{"repo":"david942j/one_gadget","free":true,"listed":false,"github":"https://github.com/david942j/one_gadget","clone":"git clone https://github.com/david942j/one_gadget.git","description":"The best tool for finding one gadget RCE in libc.so.6","language":"Ruby","stars":2345,"topics":["ctf","pwnable","pwn","glibc","one-gadget-rce","shell","exploit","gadget","libc"],"license":"MIT","category":"cli-tools","readme_excerpt":"OneGadget When playing ctf pwn challenges we usually need the one-gadget RCE (remote code execution), which leads to call execve('/bin/sh', NULL, NULL) . This gem provides such gadgets finder, no need to use objdump or IDA-pro every time like a fool :wink: To use this tool, type one gadget /path/to/libc in command line and enjoy the magic :laughing: Installation Available on RubyGems.org! Note: requires ruby version = 2.1.0, you can use ruby --version to check. Supported Architectures - [x] i386 - [x] amd64 (x86-64) - [x] aarch64 (ARMv8) - [x] arm (ARMv7, A32/Thumb-2) Implementation OneGadget uses symbolic execution to find the constraints of gadgets to be successful. Gadgets are found by walking the control-flow graph backward from each exec / posix spawn call, following conditional branches both ways. When a gadget is only reachable if a branch is (not) taken, that decision shows up as an extra constraint, e.g. x2 == 0x1 . The article introducing how I develop this tool can be found on my blog. Usage Command Line Interface Given BuildID Gadgets Near Functions Why Consider this scenario when exploiting: 1. Able to write on GOT (Global Offset Table) 2. Base address of libc is unknown In this scenario you can choose to write two low-byte on a GOT entry with one-gadget's two low-byte. If the function offset on GOT is close enough with the one-gadget, you will have at least 1/16 chance of success. Usage Reorder gadgets according to the distance of given functions. Regular expres","default_branch":null,"files":null,"tree":[],"storefront":"/r/david942j","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/david942j/one_gadget/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}