Skip to content

Commit

Permalink
Update libcdb (david942j#132)
Browse files Browse the repository at this point in the history
  • Loading branch information
@david942j
david942j committed Oct 18, 2020
1 parent 85a9cd5 commit bd1a6c2
Show file tree
Hide file tree
Showing 25 changed files with 881 additions and 0 deletions.
24 changes: 24 additions & 0 deletions builds_list
View file
Original file line number Diff line number Diff line change
Expand Up @@ -569,8 +569,10 @@ libc-2.23-b2994712adbb4db7b768554149443ddee829cb91
libc-2.23-b5381a457906d279073822a5ceb24c4bfef94ddb
libc-2.23-b8aaf9d529588ee96e6e399ab8a15cbd58ab8b54
libc-2.23-b978afd6ca2cf3f8768d6055581ece3c3e7d7b27
libc-2.23-bde4e8b0230b1b474cd8a1ca6e9f81bb2b438914
libc-2.23-c0a199289365088782dcaceab6a81721d0d8ae0c
libc-2.23-c0cc47b9f732f8150eb2bbfb18d0d60a7b3564a9
libc-2.23-c4fd86ec1eed57a09c79ce601f6c6e3796f574df
libc-2.23-cbfa941a8eb7a11e4f90e81b66fcd5a820995d7c
libc-2.23-d10743a8f3a9a7a2e9807b1af78026c0b5363f6b
libc-2.23-d10fbfd9328f5ffaca50aa93562cb3bfb618fbcc
Expand All @@ -590,7 +592,9 @@ libc-2.23-ee0b5a0f65e25f536a868d84e1d912403b56e742
libc-2.23-ee525f6c9b018c094beedd17b87a4573d7ea7e2e
libc-2.23-f0c2e03955a845c9a7f9c85228b12c9700d66c50
libc-2.23-f202f01f10e845e14e7d8ca44cf5d9e4742fca6a
libc-2.23-f303ce47c562225a4f3475170333494965760a6a
libc-2.23-f33f3937b8f458ffd96cf10a22deea1bd85ac61a
libc-2.23-f4490657edfef482025fff60e85acd5928e0d05b
libc-2.23-ffb3662a7bc5e136fa8f464fc14ec23efb8d1817
libc-2.23.90-203feaf8a7e40cef8a75568a406a22fdeda94f8b
libc-2.23.90-392b643118f919a1827477e978d9cea2b09a34fc
Expand Down Expand Up @@ -713,11 +717,19 @@ libc-2.26-d4dd444f86cfc66c97c5e3eecb69fc5b86ea6539
libc-2.26-ddcc13122ddbfe5e5ef77d4ebe66d124ae5762c2
libc-2.26-f65648a832414f2144ce795d75b6045a1ec2e252
libc-2.26-fb587bc4429e7d1b0de31a3b9ee8ae78ee797eb0
libc-2.27-06a8004be6e10c4aeabbe0db74423ace392a2d6b
libc-2.27-0e188ec5f09c187a7a92784d4b97aa251b15a93c
libc-2.27-2d1c5e0b85cb06ff47fa6fa088ec22cb6e06074e
libc-2.27-4b06dfe2c46f5e537b3d0a310ab0bda11bcbd681
libc-2.27-53f40c1d2f3739ae017dcdcef1a17314786e3709
libc-2.27-63b3d43ad45e1b0f601848c65b067f9e9b40528b
libc-2.27-9dd0bb57f81671704475d1e5163405f7b4d4b454
libc-2.27-afdabd83c53f0fc60a059c3305c4f3b57198e51b
libc-2.27-b417c0ba7cc5cf06d1d1bed6652cedb9253c60d0
libc-2.27-cc6dd208d3af4bc505f599a90ef8af52f16116e4
libc-2.27-cf1599aa8b3cb35f79dcaea7a8b48704ecf42a19
libc-2.27-d1237c55f6778f53b369cf22ff81979b2fe340bb
libc-2.27-d3cf764b2f97ac3efe366ddd07ad902fb6928fd7
libc-2.28-26b3c1a40c8a0bd026975a262774bf52aec55107
libc-2.28-44f5a3efb0e5733fa9d97e690cb36cd4c682bcdb
libc-2.28-5784a31a1c26f6d2157e585205ebb63dd19ff90f
