autorop.arutil package

Submodules

autorop.arutil.OpenTarget module

class autorop.arutil.OpenTarget.OpenTarget[source]

Bases: autorop.toplevel.Pipe.Pipe

__call__(state)[source]

Open a fresh target.

Parameters

  • state (PwnState) – The state with the old (if any) target and factory for targets

  • target_factory(). –

Return type

PwnState

Returns

The mutated PwnState with a fresh target connection open.

__init__()[source]

Open a fresh target.

This pipe will close the previous target connection and open a new one using target_factory().

autorop.arutil.addressify module

autorop.arutil.addressify.addressify(data)[source]

Produce the address from a data leak.

Parameters

data (bytes) – Raw bytes that were leaked.

Return type

int

Returns

The address which was part of the leak.

autorop.arutil.align_call module

autorop.arutil.align_call.align_call(rop, func, args)[source]

Align the stack prior to making a rop call to it.

Parameters

  • rop (ROP) – Current rop chain, just before making the call to the function.

  • func (str) – Symbol name of the function to call.

  • args (List[int]) – Arguments to pass to the function.

Return type

ROP

Returns

Reference to the mutated rop, performing the function call ensuring the stack is aligned.

autorop.arutil.align_rop module

autorop.arutil.align_rop.align_rop(rop, n)[source]

Pad rop to n words using ret instructions.

Parameters

  • rop (ROP) – The rop chain to pad.

  • n (int) – the minimum size of the rop chain after padding, in words.

Return type

ROP

Returns

Reference to the mutated rop chain rop, which is padded to be at least n bytes long.

autorop.arutil.debug_requests module

autorop.arutil.debug_requests.debug_requests(r)[source]

Print debugging information on a HTTP response made with requests.

Parameters

r (Response) – The response whose contents are to be logged.

Return type

None

autorop.arutil.leak_helper module

autorop.arutil.leak_helper.leak_helper(state, leaker, symbols, offset=0)[source]

Leak libc addresses using a leaking function.

This function leaks the libc addresses of symbols using rop chain built by leaker, placing them in state.leaks. leaker msut separate leaks using newlines.

Parameters

  • state (PwnState) –

    The current PwnState with the following set

    • target_factory: Producer of target to exploit.

    • _elf: pwntools ELF of state.binary_name.

    • overwriter: Function which writes rop chain to the “right place”.

    • vuln_function: Name of vulnerable function in binary, which we can return to repeatedly.

  • leaker (Callable[[ROP, int], ROP]) – function which reads arbitrary memory, newline terminated.

  • symbols (Iterable[str]) – what libc symbols we need to leak.

  • offset (int) – offset, in bytes, from the start of the GOT address of each symbol at which to begin leak, treating previous bytes as zeroes (this is helpful if the leaker function terminates on a zero byte)

Return type

PwnState

Returns

Mutated PwnState, with the following updated

  • target: The instance of target from which we got a successful leak. Hopefully it can still be interacted with.

  • leaks: Updated with "symbol": address pairs for each function address of libc that was leaked.

autorop.arutil.load_libc module

autorop.arutil.load_libc.load_libc(state)[source]

Load the libc specified in the given state into a pwntools’ ELF.

Parameters

state (PwnState) –

The state, with the following set

  • libc: Path to target’s libc.

  • libc_base: Base address of libc, or None if unknown.

Return type

ELF

Returns

Loaded ELF of the libc with attributes set as expected.

autorop.arutil.pad_rop module

autorop.arutil.pad_rop.pad_rop(rop, n)[source]

Append n ret instructions to rop.

Parameters

  • rop (ROP) – The rop chain to pad.

  • n (int) – The number of ret instructions to pad rop with.

Return type

ROP

Returns

Reference to mutated rop chain rop, which has had exactly n ret instructions appended to it.

autorop.arutil.pretty_function module

autorop.arutil.pretty_function.pretty_function(name, args)[source]

Produce a pretty textual description of a function call.

Produce a string describing a function call. This is of the form: name(args[0], args[1], …)

Parameters

  • name (str) – Name of function.

  • args (Iterable[Any]) – The arguments passed to said function.

Return type

str

Returns

Textual description of function call to the function name with the provided arguments.

Module contents