search

icemonster / AutoVulnDetect

This repository contains a symbolic executor with capabilities of detecting common vulnerabilities in x86 binaries
4 stars 2 forks source link

Direct shell flag #5

Open icemonster opened 4 years ago

icemonster commented 4 years ago

Create a flag to indicate you want AVD to try to find an input that spawns a shell. Possibly indicate also an IP and port of a server running that binary for direct exploitation.

icemonster commented 4 years ago

We could use one_gadget https://github.com/david942j/one_gadget to look for shell gadgets in the binary and the used libraries. Then it would be just a matter of using the result as the value for --RET_ADDR flag

icemonster commented 4 years ago

Of course this means we must get a libc base address leak first which is not trivial. Some exploit chaining infrastructure is needed