Expand All @@ -736,20 +748,32 @@ libc-2.30-3f72ae987c135c35f2e721c61991ec46df8816ab
libc-2.30-4ab6143b59defc12c3d50d176c78b4e6e5a2c179
libc-2.30-71373fd43ed6a83e0aab983c3a971e32d459e15f
libc-2.30-75e3e2d9596aae251330ae7ef3f91a847fc62641
libc-2.30-884362aa891ab565e4cf904cd60be984a7941acd
libc-2.30-93abe093a13b9b10f83b5e6de4a63a0d29175c89
libc-2.30-bef538440d5b4b0ac6b4575acb3aac4a65316061
libc-2.30-c0a4471ee8f24f2ecc0ad1ccbd4633fa6fa36654
libc-2.30-c60a7605ae87b9b40426e3123b12a91bfe2036f3
libc-2.30-c841931c41e7affad89dfe70a45f01afafa9a37a
libc-2.30-cbe9cff3c43b979739af1681b61a3d585725577b
libc-2.30-cd779a06a5df37cdad8dfcfa12cb2c8db36f62f4
libc-2.30-dc43d2c2d727158000c9bef6d47e17722d41ec2d
libc-2.30-e3e238714a7998a958651faa0a5e97fafa229ec3
libc-2.30-f07144cc3d0ac50415f3a2e061be6da672c914ba
libc-2.30-f44469d65b4efd2e5951513ed7cbf773657f1283
libc-2.31-05dd8f45f3f82869e5ca8cb214475816e41f469a
libc-2.31-0df979b8b244294bbc29bbe8f7f6dd6bf89c6820
libc-2.31-634252e0c5f8b03957a2e529719d4101699a894a
libc-2.31-6c6ea8a57519f219a10c9d6a6d199dd813680226
libc-2.31-6fe07009bc57e6917030d052370d8bed414dd7c0
libc-2.31-78702aff0796336ccdd432310ba6f84c728c9b3c
libc-2.31-8614995a8f0152ad4b1b45e28070588546ca7ac8
libc-2.31-a9053cb60c51ead85c68c941ca4d02f9381844f9
libc-2.31-b61d34c10e608722a90d339bd9a7ff28b18cd501
libc-2.31-cdaf4c7a78acdea7ede78ea0240a3d8d5833110f
libc-2.31-eb3c5cf73a0a6b7f2b3895a56dbc443806700971
libc-2.31-f3aa1ef59e51e64ff8438f46d225e4ae256c1b03
libc-2.31-f3ff3fda80b817c464a56eed59ff09dc864eaeb0
libc-2.32-0e5c8d8738927eb715941480b3726fa764cc50ed
libc-2.32-7ec3e74da842ca3c6a9ba20b21303ce1bc7a45af
libc-2.32-a75b0c335a4987f12d17d3b4adb8dc430432b082
libc-2.32-e13b24f94b260dd6394bdb2433d2a78e37078d5c
46 changes: 46 additions & 0 deletions lib/one_gadget/builds/libc-2.23-bde4e8b0230b1b474cd8a1ca6e9f81bb2b438914.rb
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
require 'one_gadget/gadget'
# https://gitlab.com/david942j/libcdb/blob/master/libc/libc6_2.23-0ubuntu11.2_i386/lib/i386-linux-gnu/libc-2.23.so
#
# Intel 80386
#
# GNU C Library (Ubuntu GLIBC 2.23-0ubuntu11.2) stable release version 2.23, by Roland McGrath et al.
# Copyright (C) 2016 Free Software Foundation, Inc.
# This is free software; see the source for copying conditions.
# There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
# PARTICULAR PURPOSE.
# Compiled by GNU CC version 5.4.0 20160609.
# Available extensions:
# crypt add-on version 2.1 by Michael Glad and others
# GNU Libidn by Simon Josefsson
# Native POSIX Threads Library by Ulrich Drepper et al
# BIND-8.2.3-T5B
# libc ABIs: UNIQUE IFUNC
# For bug reporting instructions, please see:
# <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.

