pwnscripts - 加速二进制漏洞利用的非常简单的脚本

项目说明

pwnscripts (0.6.0)

![Tests]()
![PyPI package]()
![Python]()

Very simple script(s) to hasten binary exploit creation. To use, pip install pwnscripts OR run

and replace from pwn import * with from pwnscripts import *, e.g.

Additionally, the libc_database() extension of pwnscripts requires the libc-database.

You might want to look at some of the examples in user_tests_and_examples.py.

Features

Pwnscripts has a number of different features.

Libc

Things like LibcSearcher ha felt incomplete.

Pwnscripts provides two libc classes: libc() and libc_database(). The easiest way to start with both is with context:

Anything you can run with ./libc-database/[executable] is a as a libc_database() method:

libc_database() also has a few additional methods; you can look at the tests and examples and documentation to see.

---

The libc() object is a subclass of pwntools' pwnlib.elf.elf.ELF(). It starts off with a base address of 0, but you can change that to match a remote executable by pro it with leaked addresses:

pwnscripts is smart about context.binary: if context.libc is set, context.binary.process() will run with that libc :

libc() provides one_gadget integration in the form of an interacti:

You're free to shut up the interactive menu by giving .select_gadget() an argument:

More features exist, but this is already too long.

Format string exploitation

printf() challenges are repetiti the fsb module, pwnscripts makes an attempt to further abstract the process of printf() exploitation.

Consider this simple program:

Let's further assume that you' to exploit this by returning to libc with the buffer o present. printf() can leak the runtime of the stack canary && libc page, but only after figuring out the specific stack offset (i.e. figuring out _m_ for %m$p) for both of those .

Similar to the FmtStr() class in pwntools, we'll start by setting up a python function to abstract away the i/o associated with this challenge in particular:

With this function, We can automate the process of offset identification with fsb.leak_offset:

With the canary found, we can move on to leaking libc. Since __libc_start_main_ret is located immediately after the canary in the stack, the printf() cache maintained by fsb.find_offset will speed things up immensely:

More examples can be found here and here.

---

Apart from offset bruteforcing, pwnscripts.fsb also contains a .leak submodule to make leaking with %s more programmatic.

The simple idea is that you get a payload to leak printf :

And after sending the payload, extract the with a helper function:

Minor features

Pwnscripts also comes with a few minor extensions and functions:
* util: utility functions absent from pwntools. Some of the more useful things:
* is_addr is an object you can use to check for specific address types. e.g.

These functions are heuristic-based: they don't guarantee correctness, but tend to hit the mark nonetheless.
* unpack_*: Better unpacking functions. Some examples:

* rop.py: an extension of pwntools' pwnlib.rop.rop.ROP. Core feature is to simplify ROP building outside of SIGROP:

* As was implicit in prior sections, context has been expanded with a number of extra attributes:
* .libc and .libc_database, which are useful for e mentioned above
* .is_local, to check if the most recently opened pwntools tube is a remote/local process
* other unlisted features in de

Proper examples for pwnscripts are a in examples/ and user_tests_and_examples.py.

I tried using it; it doesn't work!

File in an issue, if you can. With a single-digit userbase, it's hard to guess what might go wrong, but potentially:
* pwnscripts is broken
* Python is outdated (try python3.8+)
* libc-database is not properly installed/initialised (did you run ./get?)
* The binary provided is neither i386 or amd64; other architectures are mostly ignored (out of necessity)
* The challenge is amd64, but context.arch wasn't set to amd64

* Set context.binary appropriately, or set context.arch manually if no binary is given
* Other unknown reasons. Try making a pull-request if you're interested.

Updates

See CHANGELOG.md.

Although numbers follow the Semantic format, backwards compatibility is ne; historical pwnscripts behaviour will be broken where appropriate.

Gradual updates expected as I continue to do pwn.

项目信息

开发语言：Python

Star 数：94

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Very simple script(s) to hasten binary exploit creation展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。