728x90
반응형
One Gadget 이란 해당 Gadget 하나만을 이용하여 Shell 을 획득 할 수 있는 Gadget
- One Gadget은 라이브러리 파일 내에서 “/bin/sh”을 실행하는 Gadget이다.
- One Gadget을 사용하기 위해서 일부 조건이 만족해야 되는 경우가 있다.
직접 찾기
lmxx@lmxx:~/workplace/adult_canary$ strings -tx libc.2.31.so.6 |grep /bin/sh 1b75aa /bin/sh lmxx@lmxx:~/workplace/adult_canary$ objdump -M intel -d libc.2.31.so.6 | grep -C8 1b75aa 54f90: 66 48 0f 6e c1 movq xmm0,rcx 54f95: 48 8d 7c 24 0c lea rdi,[rsp+0xc] 54f9a: 48 8b 05 0f 5f 19 00 mov rax,QWORD PTR [rip+0x195f0f] # 1eaeb0 <__environ@@GLIBC_2.2.5-0x4430> 54fa1: 66 0f 6c c1 punpcklqdq xmm0,xmm1 54fa5: 4c 8d 44 24 50 lea r8,[rsp+0x50] 54faa: 48 89 e9 mov rcx,rbp 54fad: 48 89 5c 24 60 mov QWORD PTR [rsp+0x60],rbx 54fb2: 4c 8b 08 mov r9,QWORD PTR [rax] 54fb5: 48 8d 35 ee 25 16 00 lea rsi,[rip+0x1625ee] # 1b75aa <_libc_intl_domainname@@GLIBC_2.2.5+0x1a5> 54fbc: 0f 29 44 24 50 movaps XMMWORD PTR [rsp+0x50],xmm0 54fc1: 48 c7 44 24 68 00 00 mov QWORD PTR [rsp+0x68],0x0 54fc8: 00 00 54fca: e8 41 a9 0b 00 call 10f910 <posix_spawn@@GLIBC_2.15> 54fcf: 48 89 ef mov rdi,rbp 54fd2: 89 c3 mov ebx,eax 54fd4: e8 37 a8 0b 00 call 10f810 <posix_spawnattr_destroy@@GLIBC_2.2.5> 54fd9: 85 db test ebx,ebx -- 872d0: 48 8b 05 d9 3b 16 00 mov rax,QWORD PTR [rip+0x163bd9] # 1eaeb0 <__environ@@GLIBC_2.2.5-0x4430> 872d7: 66 48 0f 6e c1 movq xmm0,rcx 872dc: 31 c9 xor ecx,ecx 872de: 66 0f 6c c1 punpcklqdq xmm0,xmm1 872e2: 48 8d bb e0 00 00 00 lea rdi,[rbx+0xe0] 872e9: 4c 8d 44 24 60 lea r8,[rsp+0x60] 872ee: 31 ed xor ebp,ebp 872f0: 4c 8b 08 mov r9,QWORD PTR [rax] 872f3: 48 8d 35 b0 02 13 00 lea rsi,[rip+0x1302b0] # 1b75aa <_libc_intl_domainname@@GLIBC_2.2.5+0x1a5> 872fa: 0f 29 44 24 60 movaps XMMWORD PTR [rsp+0x60],xmm0 872ff: 48 c7 44 24 78 00 00 mov QWORD PTR [rsp+0x78],0x0 87306: 00 00 87308: e8 03 86 08 00 call 10f910 <posix_spawn@@GLIBC_2.15> 8730d: 85 c0 test eax,eax 8730f: 75 41 jne 87352 <_IO_proc_open@@GLIBC_2.2.5+0x262> 87311: 48 8b 44 24 08 mov rax,QWORD PTR [rsp+0x8] 87316: 8b 7c 84 58 mov edi,DWORD PTR [rsp+rax*4+0x58] -- e6c37: 48 85 c9 test rcx,rcx e6c3a: 74 06 je e6c42 <execvpe@@GLIBC_2.11+0x242> e6c3c: 48 83 4c 0c f8 00 or QWORD PTR [rsp+rcx*1-0x8],0x0 e6c42: 48 8d 4c 24 07 lea rcx,[rsp+0x7] e6c47: 48 89 ca mov rdx,rcx e6c4a: 48 83 e1 f8 and rcx,0xfffffffffffffff8 e6c4e: 48 c1 ea 03 shr rdx,0x3 e6c52: 49 89 cf mov r15,rcx e6c55: 48 8d 0d 4e 09 0d 00 lea rcx,[rip+0xd094e] # 