build_id = File.basename(__FILE__, '.rb').split('-').last
OneGadget::Gadget.add(build_id, 240748,
constraints: ["esi is the GOT address of libc", "[esp+0x28] == NULL"],
effect: "execve(\"/bin/sh\", esp+0x28, environ)")
OneGadget::Gadget.add(build_id, 240750,
constraints: ["esi is the GOT address of libc", "[esp+0x2c] == NULL"],
effect: "execve(\"/bin/sh\", esp+0x2c, environ)")
OneGadget::Gadget.add(build_id, 240754,
constraints: ["esi is the GOT address of libc", "[esp+0x30] == NULL"],
effect: "execve(\"/bin/sh\", esp+0x30, environ)")
OneGadget::Gadget.add(build_id, 240761,
constraints: ["esi is the GOT address of libc", "[esp+0x34] == NULL"],
effect: "execve(\"/bin/sh\", esp+0x34, environ)")
OneGadget::Gadget.add(build_id, 240796,
constraints: ["esi is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp]] == NULL || [esp] == NULL"],
effect: "execve(\"/bin/sh\", eax, [esp])")
OneGadget::Gadget.add(build_id, 240797,
constraints: ["esi is the GOT address of libc", "[[esp]] == NULL || [esp] == NULL", "[[esp+0x4]] == NULL || [esp+0x4] == NULL"],
effect: "execve(\"/bin/sh\", [esp], [esp+0x4])")
OneGadget::Gadget.add(build_id, 392149,
constraints: ["esi is the GOT address of libc", "eax == NULL"],
effect: "execl(\"/bin/sh\", eax)")
OneGadget::Gadget.add(build_id, 392150,
constraints: ["esi is the GOT address of libc", "[esp] == NULL"],
effect: "execl(\"/bin/sh\", [esp])")

46 changes: 46 additions & 0 deletions lib/one_gadget/builds/libc-2.23-c4fd86ec1eed57a09c79ce601f6c6e3796f574df.rb
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
require 'one_gadget/gadget'
# https://gitlab.com/david942j/libcdb/blob/master/libc/libc6_2.23-0ubuntu11.2_amd64/lib/x86_64-linux-gnu/libc-2.23.so
#
# Advanced Micro Devices X86-64
#
# GNU C Library (Ubuntu GLIBC 2.23-0ubuntu11.2) stable release version 2.23, by Roland McGrath et al.
# Copyright (C) 2016 Free Software Foundation, Inc.
# This is free software; see the source for copying conditions.
# There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
# PARTICULAR PURPOSE.
# Compiled by GNU CC version 5.4.0 20160609.
# Available extensions:
# crypt add-on version 2.1 by Michael Glad and others
# GNU Libidn by Simon Josefsson
# Native POSIX Threads Library by Ulrich Drepper et al
# BIND-8.2.3-T5B
# libc ABIs: UNIQUE IFUNC
# For bug reporting instructions, please see:
# <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.

build_id = File.basename(__FILE__, '.rb').split('-').last
OneGadget::Gadget.add(build_id, 283174,
constraints: ["rax == NULL"],
effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
OneGadget::Gadget.add(build_id, 283258,
constraints: ["[rsp+0x30] == NULL"],
effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
OneGadget::Gadget.add(build_id, 840051,
constraints: ["[rcx] == NULL || rcx == NULL", "[r12] == NULL || r12 == NULL"],
effect: "execve(\"/bin/sh\", rcx, r12)")
OneGadget::Gadget.add(build_id, 840264,
constraints: ["[rax] == NULL || rax == NULL", "[r12] == NULL || r12 == NULL"],
effect: "execve(\"/bin/sh\", rax, r12)")
OneGadget::Gadget.add(build_id, 983908,
constraints: ["[rsp+0x50] == NULL"],
effect: "execve(\"/bin/sh\", rsp+0x50, environ)")
OneGadget::Gadget.add(build_id, 983920,
constraints: ["[rsi] == NULL || rsi == NULL", "[[rax]] == NULL || [rax] == NULL"],
effect: "execve(\"/bin/sh\", rsi, [rax])")
OneGadget::Gadget.add(build_id, 987655,
constraints: ["[rsp+0x70] == NULL"],
effect: "execve(\"/bin/sh\", rsp+0x70, environ)")
OneGadget::Gadget.add(build_id, 1009584,
constraints: ["[rcx] == NULL || rcx == NULL", "[[rbp-0xf8]] == NULL || [rbp-0xf8] == NULL"],
effect: "execve(\"/bin/sh\", rcx, [rbp-0xf8])")

