil
|
|
15
|
+
|
|
16
|
+
times.times do
|
|
17
|
+
target = fmtstr_parse value, bytes
|
|
18
|
+
if (c = fmtstr_calc(@fmt_size, target, bytes)) > 0
|
|
19
|
+
result << "%#{c}c"
|
|
20
|
+
@fmt_size += c
|
|
21
|
+
end
|
|
22
|
+
result << "%#{index}$#{bytes == 4 ? "" : "h" * (3-bytes)}n"
|
|
23
|
+
index += 1
|
|
24
|
+
value = value[bytes..-1]
|
|
25
|
+
end
|
|
26
|
+
|
|
27
|
+
result
|
|
28
|
+
end
|
|
29
|
+
|
|
30
|
+
private
|
|
31
|
+
def fmtstr_calc(from, to, scale)
|
|
32
|
+
base = 256 ** scale
|
|
33
|
+
|
|
34
|
+
count = 0
|
|
35
|
+
count = to - (from % base)
|
|
36
|
+
count += base if count < 0
|
|
37
|
+
count
|
|
38
|
+
end
|
|
39
|
+
|
|
40
|
+
def fmtstr_parse(v, bytes)
|
|
41
|
+
result = 0
|
|
42
|
+
v = v.ljust bytes, "\x00"
|
|
43
|
+
if bytes == 1
|
|
44
|
+
result = v.unpack("C")[0]
|
|
45
|
+
elsif bytes == 2
|
|
46
|
+
result = v.unpack("S<")[0]
|
|
47
|
+
elsif bytes == 4
|
|
48
|
+
result = v.unpack("L<")[0]
|
|
49
|
+
end
|
|
50
|
+
result
|
|
51
|
+
end
|
|
52
|
+
end
|
data/rubypwn.gemspec
CHANGED
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: rubypwn
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.0.
|
|
4
|
+
version: 0.0.14
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- atdog
|
|
@@ -111,12 +111,14 @@ files:
|
|
|
111
111
|
- docs/source/elf.rst
|
|
112
112
|
- docs/source/getting_started.rst
|
|
113
113
|
- docs/source/index.rst
|
|
114
|
+
- docs/source/patch_alarm.rst
|
|
114
115
|
- lib/asm.rb
|
|
115
116
|
- lib/basic.rb
|
|
116
117
|
- lib/elf.rb
|
|
117
118
|
- lib/exec.rb
|
|
118
119
|
- lib/netcat.rb
|
|
119
120
|
- lib/rubypwn.rb
|
|
121
|
+
- lib/string_ext.rb
|
|
120
122
|
- rubypwn.gemspec
|
|
121
123
|
homepage: https://github.com/atdog/rubypwn/
|
|
122
124
|
licenses:
|