1b75aa <_libc_intl_domainname@@GLIBC_2.2.5+0x1a5> e6c5c: 48 89 0c d5 00 00 00 mov QWORD PTR [rdx*8+0x0],rcx e6c63: 00 e6c64: 4c 89 2c d5 08 00 00 mov QWORD PTR [rdx*8+0x8],r13 e6c6b: 00 e6c6c: 48 83 f8 01 cmp rax,0x1 e6c70: 0f 85 ea 00 00 00 jne e6d60 <execvpe@@GLIBC_2.11+0x360> e6c76: 49 c7 47 10 00 00 00 mov QWORD PTR [r15+0x10],0x0 e6c7d: 00 e6c7e: 4c 89 e2 mov rdx,r12 e6c81: 4c 89 fe mov rsi,r15 **e6c84: 48 8d 3d 1f 09 0d 00 lea rdi,[rip+0xd091f] # 1b75aa <_libc_intl_domainname@@GLIBC_2.2.5+0x1a5>** **e6c8b: e8 60 f6 ff ff call e62f0 <execve@@GLIBC_2.2.5>** e6c90: 4c 89 f4 mov rsp,r14 e6c93: e9 cd fd ff ff jmp e6a65 <execvpe@@GLIBC_2.11+0x65> e6c98: 0f 1f 84 00 00 00 00 nop DWORD PTR [rax+rax*1+0x0] e6c9f: 00 e6ca0: 48 8b 7d 98 mov rdi,QWORD PTR [rbp-0x68] e6ca4: 4c 89 f6 mov rsi,r14 e6ca7: e8 f4 e8 f3 ff call 255a0 <*ABS*+0xa3760@plt> -- e6e21: 48 39 d4 cmp rsp,rdx e6e24: 75 eb jne e6e11 <execvpe@@GLIBC_2.11+0x411> e6e26: 81 e7 ff 0f 00 00 and edi,0xfff e6e2c: 48 29 fc sub rsp,rdi e6e2f: 48 85 ff test rdi,rdi e6e32: 74 06 je e6e3a <execvpe@@GLIBC_2.11+0x43a> e6e34: 48 83 4c 3c f8 00 or QWORD PTR [rsp+rdi*1-0x8],0x0 e6e3a: 4c 8d 54 24 07 lea r10,[rsp+0x7] e6e3f: 48 8d 0d 64 07 0d 00 lea rcx,[rip+0xd0764] # 1b75aa <_libc_intl_domainname@@GLIBC_2.2.5+0x1a5> e6e46: 4c 89 d2 mov rdx,r10 e6e49: 49 83 e2 f8 and r10,0xfffffffffffffff8 e6e4d: 48 c1 ea 03 shr rdx,0x3 e6e51: 48 89 0c d5 00 00 00 mov QWORD PTR [rdx*8+0x0],rcx e6e58: 00 e6e59: 48 8b 4d 98 mov rcx,QWORD PTR [rbp-0x68] e6e5d: 48 89 0c d5 08 00 00 mov QWORD PTR [rdx*8+0x8],rcx e6e64: 00 e6e65: 48 83 f8 01 cmp rax,0x1 e6e69: 75 52 jne e6ebd <execvpe@@GLIBC_2.11+0x4bd> e6e6b: 49 c7 42 10 00 00 00 mov QWORD PTR [r10+0x10],0x0 e6e72: 00 e6e73: 4c 89 e2 mov rdx,r12 e6e76: 4c 89 d6 mov rsi,r10 e6e79: 48 8d 3d 2a 07 0d 00 lea rdi,[rip+0xd072a] # 1b75aa <_libc_intl_domainname@@GLIBC_2.2.5+0x1a5> e6e80: 4c 89 5d 88 mov QWORD PTR [rbp-0x78],r11 **e6e84: e8 67 f4 ff ff call e62f0 <execve@@GLIBC_2.2.5>** e6e89: 4c 8b 5d 88 mov r11,QWORD PTR [rbp-0x78] e6e8d: 64 41 8b 06 mov eax,DWORD PTR fs:[r14] e6e91: 4c 89 dc mov rsp,r11 e6e94: e9 6a fe ff ff jmp e6d03 <execvpe@@GLIBC_2.11+0x303> e6e99: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0] e6ea0: c6 45 97 01 mov BYTE PTR [rbp-0x69],0x1 -- e6ec5: 4c 89 ca mov rdx,r9 e6ec8: 4c 89 5d 80 mov QWORD PTR [rbp-0x80],r11 e6ecc: 