There is a crash when I try to generate a shellcode. I think this is due to the fact the the tested binary doesn't have the memcpy in its PLT table.
$ sudo ROPGenerator
[sudo] password for fraf:
▒▒▒▒▒▒▒╗░▒▒▒▒▒▒╗░▒▒▒▒▒▒ ═════════════════════════
▒▒╔══▒▒║▒▒╔═══▒▒╗▒▒╔══▒╗
▒▒▒▒▒▒╔╝▒▒║ ▒▒║▒▒▒▒▒▒║ G E N E R A T O R
▒▒╔══▒▒╗╚▒▒▒▒▒▒╔╝▒▒╔═══╝
╚═╝ ╚═╝ ╚═════╝ ╚═╝ ════════════════════ v1.2
(main)> load my_binary
[+] Extracting gadgets from file 'my_binary'
% ELF 32-bits detected
% Executing ROPgadget as: ROPgadget
% Finished : 140 gadgets generated
[+] Creating gadget database
% Gadgets analyzed : 140
% Successfully translated : 115
% Computation time : 0:00:00.495802
[+] Initializing Semantic Engine
% Optimization rate : 92%
% Computation time : 0:00:00.390653
(main)> exploit
(exploit)> pwn --help
________________________
'pwn' command
(Generate full exploits)
________________________
Usage:
pwn [OPTIONS] <subcommand> [SUBCOMMAND_OPTIONS]
Subcommands:
(For more info use 'pwn <subcommand> -h')
deliver-shellcode Inject a shellcode an execute it
Options:
-b,--bad-bytes <bytes> Bad bytes for payload.
Expected format is a list of bytes
separated by comas (e.g '-b 0A,0B,2F')
-m,--max-length <int> Max length of the ROPChain in bytes
-pb,--padding-byte <byte> Byte for payload padding
-pl,--padding-len <int> Length of payload padding
-off,--offset <int> Offset to add to gadget addresses
-f,--output-format <fmt> Output format for ropchains.
Expected format is one of the
following: console,python
-o,--output-file <file> Save payload in a file
-h,--help Show this help
Examples:
No examples yet
(exploit)> shellcode -l X86
_________________________________
Available shellcodes for arch X86
_________________________________
(1) Linux x86 exec /bin/sh (ragg2)
'\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\...' - 24 bytes
(exploit)> pwn --bad-bytes 0a --padding-len 128 --output-format python deliver-shellcode --address 0xffffd040
_________________________________
Available shellcodes for arch X86
_________________________________
(1) Linux x86 exec /bin/sh (ragg2)
'\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\...' - 24 bytes
> Select a shellcode:
> 1
[+] Building exploit: deliver-shellcode strategy
% Building chain to copy shellcode in memory
ERROR DEBUG The file has no .rela.plt section
Traceback (most recent call last):
File "/usr/local/bin/ROPGenerator", line 4, in <module>
__import__('pkg_resources').run_script('ropgenerator==1.1', 'ROPGenerator')
File "/usr/lib/python2.7/dist-packages/pkg_resources/__init__.py", line 661, in run_script
self.require(requires)[0].run_script(script_name, ns)
File "/usr/lib/python2.7/dist-packages/pkg_resources/__init__.py", line 1441, in run_script
exec(code, namespace, namespace)
File "/usr/local/lib/python2.7/dist-packages/ropgenerator-1.1-py2.7.egg/EGG-INFO/scripts/ROPGenerator", line 5, in <module>
Main.main()
File "/usr/local/lib/python2.7/dist-packages/ropgenerator-1.1-py2.7.egg/ropgenerator/Main.py", line 77, in main
if( not exploit_mode()):
File "/usr/local/lib/python2.7/dist-packages/ropgenerator-1.1-py2.7.egg/ropgenerator/exploit/Main.py", line 58, in exploit_mode
pwn(args[1:])
File "/usr/local/lib/python2.7/dist-packages/ropgenerator-1.1-py2.7.egg/ropgenerator/exploit/Pwn.py", line 267, in pwn
payload = dshell(args[i+1:], constraint, assertion, lmax=clmax)
File "/usr/local/lib/python2.7/dist-packages/ropgenerator-1.1-py2.7.egg/ropgenerator/exploit/pwn/DeliverShellcode.py", line 146, in dshell
res = build_dshell(shellcode, constraint, assertion, address, limit, lmax)
File "/usr/local/lib/python2.7/dist-packages/ropgenerator-1.1-py2.7.egg/ropgenerator/exploit/pwn/DeliverShellcode.py", line 178, in build_dshell
(shellcode_address, STRtoMEM_chain) = STRtoMEM(shellcode, address, constraint, assertion, limit=limit, lmax=lmax, addr_str=addr_str, hex_info=True, optimizeLen=optimizeLen)
File "/usr/local/lib/python2.7/dist-packages/ropgenerator-1.1-py2.7.egg/ropgenerator/exploit/HighLevelUtils.py", line 42, in STRtoMEM
(addr,chain) = STRtoMEM_memcpy(string, address, constraint, assertion, limit, lmax, addr_str, hex_info)
File "/usr/local/lib/python2.7/dist-packages/ropgenerator-1.1-py2.7.egg/ropgenerator/exploit/HighLevelUtils.py", line 141, in STRtoMEM_memcpy
(func_name, func_addr ) = getFunctionAddress('memcpy')
File "/usr/local/lib/python2.7/dist-packages/ropgenerator-1.1-py2.7.egg/ropgenerator/exploit/Scanner.py", line 95, in getFunctionAddress
relasec_addr = relasec.header['sh_addr']
AttributeError: 'NoneType' object has no attribute 'header'
$
Hi,
There is a crash when I try to generate a shellcode. I think this is due to the fact the the tested binary doesn't have the memcpy in its PLT table.
Regards,