OneGadget v1.9 releases: The best tool for finding one gadget RCE

by do son · Published May 6, 2019 · Updated November 29, 2023

OneGadget

When playing ctf pwn challenges we usually need the one-gadget RCE (remote code execution), which leads to call execve(‘/bin/sh’, NULL, NULL).

This gem provides such gadgets finder, no need to use objdump or IDA-pro every time like a fool

To use this tool, type one_gadget /path/to/libc in the command line and enjoy the magic.

Changelog v1.9

Check for false positives in jmp_case_candidates by @CptGibbon in #198
Replace obsolescent egrep with grep -E by @rad4day in #199
Add --dwarf-start=0 option to remove the file path in the output by @lebr0nli in #205
Enhance the constraints for argv and envp by @lebr0nli in #206

Installation

$ gem install one_gadget

OneGadget uses symbolic execution to find the constraints of gadgets to be successful.

Usage

$ one_gadget

# Usage: one_gadget [file] [options]

#     -b, --build-id BuildID           BuildID[sha1] of libc.

#     -f, --[no-]force-file            Force search gadgets in file instead of build id first.

#     -l, --level OUTPUT_LEVEL         The output level.

#                                      OneGadget automatically selects gadgets with higher successful probability.

#                                      Increase this level to ask OneGadget show more gadgets it found.

#                                      Default: 0

#     -r, --[no-]raw                   Output gadgets offset only, split with one space.

#     -s, --script exploit-script      Run exploit script with all possible gadgets.

#                                      The script will be run as 'exploit-script $offset'.

#         --info BuildID               Show version information given BuildID.

#         --version                    Current gem version.

$ one_gadget /lib/x86_64-linux-gnu/libc.so.6

# 0x4f2c5 execve("/bin/sh", rsp+0x40, environ)

# constraints:

#   rcx == NULL

#

# 0x4f322 execve("/bin/sh", rsp+0x40, environ)

# constraints:

#   [rsp+0x40] == NULL

#

# 0x10a38c execve("/bin/sh", rsp+0x70, environ)

# constraints:

#   [rsp+0x70] == NULL

Given BuildID

$ one_gadget -b aad7dbe330f23ea00ca63daf793b766b51aceb5d

# 0x45526 execve("/bin/sh", rsp+0x30, environ)

# constraints:

#   rax == NULL

#

# 0x4557a execve("/bin/sh", rsp+0x30, environ)

# constraints:

#   [rsp+0x30] == NULL

#

# 0xf1651 execve("/bin/sh", rsp+0x40, environ)

# constraints:

#   [rsp+0x40] == NULL

#

# 0xf24cb execve("/bin/sh", rsp+0x60, environ)

# constraints:

#   [rsp+0x60] == NULL

Show All Gadgets

Sometimes one_gadget finds too many gadgets to show them in one screen, by default gadgets would be filtered automatically according to the difficulty of constraints.

Use option --level 1 to show all gadgets found instead of only those with higher probabilities.

$ one_gadget /lib/x86_64-linux-gnu/libc.so.6 --level 1

# 0x4f2c5 execve("/bin/sh", rsp+0x40, environ)

# constraints:

#   rcx == NULL

#

# 0x4f322 execve("/bin/sh", rsp+0x40, environ)

# constraints:

#   [rsp+0x40] == NULL

#

# 0xe569f execve("/bin/sh", r14, r12)

# constraints:

#   [r14] == NULL || r14 == NULL

#   [r12] == NULL || r12 == NULL

#

# 0xe5858 execve("/bin/sh", [rbp-0x88], [rbp-0x70])

# constraints:

#   [[rbp-0x88]] == NULL || [rbp-0x88] == NULL

#   [[rbp-0x70]] == NULL || [rbp-0x70] == NULL

#

# 0xe585f execve("/bin/sh", r10, [rbp-0x70])

# constraints:

#   [r10] == NULL || r10 == NULL

#   [[rbp-0x70]] == NULL || [rbp-0x70] == NULL

#

# 0xe5863 execve("/bin/sh", r10, rdx)

# constraints:

#   [r10] == NULL || r10 == NULL

#   [rdx] == NULL || rdx == NULL

#

# 0x10a38c execve("/bin/sh", rsp+0x70, environ)

# constraints:

#   [rsp+0x70] == NULL

#

# 0x10a398 execve("/bin/sh", rsi, [rax])

# constraints:

#   [rsi] == NULL || rsi == NULL

#   [[rax]] == NULL || [rax] == NULL