4c 89 c6 mov rsi,r8 e6ecf: 4c 89 55 88 mov QWORD PTR [rbp-0x78],r10 e6ed3: e8 f8 e5 f3 ff call 254d0 <*ABS*+0xa3ad0@plt> e6ed8: 4c 8b 55 88 mov r10,QWORD PTR [rbp-0x78] e6edc: 4c 8b 5d 80 mov r11,QWORD PTR [rbp-0x80] e6ee0: eb 91 jmp e6e73 <execvpe@@GLIBC_2.11+0x473> e6ee2: 48 8d 05 c1 06 0d 00 lea rax,[rip+0xd06c1] # 1b75aa <_libc_intl_domainname@@GLIBC_2.2.5+0x1a5> e6ee9: 4c 89 6d b8 mov QWORD PTR [rbp-0x48],r13 e6eed: 49 89 e6 mov r14,rsp e6ef0: 4c 8d 7d b0 lea r15,[rbp-0x50] e6ef4: 48 89 45 b0 mov QWORD PTR [rbp-0x50],rax e6ef8: e9 79 fd ff ff jmp e6c76 <execvpe@@GLIBC_2.11+0x276> e6efd: 41 8b 55 00 mov edx,DWORD PTR [r13+0x0] e6f01: 89 10 mov DWORD PTR [rax],edx e6f03: 8b 55 a0 mov edx,DWORD PTR [rbp-0x60] e6f06: 41 8b 4c 15 fc mov ecx,DWORD PTR [r13+rdx*1-0x4] e6f0b: 89 4c 10 fc mov DWORD PTR [rax+rdx*1-0x4],ecx e6f0f: e9 cc fd ff ff jmp e6ce0 <execvpe@@GLIBC_2.11+0x2e0> e6f14: 8b 55 a0 mov edx,DWORD PTR [rbp-0x60] e6f17: 41 0f b7 4c 15 fe movzx ecx,WORD PTR [r13+rdx*1-0x2] e6f1d: 66 89 4c 10 fe mov WORD PTR [rax+rdx*1-0x2],cx e6f22: e9 b9 fd ff ff jmp e6ce0 <execvpe@@GLIBC_2.11+0x2e0> e6f27: 48 8d 05 7c 06 0d 00 lea rax,[rip+0xd067c] # 1b75aa <_libc_intl_domainname@@GLIBC_2.2.5+0x1a5> e6f2e: 49 89 e3 mov r11,rsp e6f31: 4c 8d 55 b0 lea r10,[rbp-0x50] e6f35: 48 89 45 b0 mov QWORD PTR [rbp-0x50],rax e6f39: 48 8b 45 98 mov rax,QWORD PTR [rbp-0x68] e6f3d: 48 89 45 b8 mov QWORD PTR [rbp-0x48],rax e6f41: e9 25 ff ff ff jmp e6e6b <execvpe@@GLIBC_2.11+0x46b> e6f46: e8 b5 bb 04 00 call 132b00 <__stack_chk_fail@@GLIBC_2.4> e6f4b: 0f 1f 44 00 00 nop DWORD PTR [rax+rax*1+0x0] -- 10a533: 48 8d 7c 24 68 lea rdi,[rsp+0x68] 10a538: be 00 00 08 00 mov esi,0x80000 10a53d: 44 89 c3 mov ebx,r8d 10a540: 4d 89 cd mov r13,r9 10a543: e8 78 75 00 00 call 111ac0 <pipe2@@GLIBC_2.9> 10a548: 85 c0 test eax,eax 10a54a: 0f 88 40 07 00 00 js 10ac90 <gai_strerror@@GLIBC_2.2.5+0xfc0> 10a550: f3 0f 1e fa endbr64 10a554: 48 8d 05 4f d0 0a 00 lea rax,[rip+0xad04f] # 1b75aa <_libc_intl_domainname@@GLIBC_2.2.5+0x1a5> 10a55b: c7 44 24 64 ff ff ff mov DWORD PTR [rsp+0x64],0xffffffff 10a562: ff 10a563: c1 eb 04 shr ebx,0x4 10a566: bd 02 00 00 00 mov ebp,0x2 10a56b: 48 89 44 24 70 mov QWORD PTR [rsp+0x70],rax 10a570: 48 8d 05 30 d0 0a 00 lea rax,[rip+0xad030] # 1b75a7 <_libc_intl_domainname@@GLIBC_2.2.5+0x1a2> 10a577: 83 e3 01 and ebx,0x1 10a57a: 48 c7 44 