43 changes: 43 additions & 0 deletions lib/one_gadget/builds/libc-2.23-f303ce47c562225a4f3475170333494965760a6a.rb
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
require 'one_gadget/gadget'
# https://gitlab.com/david942j/libcdb/blob/master/libc/libc6-amd64_2.23-0ubuntu11.2_i386/lib64/libc-2.23.so
#
# Advanced Micro Devices X86-64
#
# GNU C Library (Ubuntu GLIBC 2.23-0ubuntu11.2) stable release version 2.23, by Roland McGrath et al.
# Copyright (C) 2016 Free Software Foundation, Inc.
# This is free software; see the source for copying conditions.
# There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
# PARTICULAR PURPOSE.
# Compiled by GNU CC version 5.4.0 20160609.
# Available extensions:
# crypt add-on version 2.1 by Michael Glad and others
# GNU Libidn by Simon Josefsson
# Native POSIX Threads Library by Ulrich Drepper et al
# BIND-8.2.3-T5B
# libc ABIs: UNIQUE IFUNC
# For bug reporting instructions, please see:
# <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.

build_id = File.basename(__FILE__, '.rb').split('-').last
OneGadget::Gadget.add(build_id, 259286,
constraints: ["rax == NULL"],
effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
OneGadget::Gadget.add(build_id, 259370,
constraints: ["[rsp+0x30] == NULL"],
effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
OneGadget::Gadget.add(build_id, 753847,
constraints: ["[rsi] == NULL || rsi == NULL", "[r12] == NULL || r12 == NULL"],
effect: "execve(\"/bin/sh\", rsi, r12)")
OneGadget::Gadget.add(build_id, 754056,
constraints: ["[[rbp-0x40]] == NULL || [rbp-0x40] == NULL", "[r12] == NULL || r12 == NULL"],
effect: "execve(\"/bin/sh\", [rbp-0x40], r12)")
OneGadget::Gadget.add(build_id, 875223,
constraints: ["[rsp+0x70] == NULL"],
effect: "execve(\"/bin/sh\", rsp+0x70, environ)")
OneGadget::Gadget.add(build_id, 875235,
constraints: ["[rsi] == NULL || rsi == NULL", "[[rax]] == NULL || [rax] == NULL"],
effect: "execve(\"/bin/sh\", rsi, [rax])")
OneGadget::Gadget.add(build_id, 889985,
constraints: ["[r9] == NULL || r9 == NULL", "[rdx] == NULL || rdx == NULL"],
effect: "execve(\"/bin/sh\", r9, rdx)")

46 changes: 46 additions & 0 deletions lib/one_gadget/builds/libc-2.23-f4490657edfef482025fff60e85acd5928e0d05b.rb
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
require 'one_gadget/gadget'
# https://gitlab.com/david942j/libcdb/blob/master/libc/libc6-i386_2.23-0ubuntu11.2_amd64/lib32/libc-2.23.so
#
# Intel 80386
#
# GNU C Library (Ubuntu GLIBC 2.23-0ubuntu11.2) stable release version 2.23, by Roland McGrath et al.
# Copyright (C) 2016 Free Software Foundation, Inc.
# This is free software; see the source for copying conditions.
# There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
# PARTICULAR PURPOSE.
# Compiled by GNU CC version 5.4.0 20160609.
# Available extensions:
# crypt add-on version 2.1 by Michael Glad and others
# GNU Libidn by Simon Josefsson
# Native POSIX Threads Library by Ulrich Drepper et al
# BIND-8.2.3-T5B
# libc ABIs: UNIQUE IFUNC
# For bug reporting instructions, please see:
# <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.

