one_gadget

可通过glibc来获取shell

pip3 install one_gadget安装即可

Example

通过one_gadget libc路径找到对应的 get shell地址和 get shell的条件

如下面的

┌──(wrwrw㉿DESKTOP-1DM15A6)-[~]
└─$ one_gadget /lib/x86_64-linux-gnu/libc.so.6
0x4d74c posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
constraints:
  address rsp+0x68 is writable
  rsp & 0xf == 0
  rax == NULL || {"sh", rax, rip+0x14a6c3, r12, ...} is a valid argv
  rbx == NULL || (u16)[rbx] == NULL

0x4d753 posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
constraints:
  address rsp+0x68 is writable
  rsp & 0xf == 0
  rcx == NULL || {rcx, rax, rip+0x14a6c3, r12, ...} is a valid argv
  rbx == NULL || (u16)[rbx] == NULL

0xd636b execve("/bin/sh", rbp-0x40, r13)
constraints:
  address rbp-0x38 is writable
  rdi == NULL || {"/bin/sh", rdi, NULL} is a valid argv
  [r13] == NULL || r13 == NULL || r13 is a valid envp

例如

0x4d74c posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)#posix_spawn 类似于system 也是执行函数
constraints:#获取shell的约束条件 
  address rsp+0x68 is writable#rsp+0x68是可写的
  rsp & 0xf == 0#rsp & 0xf为0
  rax == NULL || {"sh", rax, rip+0x14a6c3, r12, ...} is a valid argv
  rbx == NULL || (u16)[rbx] == NULL