BigNerd95 / Chimay-Red

Working POC of Mikrotik exploit from Vault 7 CIA Leaks
649 stars 216 forks source link

cannot import name lzma #8

Closed lanjianchun closed 6 years ago

lanjianchun commented 6 years ago

root@kali:~/test/Chimay-Red# proxychains python getROSbin.py 6.37.2 x86 /nova/bin/www www_binary ProxyChains-3.1 (http://proxychains.sf.net) |DNS-request| ::1 |S-chain|-<>-127.0.0.1:1080-<><>-4.2.2.2:53-<><>-OK |DNS-response|: ::1 does not exist Downloading firmware... |DNS-request| download2.mikrotik.com |S-chain|-<>-127.0.0.1:1080-<><>-4.2.2.2:53-<><>-OK |DNS-response| download2.mikrotik.com is 52.85.158.145 |S-chain|-<>-127.0.0.1:1080-<><>-52.85.158.145:443-<><>-OK ('Extracting', '/nova/bin/www') cannot import name lzma

how to fix this problem?

BigNerd95 commented 6 years ago

Maybe related to PySquashfsImage Try reinstalling it Or simply download the firmware and extract it using binwalk

Ramos-dev commented 6 years ago

I have downloaded the "routeros-x86-6.27.npk",can I unzip to use the "/nova/bin/www" file as the "www_binary"? i don't understand to use binwalk to get which file. And, also I get that error: use mips: Traceback (most recent call last): File "./StackClash_mips.py", line 230, in payload = build_payload(binRop, shellCmd) File "./StackClash_mips.py", line 127, in build_payload stack_finder = binRop.get_gadgets("addiu ?a0, ?sp, 0x18; lw ?ra, 0x???(?sp% jr ?ra;")[0] File "./StackClash_mips.py", line 43, in get_gadgets raise Exception("Cannot find gadgets!") Exception: Cannot find gadgets!

use x86: File "./StackClash_x86.py", line 232, in ropChain = buildROP(binary, shellCmd) File "./StackClash_x86.py", line 178, in buildROP loadOffsets(binary, shellCmd) File "./StackClash_x86.py", line 98, in loadOffsets elf = ELF(binary) File "/usr/local/lib/python2.7/site-packages/pwnlib/elf/elf.py", line 328, in init self._populate_libraries() File "/usr/local/lib/python2.7/site-packages/pwnlib/elf/elf.py", line 631, in _populate_libraries data = subprocess.check_output(cmd, shell = True, stderr = subprocess.STDOUT) File "/usr/local/lib/python2.7/subprocess.py", line 568, in check_output process = Popen(stdout=PIPE, *popenargs, **kwargs) File "/usr/local/lib/python2.7/subprocess.py", line 711, in init errread, errwrite) File "/usr/local/lib/python2.7/subprocess.py", line 1205, in _execute_child self.pid = os.fork() OSError: [Errno 12] Cannot allocate memory @BigNerd95

BigNerd95 commented 6 years ago

Any way to extract the file is valid Only check it is an ELF file once extracted

Mips: it looks like it isnt able to find the gadgets, very strange, which version of ROS are you using?

X86: it looks like a pwntools problem, i cant offer support about this

Ramos-dev commented 6 years ago

@BigNerd95 thanks.the version is 6.27,my test ip is 180.166.152.83 in fact no one target version I test is succesful......

BigNerd95 commented 6 years ago

I tested it on 6.18, 6.37 and 8.38.3 And it works

Are you sure you are using mipsbe version of www with StackClash_mips?

It can find gadgets for me image