build_id = File.basename(__FILE__, '.rb').split('-').last
OneGadget::Gadget.add(build_id, 239644,
constraints: ["esi is the GOT address of libc", "[esp+0x28] == NULL"],
effect: "execve(\"/bin/sh\", esp+0x28, environ)")
OneGadget::Gadget.add(build_id, 239646,
constraints: ["esi is the GOT address of libc", "[esp+0x2c] == NULL"],
effect: "execve(\"/bin/sh\", esp+0x2c, environ)")
OneGadget::Gadget.add(build_id, 239650,
constraints: ["esi is the GOT address of libc", "[esp+0x30] == NULL"],
effect: "execve(\"/bin/sh\", esp+0x30, environ)")
OneGadget::Gadget.add(build_id, 239657,
constraints: ["esi is the GOT address of libc", "[esp+0x34] == NULL"],
effect: "execve(\"/bin/sh\", esp+0x34, environ)")
OneGadget::Gadget.add(build_id, 239692,
constraints: ["esi is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp]] == NULL || [esp] == NULL"],
effect: "execve(\"/bin/sh\", eax, [esp])")
OneGadget::Gadget.add(build_id, 239693,
constraints: ["esi is the GOT address of libc", "[[esp]] == NULL || [esp] == NULL", "[[esp+0x4]] == NULL || [esp+0x4] == NULL"],
effect: "execve(\"/bin/sh\", [esp], [esp+0x4])")
OneGadget::Gadget.add(build_id, 389237,
constraints: ["esi is the GOT address of libc", "eax == NULL"],
effect: "execl(\"/bin/sh\", eax)")
OneGadget::Gadget.add(build_id, 389238,
constraints: ["esi is the GOT address of libc", "[esp] == NULL"],
effect: "execl(\"/bin/sh\", [esp])")

47 changes: 47 additions & 0 deletions lib/one_gadget/builds/libc-2.27-06a8004be6e10c4aeabbe0db74423ace392a2d6b.rb
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
require 'one_gadget/gadget'
# https://gitlab.com/david942j/libcdb/blob/master/libc/libc6-i386_2.27-3ubuntu1.3_amd64/lib32/libc-2.27.so
#
# Intel 80386
#
# GNU C Library (Ubuntu GLIBC 2.27-3ubuntu1.3) stable release version 2.27.
# Copyright (C) 2018 Free Software Foundation, Inc.
# This is free software; see the source for copying conditions.
# There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
# PARTICULAR PURPOSE.
# Compiled by GNU CC version 7.5.0.
# libc ABIs: UNIQUE IFUNC
# For bug reporting instructions, please see:
# <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.

build_id = File.basename(__FILE__, '.rb').split('-').last
OneGadget::Gadget.add(build_id, 249066,
constraints: ["esi is the GOT address of libc", "[esp+0x34] == NULL"],
effect: "execve(\"/bin/sh\", esp+0x34, environ)")
OneGadget::Gadget.add(build_id, 249068,
constraints: ["esi is the GOT address of libc", "[esp+0x38] == NULL"],
effect: "execve(\"/bin/sh\", esp+0x38, environ)")
OneGadget::Gadget.add(build_id, 249072,
constraints: ["esi is the GOT address of libc", "[esp+0x3c] == NULL"],
effect: "execve(\"/bin/sh\", esp+0x3c, environ)")
OneGadget::Gadget.add(build_id, 249079,
constraints: ["esi is the GOT address of libc", "[esp+0x40] == NULL"],
effect: "execve(\"/bin/sh\", esp+0x40, environ)")
OneGadget::Gadget.add(build_id, 249114,
constraints: ["esi is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp]] == NULL || [esp] == NULL"],
effect: "execve(\"/bin/sh\", eax, [esp])")
OneGadget::Gadget.add(build_id, 249115,
constraints: ["esi is the GOT address of libc", "[[esp]] == NULL || [esp] == NULL", "[[esp+0x4]] == NULL || [esp+0x4] == NULL"],
effect: "execve(\"/bin/sh\", [esp], [esp+0x4])")
OneGadget::Gadget.add(build_id, 422815,
constraints: ["esi is the GOT address of libc", "eax == NULL"],
effect: "execl(\"/bin/sh\", eax)")
OneGadget::Gadget.add(build_id, 422816,
constraints: ["esi is the GOT address of libc", "[esp] == NULL"],
effect: "execl(\"/bin/sh\", [esp])")
OneGadget::Gadget.add(build_id, 1267262,
constraints: ["ebx is the GOT address of libc", "eax == NULL"],
effect: "execl(\"/bin/sh\", eax)")
OneGadget::Gadget.add(build_id, 1267263,
constraints: ["ebx is the GOT address of libc", "[esp] == NULL"],
effect: "execl(\"/bin/sh\", [esp])")

