christhecoolhut / angry_gadget

A tool for finding the one gadget RCE in libc

Angry Gadget

Locating OneGadgets in libc.

Inspired by OneGadget this tool is written in python and uses angr to test constraints for gadgets executing execve('/bin/sh', NULL, NULL)

If you've run out gadgets to try from OneGadget, Angry Gadget gives a lot more with complicated constraints to try!

Installation

pip install angry_gadget

or

git clone https://github.com/ChrisTheCoolHut/angry_gadget.git
cd angry_gadget
pip install -e .

Usage

The python script accepts one positional argument.

$ angry_gadget.py -h
usage: angry_gadget.py [-h] binary

positional arguments:
  binary

optional arguments:
  -h, --help  show this help message and exit

Example

$ angry_gadget.py examples/libc6_2.23-0ubuntu10_amd64.so 
Building CFG, this will take a moment
100% |###############################################################################################| Elapsed Time: 0:03:08 Time:  0:03:08
Iterating over XREFs looking for gadget
100%|#######################################################################################################| 14/14 [00:01<00:00,  8.39it/s]
Trying 0x4f0fe9: 100%|######################################################################################| 16/16 [02:03<00:00,  7.75s/it]
libc_base + 0xf6661 :
	<Bool reg_rbx_114460_64{UNINITIALIZED}[60:0] == 0x1fffffffffffffff>
	<Bool !(reg_cc_dep1_114463_64{UNINITIALIZED}[6:6] == 0)>
	<Bool reg_rbp_114471_64{UNINITIALIZED} == 0xf6>
	<Bool True>
	<Bool reg_rcx_114473_64{UNINITIALIZED} <= 0xffffffffffffffff>
	<Bool reg_rcx_114473_64{UNINITIALIZED} == 0xfffffffffff80000>
libc_base + 0xf6669 :
	<Bool reg_rbx_114476_64{UNINITIALIZED}[60:0] == 0x1ffffffffffffffe>
	<Bool !(reg_cc_dep1_114478_64{UNINITIALIZED}[6:6] == 0)>
	<Bool reg_rbp_114486_64{UNINITIALIZED} == 0xf4>
	<Bool True>
	<Bool reg_rcx_114488_64{UNINITIALIZED} <= 0xffffffffffffffff>
	<Bool reg_rcx_114488_64{UNINITIALIZED} == 0x8000000000000000>
 ----- SNIP ------
libc_base + 0xf115d :
	<Bool True>
	<Bool reg_rsi_114729_64{UNINITIALIZED} <= 0xffffffffffffffff>
	<Bool reg_rsi_114729_64{UNINITIALIZED} == 0xffffffffffffffc0>
libc_base + 0x6f5bb :
	<Bool reg_rsi_114534_64{UNINITIALIZED} == 0x0>
libc_base + 0x6f5be :
	<Bool reg_rsi_114544_64{UNINITIALIZED} == 0x0>
libc_base + 0x6f5c1 :
	<Bool reg_rsi_114555_64{UNINITIALIZED} == 0x0>
libc_base + 0x6f5c3 :
	<Bool reg_rsi_114567_64{UNINITIALIZED} == 0x0>
libc_base + 0x4526a :
libc_base + 0xf02a4 :
libc_base + 0xf1147 :

Notes

• It's slower than OneGadget, so you should probably still use that.
• It's only 64bit, if there is interest, I can expand it to 32bit.