-
Notifications
You must be signed in to change notification settings - Fork 141
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Fix fails in glibc-2.28 * Update to latest libcdb
- Loading branch information
Showing
40 changed files
with
1,642 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
38 changes: 38 additions & 0 deletions
38
lib/one_gadget/builds/libc-2.19-397c84e78c14cbffba39a48184db482211df9fb3.rb
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| require 'one_gadget/gadget' | ||
| # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.19-10ubuntu2_arm64/lib/aarch64-linux-gnu/libc-2.19.so | ||
| # | ||
| # AArch64 | ||
| # | ||
| # GNU C Library (Ubuntu GLIBC 2.19-10ubuntu2) stable release version 2.19, by Roland McGrath et al. | ||
| # Copyright (C) 2014 Free Software Foundation, Inc. | ||
| # This is free software; see the source for copying conditions. | ||
| # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A | ||
| # PARTICULAR PURPOSE. | ||
| # Compiled by GNU CC version 4.8.3. | ||
| # Compiled on a Linux 3.16.3 system on 2014-09-30. | ||
| # Available extensions: | ||
| # crypt add-on version 2.1 by Michael Glad and others | ||
| # GNU Libidn by Simon Josefsson | ||
| # Native POSIX Threads Library by Ulrich Drepper et al | ||
| # BIND-8.2.3-T5B | ||
| # libc ABIs: UNIQUE | ||
| # For bug reporting instructions, please see: | ||
| # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>. | ||
|
|
||
| build_id = File.basename(__FILE__, '.rb').split('-').last | ||
| OneGadget::Gadget.add(build_id, 261724, | ||
| constraints: ["writable: x21+0x2e0", "x3+0x9e0 == NULL"], | ||
| effect: "execve(\"/bin/sh\", sp+0x68, environ)") | ||
| OneGadget::Gadget.add(build_id, 261732, | ||
| constraints: ["writable: x20", "writable: x21+0x2e0", "[x20] == NULL || x20 == NULL"], | ||
| effect: "execve(\"/bin/sh\", x20, environ)") | ||
| OneGadget::Gadget.add(build_id, 261808, | ||
| constraints: ["writable: x21+0x2e0", "writable: x24+0x4", "[x20] == NULL || x20 == NULL"], | ||
| effect: "execve(\"/bin/sh\", x20, environ)") | ||
| OneGadget::Gadget.add(build_id, 261820, | ||
| constraints: ["writable: x21+0x2e0", "writable: x24+0x4", "[x1] == NULL || x1 == NULL", "[[x0]] == NULL || [x0] == NULL"], | ||
| effect: "execve(\"/bin/sh\", x1, [x0])") | ||
| OneGadget::Gadget.add(build_id, 261824, | ||
| constraints: ["writable: x21+0x2e0", "writable: x24+0x4", "[x1] == NULL || x1 == NULL", "[x2] == NULL || x2 == NULL"], | ||
| effect: "execve(\"/bin/sh\", x1, x2)") | ||
|
|
44 changes: 44 additions & 0 deletions
44
lib/one_gadget/builds/libc-2.19-4eda8ff01be3fba1c7bdd442a8690c3dc7397b6a.rb
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| require 'one_gadget/gadget' | ||
| # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-amd64_2.19-0ubuntu6.14_i386/lib64/libc-2.19.so | ||
| # | ||
| # Advanced Micro Devices X86-64 | ||
| # | ||
| # GNU C Library (Ubuntu EGLIBC 2.19-0ubuntu6.14) stable release version 2.19, by Roland McGrath et al. | ||
| # Copyright (C) 2014 Free Software Foundation, Inc. | ||
| # This is free software; see the source for copying conditions. | ||
| # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A | ||
| # PARTICULAR PURPOSE. | ||
| # Compiled by GNU CC version 4.8.4. | ||
| # Compiled on a Linux 3.13.11 system on 2018-01-15. | ||
| # Available extensions: | ||
| # crypt add-on version 2.1 by Michael Glad and others | ||
| # GNU Libidn by Simon Josefsson | ||
| # Native POSIX Threads Library by Ulrich Drepper et al | ||
| # BIND-8.2.3-T5B | ||
| # libc ABIs: UNIQUE IFUNC | ||
| # For bug reporting instructions, please see: | ||
| # <https://bugs.launchpad.net/ubuntu/+source/eglibc/+bugs>. | ||
|
|
||
| build_id = File.basename(__FILE__, '.rb').split('-').last | ||
| OneGadget::Gadget.add(build_id, 274192, | ||
| constraints: ["rax == NULL"], | ||
| effect: "execve(\"/bin/sh\", rsp+0x30, environ)") | ||
