pwntools
pwntools copied to clipboard
Gallopsled
Add libc to pwn template
What is the purpose of these changes? When is it useful and how does it work?
It add a libc file argument to the pwn template. pwn template --host HOST --port PORT --libc=LIBC ./EXE
Thank you for replying, however I still do not know what the new argument does and why is it useful. Could you provide an example exploit produced by such a modified template, and justify why it is done this way?
Of course, most CTFs provide the binary and libc. As part of the exploit many times we have to take advantage of the fact that we have the appropriate libc. For example if we want to do ret2libc we want to use libc.
Attached is an exploit example exp.zip
I think adding libc argument makes sense, but the way it is proposed in this PR does not work. @ghsi10 have you tested your change at all?
With your change, we would just get libc = os.path.basename(binary) line printed out by the pwn template command. I think what you want is something like libc = ELF({libc_repr}) if I understand the syntax correctly (I have not tested it of course, please do so!).
I updated the template to be correct. I'm not sure how to compile and test it. I would appreciate an explanation :)
The quick&dirty way: just find wherever your pwntools is located, replace the relevant file(s), and run pwn template --whatever --args --you --added.
The less messy way: cd into your cloned fork and run python3 -m pwnlib.commandline.main template --whatever --args --and-so-on.
This clearly does not work. libc_repr is not defined, and therefore a NameError is raised every time libc is set.
I see that this could be a useful feature, but please please do test that your changes work before requesting a review. It will save everyone's time, and reduce the feedback round-trips count.
Great, now I can see that the template works in normal cases. However, imagine the libc is not called libc.so.6 but instead libc.'); evil_code() #.so.6 —what does the code do then? I see that this is unlikely etc, but we should do the same as we do for the EXE path, i.e. the repr thing. Please read the code carefully and copy relevant parts.