47 changes: 47 additions & 0 deletions lib/one_gadget/builds/libc-2.27-2d1c5e0b85cb06ff47fa6fa088ec22cb6e06074e.rb
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
require 'one_gadget/gadget'
# https://gitlab.com/david942j/libcdb/blob/master/libc/libc6-i386_2.27-3ubuntu1.2_amd64/lib32/libc-2.27.so
#
# Intel 80386
#
# GNU C Library (Ubuntu GLIBC 2.27-3ubuntu1.2) stable release version 2.27.
# Copyright (C) 2018 Free Software Foundation, Inc.
# This is free software; see the source for copying conditions.
# There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
# PARTICULAR PURPOSE.
# Compiled by GNU CC version 7.5.0.
# libc ABIs: UNIQUE IFUNC
# For bug reporting instructions, please see:
# <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.

build_id = File.basename(__FILE__, '.rb').split('-').last
OneGadget::Gadget.add(build_id, 248922,
constraints: ["esi is the GOT address of libc", "[esp+0x34] == NULL"],
effect: "execve(\"/bin/sh\", esp+0x34, environ)")
OneGadget::Gadget.add(build_id, 248924,
constraints: ["esi is the GOT address of libc", "[esp+0x38] == NULL"],
effect: "execve(\"/bin/sh\", esp+0x38, environ)")
OneGadget::Gadget.add(build_id, 248928,
constraints: ["esi is the GOT address of libc", "[esp+0x3c] == NULL"],
effect: "execve(\"/bin/sh\", esp+0x3c, environ)")
OneGadget::Gadget.add(build_id, 248935,
constraints: ["esi is the GOT address of libc", "[esp+0x40] == NULL"],
effect: "execve(\"/bin/sh\", esp+0x40, environ)")
OneGadget::Gadget.add(build_id, 248970,
constraints: ["esi is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp]] == NULL || [esp] == NULL"],
effect: "execve(\"/bin/sh\", eax, [esp])")
OneGadget::Gadget.add(build_id, 248971,
constraints: ["esi is the GOT address of libc", "[[esp]] == NULL || [esp] == NULL", "[[esp+0x4]] == NULL || [esp+0x4] == NULL"],
effect: "execve(\"/bin/sh\", [esp], [esp+0x4])")
OneGadget::Gadget.add(build_id, 422671,
constraints: ["esi is the GOT address of libc", "eax == NULL"],
effect: "execl(\"/bin/sh\", eax)")
OneGadget::Gadget.add(build_id, 422672,
constraints: ["esi is the GOT address of libc", "[esp] == NULL"],
effect: "execl(\"/bin/sh\", [esp])")
OneGadget::Gadget.add(build_id, 1268030,
constraints: ["ebx is the GOT address of libc", "eax == NULL"],
effect: "execl(\"/bin/sh\", eax)")
OneGadget::Gadget.add(build_id, 1268031,
constraints: ["ebx is the GOT address of libc", "[esp] == NULL"],
effect: "execl(\"/bin/sh\", [esp])")

Loading

0 comments on commit bd1a6c2

Please sign in to comment.