| OneGadget::Gadget.add(build_id, 274276, | ||
| constraints: ["[rsp+0x30] == NULL"], | ||
| effect: "execve(\"/bin/sh\", rsp+0x30, environ)") | ||
| OneGadget::Gadget.add(build_id, 764189, | ||
| constraints: ["[rsi] == NULL || rsi == NULL", "[r12] == NULL || r12 == NULL"], | ||
| effect: "execve(\"/bin/sh\", rsi, r12)") | ||
| OneGadget::Gadget.add(build_id, 764268, | ||
| constraints: ["[[rbp-0x48]] == NULL || [rbp-0x48] == NULL", "[r12] == NULL || r12 == NULL"], | ||
| effect: "execve(\"/bin/sh\", [rbp-0x48], r12)") | ||
| OneGadget::Gadget.add(build_id, 878784, | ||
| constraints: ["[r9] == NULL || r9 == NULL", "[rdx] == NULL || rdx == NULL"], | ||
| effect: "execve(\"/bin/sh\", r9, rdx)") | ||
| OneGadget::Gadget.add(build_id, 883528, | ||
| constraints: ["[rsp+0x70] == NULL"], | ||
| effect: "execve(\"/bin/sh\", rsp+0x70, environ)") | ||
| OneGadget::Gadget.add(build_id, 883540, | ||
| constraints: ["[rsi] == NULL || rsi == NULL", "[[rax]] == NULL || [rax] == NULL"], | ||
| effect: "execve(\"/bin/sh\", rsi, [rax])") | ||
|
|
38 changes: 38 additions & 0 deletions
38
lib/one_gadget/builds/libc-2.19-509ee0c9616c4c3ed81951501a8950e1f529bbff.rb
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| require 'one_gadget/gadget' | ||
| # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-2.19-12/lib/aarch64-linux-gnu/libc-2.19.so | ||
| # | ||
| # AArch64 | ||
| # | ||
| # GNU C Library (Debian GLIBC 2.19-12) stable release version 2.19, by Roland McGrath et al. | ||
| # Copyright (C) 2014 Free Software Foundation, Inc. | ||
| # This is free software; see the source for copying conditions. | ||
| # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A | ||
| # PARTICULAR PURPOSE. | ||
| # Compiled by GNU CC version 4.8.3. | ||
| # Compiled on a Linux 3.16.5 system on 2014-10-25. | ||
| # Available extensions: | ||
| # crypt add-on version 2.1 by Michael Glad and others | ||
| # GNU Libidn by Simon Josefsson | ||
| # Native POSIX Threads Library by Ulrich Drepper et al | ||
| # BIND-8.2.3-T5B | ||
| # libc ABIs: UNIQUE | ||
| # For bug reporting instructions, please see: | ||
| # <http://www.debian.org/Bugs/>. | ||
|
|
||
| build_id = File.basename(__FILE__, '.rb').split('-').last | ||
| OneGadget::Gadget.add(build_id, 261532, | ||
| constraints: ["writable: x21+0x2d8", "x3+0x6c0 == NULL"], | ||
| effect: "execve(\"/bin/sh\", sp+0x68, environ)") | ||
| OneGadget::Gadget.add(build_id, 261540, | ||
| constraints: ["writable: x20", "writable: x21+0x2d8", "[x20] == NULL || x20 == NULL"], | ||
| effect: "execve(\"/bin/sh\", x20, environ)") | ||
| OneGadget::Gadget.add(build_id, 261616, | ||
| constraints: ["writable: x21+0x2d8", "writable: x24+0x4", "[x20] == NULL || x20 == NULL"], | ||
| effect: "execve(\"/bin/sh\", x20, environ)") | ||
| OneGadget::Gadget.add(build_id, 261628, | ||
| constraints: ["writable: x21+0x2d8", "writable: x24+0x4", "[x1] == NULL || x1 == NULL", "[[x0]] == NULL || [x0] == NULL"], | ||
| effect: "execve(\"/bin/sh\", x1, [x0])") | ||
| OneGadget::Gadget.add(build_id, 261632, | ||
| constraints: ["writable: x21+0x2d8", "writable: x24+0x4", "[x1] == NULL || x1 == NULL", "[x2] == NULL || x2 == NULL"], | ||
| effect: "execve(\"/bin/sh\", x1, x2)") | ||
|
|
41 changes: 41 additions & 0 deletions
41
lib/one_gadget/builds/libc-2.19-6aff6d091954955fe931bb720a17708513aabda7.rb
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| require 'one_gadget/gadget' | ||
| # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-i386_2.19-0ubuntu6.14_amd64/lib32/libc-2.19.so | ||
| # | ||
| # Intel 80386 | ||
| # | ||
| # GNU C Library (Ubuntu EGLIBC 2.19-0ubuntu6.14) stable release version 2.19, by Roland McGrath et al. | ||
| # Copyright (C) 2014 Free Software Foundation, Inc. | ||
| # This is free software; see the source for copying conditions. | ||
| # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A | ||