24 18 00 00 mov QWORD PTR [rsp+0x18],0x0 -- 10a726: 00 ff 10a728: 74 4f je 10a779 <gai_strerror@@GLIBC_2.2.5+0xaa9> 10a72a: 4c 8b 8c 24 f0 00 00 mov r9,QWORD PTR [rsp+0xf0] 10a731: 00 10a732: 48 8b 54 24 38 mov rdx,QWORD PTR [rsp+0x38] 10a737: 48 8d 7c 24 64 lea rdi,[rsp+0x64] 10a73c: 4c 8d 44 24 70 lea r8,[rsp+0x70] 10a741: 31 c9 xor ecx,ecx 10a743: 48 8d 35 60 ce 0a 00 lea rsi,[rip+0xace60] # 1b75aa <_libc_intl_domainname@@GLIBC_2.2.5+0x1a5> 10a74a: e8 c1 51 00 00 call 10f910 <posix_spawn@@GLIBC_2.15> 10a74f: 48 8b bc 24 f0 00 00 mov rdi,QWORD PTR [rsp+0xf0] 10a756: 00 10a757: 48 39 df cmp rdi,rbx 10a75a: 74 05 je 10a761 <gai_strerror@@GLIBC_2.2.5+0xa91> 10a75c: e8 cf ab f1 ff call 25330 <free@plt> 10a761: 66 0f 6f 15 47 53 0b movdqa xmm2,XMMWORD PTR [rip+0xb5347] # 1bfab0 <in6addr_any@@GLIBC_2.2.5+0x470> 10a768: 00 -- 10ac3c: 48 89 4c 24 18 mov QWORD PTR [rsp+0x18],rcx 10ac41: 8b 7c 24 68 mov edi,DWORD PTR [rsp+0x68] 10ac45: e8 26 6d 00 00 call 111970 <__close@@GLIBC_2.2.5> 10ac4a: 8b 44 24 60 mov eax,DWORD PTR [rsp+0x60] 10ac4e: c7 44 24 68 ff ff ff mov DWORD PTR [rsp+0x68],0xffffffff 10ac55: ff 10ac56: 85 c0 test eax,eax 10ac58: 0f 84 a0 f8 ff ff je 10a4fe <gai_strerror@@GLIBC_2.2.5+0x82e> 10ac5e: 48 8d 05 45 c9 0a 00 lea rax,[rip+0xac945] # 1b75aa <_libc_intl_domainname@@GLIBC_2.2.5+0x1a5> 10ac65: 48 8b 7c 24 38 mov rdi,QWORD PTR [rsp+0x38] 10ac6a: 31 db xor ebx,ebx 10ac6c: bd 01 00 00 00 mov ebp,0x1 10ac71: 48 89 44 24 70 mov QWORD PTR [rsp+0x70],rax 10ac76: 48 8d 05 f0 e0 0a 00 lea rax,[rip+0xae0f0] # 1b8d6d <_libc_intl_domainname@@GLIBC_2.2.5+0x1968> 10ac7d: c7 44 24 64 ff ff ff mov DWORD PTR [rsp+0x64],0xffffffff 10ac84: ff 10ac85: 66 48 0f 6e c0 movq xmm0,rax -- 110069: 75 cf jne 11003a <posix_spawnp@@GLIBC_2.15+0x70a> 11006b: e9 42 fe ff ff jmp 10feb2 <posix_spawnp@@GLIBC_2.15+0x582> 110070: 25 ff 0f 00 00 and eax,0xfff 110075: 48 29 c4 sub rsp,rax 110078: 48 85 c0 test rax,rax 11007b: 74 06 je 110083 <posix_spawnp@@GLIBC_2.15+0x753> 11007d: 48 83 4c 04 f8 00 or QWORD PTR [rsp+rax*1-0x8],0x0 110083: 4c 8d 64 24 07 lea r12,[rsp+0x7] 110088: 48 8d 0d 1b 75 0a 00 lea rcx,[rip+0xa751b] # 1b75aa <_libc_intl_domainname@@GLIBC_2.2.5+0x1a5> 11008f: 4c 89 e0 mov rax,r12 110092: 49 83 e4 f8 and r12,0xfffffffffffffff8 110096: 48 c1 e8 03 shr rax,0x3 11009a: 48 83 ef 01 sub rdi,0x1 11009e: 48 89 0c c5 00 00 00 mov QWORD PTR [rax*8+0x0],rcx 1100a5: 00 1100a6: 48 8b 8d 98 fe ff ff mov rcx,QWORD PTR [rbp-0x168] 1100ad: 48 8b 89 80 00 00 00 mov rcx,QWORD PTR [rcx+0x80] 1100b4: 48 89 0c c5 08 00 00 mov QWORD PTR [rax*8+0x8],rcx 1100bb: 00 1100bc: 7f 46 jg 110104 <posix_spawnp@@GLIBC_2.15+0x7d4> 1100be: 48 c7 04 c5 10 00 00 mov QWORD PTR [rax*8+0x10],0x0 1100c5: 00 00 00 00 00 1100ca: 48 8b 85 98 fe ff ff mov rax,QWORD PTR [rbp-0x168] 1100d1: 4c 89 e6 mov rsi,r12 1100d4: 48 8d 3d cf 74 0a 00 lea rdi,[rip+0xa74cf] # 1b75aa <_libc_intl_domainname@@GLIBC_2.2.5+0x1a5> 1100db: 48 8b 90 b0 00 00 00 mov rdx,QWORD PTR [rax+0xb0] 1100e2: ff 90 88 00 00 00 call QWORD PTR [rax+0x88] 1100e8: 4c 89 ec mov rsp,r13 1100eb: e9 c9 fd ff ff jmp 10feb9 <posix_spawnp@@GLIBC_2.15+0x589> 1100f0: 48 8b 1d 79 ad 0d 00 mov rbx,QWORD PTR [rip+0xdad79] # 1eae70 <h_errlist@@GLIBC_2.2.5+0xd50> 1100f7: f7 d8 neg eax 1100f9: 64 89 03 mov DWORD PTR fs:[rbx],eax 1100fc: 64 8b 03 mov eax,DWORD PTR fs:[rbx] -- 11a681: eb bd jmp 11a640 <endttyent@@GLIBC_2.2.5+0x150> 11a683: 48 89 ef mov rdi,rbp 11a686: e8 a5 ac f0 ff call 25330 <free@plt> 11a68b: 48 c7 05 ca 4d 0d 00 mov QWORD PTR [rip+0xd4dca],0x0 # 1ef460 <__curbrk@@GLIBC_2.2.5+0x160> 11a692: 00 00 00 00 11a696: 4c 89 e7 mov rdi,r12 11a699: e8 b2 a8 f6 ff call 84f50 <_IO_fclose@@GLIBC_2.2.5> 11a69e: 48 8d 05 6c e8 09 00 lea rax,[rip+0x9e86c] # 1b8f11 <_libc_intl_domainname@@GLIBC_2.2.5+0x1b0c> 11a6a5: 48 8d 1d fe ce 09 00 lea rbx,[rip+0x9cefe] # 1b75aa <_libc_intl_domainname@@GLIBC_2.2.5+0x1a5> 11a6ac: 66 48 0f 6e c8 movq xmm1,rax 11a6b1: 66 48 0f 6e c3 movq xmm0,rbx 11a6b6: 48 8d 05 c3 4d 0d 00 lea rax,[rip+0xd4dc3] # 1ef480 <__curbrk@@GLIBC_2.2.5+0x180> 11a6bd: 66 0f 6c c1 punpcklqdq xmm0,xmm1 11a6c1: 0f 29 05 b8 4d 0d 00 movaps XMMWORD PTR [rip+0xd4db8],xmm0 # 1ef480 <__curbrk@@GLIBC_2.2.5+0x180> 11a6c8: 48 8b 9c 24 98 00 00 mov rbx,QWORD PTR [rsp+0x98] 11a6cf: 00 11a6d0: 64 48 33 1c 25 28 00 xor rbx,QWORD PTR fs:0x28 One_Gadget 이용
sudo apt-get insatll ruby-fullsudo gem install one_gadgetone_gadget <filename>
이 글은 옵시디언을 이용해서 작성되었습니다.
728x90
반응형
'TOOR' 카테고리의 다른 글
| [TOOR] 12.2 rop_2 write_up (0) | 2023.09.24 |
|---|---|
| [TOOR] 12.1. ROP & ropasaurusrex write_up (0) | 2023.09.24 |
| [TOOR] 11.1. GOT Overwrite (0) | 2023.09.24 |
| [TOOR] 9.3. aslr_2 write up (미완) (0) | 2023.09.24 |
| [TOOR] 9.2 ASLR_1 write up (0) | 2023.09.24 |