| # PARTICULAR PURPOSE. | ||
| # Compiled by GNU CC version 4.8.4. | ||
| # Compiled on a Linux 3.13.11 system on 2018-01-15. | ||
| # Available extensions: | ||
| # crypt add-on version 2.1 by Michael Glad and others | ||
| # GNU Libidn by Simon Josefsson | ||
| # Native POSIX Threads Library by Ulrich Drepper et al | ||
| # BIND-8.2.3-T5B | ||
| # libc ABIs: UNIQUE IFUNC | ||
| # For bug reporting instructions, please see: | ||
| # <https://bugs.launchpad.net/ubuntu/+source/eglibc/+bugs>. | ||
|
|
||
| build_id = File.basename(__FILE__, '.rb').split('-').last | ||
| OneGadget::Gadget.add(build_id, 261415, | ||
| constraints: ["ebx is the GOT address of libc", "[esp+0x34] == NULL"], | ||
| effect: "execve(\"/bin/sh\", esp+0x34, environ)") | ||
| OneGadget::Gadget.add(build_id, 261451, | ||
| constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"], | ||
| effect: "execve(\"/bin/sh\", eax, [esp+0x8])") | ||
| OneGadget::Gadget.add(build_id, 261455, | ||
| constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"], | ||
| effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])") | ||
| OneGadget::Gadget.add(build_id, 412772, | ||
| constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"], | ||
| effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])") | ||
| OneGadget::Gadget.add(build_id, 412778, | ||
| constraints: ["ebx is the GOT address of libc", "eax == NULL"], | ||
| effect: "execl(\"/bin/sh\", eax)") | ||
| OneGadget::Gadget.add(build_id, 412782, | ||
| constraints: ["ebx is the GOT address of libc", "[esp+0x4] == NULL"], | ||
| effect: "execl(\"/bin/sh\", [esp+0x4])") | ||
|
|
38 changes: 38 additions & 0 deletions
38
lib/one_gadget/builds/libc-2.19-8d935a42f2f2a1149aa52d3098b32b1d5012cb67.rb
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| require 'one_gadget/gadget' | ||
| # https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.19-10ubuntu2.3_arm64/lib/aarch64-linux-gnu/libc-2.19.so | ||
| # | ||
| # AArch64 | ||
| # | ||
| # GNU C Library (Ubuntu GLIBC 2.19-10ubuntu2.3) stable release version 2.19, by Roland McGrath et al. | ||
| # Copyright (C) 2014 Free Software Foundation, Inc. | ||
| # This is free software; see the source for copying conditions. | ||
| # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A | ||
| # PARTICULAR PURPOSE. | ||
| # Compiled by GNU CC version 4.8.3. | ||
| # Compiled on a Linux 3.16.7 system on 2015-02-25. | ||
| # Available extensions: | ||
| # crypt add-on version 2.1 by Michael Glad and others | ||
| # GNU Libidn by Simon Josefsson | ||
| # Native POSIX Threads Library by Ulrich Drepper et al | ||
| # BIND-8.2.3-T5B | ||
| # libc ABIs: UNIQUE | ||
| # For bug reporting instructions, please see: | ||
| # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>. | ||
|
|
||
| build_id = File.basename(__FILE__, '.rb').split('-').last | ||
| OneGadget::Gadget.add(build_id, 261724, | ||
| constraints: ["writable: x21+0x2e0", "x3+0x3b0 == NULL"], | ||
| effect: "execve(\"/bin/sh\", sp+0x68, environ)") | ||
| OneGadget::Gadget.add(build_id, 261732, | ||
| constraints: ["writable: x20", "writable: x21+0x2e0", "[x20] == NULL || x20 == NULL"], | ||
| effect: "execve(\"/bin/sh\", x20, environ)") | ||
| OneGadget::Gadget.add(build_id, 261808, | ||
| constraints: ["writable: x21+0x2e0", "writable: x24+0x4", "[x20] == NULL || x20 == NULL"], | ||
| effect: "execve(\"/bin/sh\", x20, environ)") | ||
| OneGadget::Gadget.add(build_id, 261820, | ||
| constraints: ["writable: x21+0x2e0", "writable: x24+0x4", "[x1] == NULL || x1 == NULL", "[[x0]] == NULL || [x0] == NULL"], | ||
| effect: "execve(\"/bin/sh\", x1, [x0])") | ||
| OneGadget::Gadget.add(build_id, 261824, | ||
| constraints: ["writable: x21+0x2e0", "writable: x24+0x4", "[x1] == NULL || x1 == NULL", "[x2] == NULL || x2 == NULL"], | ||
| effect: "execve(\"/bin/sh\", x1, x2)") | ||
|
|
Oops, something went wrong.