2020-07-15 15:43:14 +00:00
|
|
|
# PwnTools
|
|
|
|
|
2021-10-18 11:21:18 +00:00
|
|
|
```
|
2020-07-15 15:43:14 +00:00
|
|
|
pip3 install pwntools
|
|
|
|
```
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
## Pwn asm 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
Get opcodes from line or file. 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-10-18 11:21:18 +00:00
|
|
|
```
|
2020-07-15 15:43:14 +00:00
|
|
|
pwn asm "jmp esp"
|
|
|
|
pwn asm -i <filepath>
|
|
|
|
```
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
**Can select:** 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-10-18 11:21:18 +00:00
|
|
|
* output type (raw,hex,string,elf)
|
|
|
|
* output file context (16,32,64,linux,windows...)
|
2021-11-30 16:46:07 +00:00
|
|
|
* avoid bytes (new lines, null, a list) 
|
2020-07-15 15:43:14 +00:00
|
|
|
* select encoder debug shellcode using gdb run the output
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
##   **Pwn checksec**
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
Checksec script 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-10-18 11:21:18 +00:00
|
|
|
```
|
2020-07-15 15:43:14 +00:00
|
|
|
pwn checksec <executable>
|
|
|
|
```
|
|
|
|
|
|
|
|
## Pwn constgrep
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
## Pwn cyclic 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
|
|
|
Get a pattern
|
|
|
|
|
2021-10-18 11:21:18 +00:00
|
|
|
```
|
2020-07-15 15:43:14 +00:00
|
|
|
pwn cyclic 3000
|
|
|
|
pwn cyclic -l faad
|
|
|
|
```
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
**Can select:**  
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-10-18 11:21:18 +00:00
|
|
|
* The used alphabet (lowercase chars by default)
|
|
|
|
* Length of uniq pattern (default 4)
|
|
|
|
* context (16,32,64,linux,windows...)
|
|
|
|
* Take the offset (-l)
|
2020-07-15 15:43:14 +00:00
|
|
|
|
|
|
|
## Pwn debug
|
|
|
|
|
|
|
|
Attach GDB to a process
|
|
|
|
|
2021-10-18 11:21:18 +00:00
|
|
|
```
|
2020-07-15 15:43:14 +00:00
|
|
|
pwn debug --exec /bin/bash
|
|
|
|
pwn debug --pid 1234
|
|
|
|
pwn debug --process bash
|
|
|
|
```
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
**Can select:** 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
* By executable, by name or by pid context (16,32,64,linux,windows...) 
|
|
|
|
* gdbscript to execute 
|
2020-07-15 15:43:14 +00:00
|
|
|
* sysrootpath
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
## Pwn disablenx 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
Disable nx of a binary  
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-10-18 11:21:18 +00:00
|
|
|
```
|
2020-07-15 15:43:14 +00:00
|
|
|
pwn disablenx <filepath>
|
|
|
|
```
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
## Pwn disasm 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
|
|
|
Disas hex opcodes
|
|
|
|
|
2021-10-18 11:21:18 +00:00
|
|
|
```
|
2020-07-15 15:43:14 +00:00
|
|
|
pwn disasm ffe4
|
|
|
|
```
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
**Can select:** 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
* context (16,32,64,linux,windows...) 
|
|
|
|
* base addres 
|
2021-10-18 11:21:18 +00:00
|
|
|
* color(default)/no color
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
## Pwn elfdiff 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
|
|
|
Print differences between 2 fiels
|
|
|
|
|
2021-10-18 11:21:18 +00:00
|
|
|
```
|
2020-07-15 15:43:14 +00:00
|
|
|
pwn elfdiff <file1> <file2>
|
|
|
|
```
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
## Pwn hex 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
|
|
|
Get hexadecimal representation
|
|
|
|
|
|
|
|
```bash
|
|
|
|
pwn hex hola #Get hex of "hola" ascii
|
|
|
|
```
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
## Pwn phd 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
Get hexdump 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-10-18 11:21:18 +00:00
|
|
|
```
|
2020-07-15 15:43:14 +00:00
|
|
|
pwn phd <file>
|
|
|
|
```
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
 **Can select:** 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
* Number of bytes to show 
|
|
|
|
* Number of bytes per line highlight byte 
|
2020-07-15 15:43:14 +00:00
|
|
|
* Skip bytes at beginning
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
## Pwn pwnstrip 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
|
|
|
## Pwn scrable
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
## Pwn shellcraft 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
|
|
|
Get shellcodes
|
|
|
|
|
2021-10-18 11:21:18 +00:00
|
|
|
```
|
2020-07-15 15:43:14 +00:00
|
|
|
pwn shellcraft -l #List shellcodes
|
|
|
|
pwn shellcraft -l amd #Shellcode with amd in the name
|
|
|
|
pwn shellcraft -f hex amd64.linux.sh #Create in C and run
|
|
|
|
pwn shellcraft -r amd64.linux.sh #Run to test. Get shell
|
|
|
|
pwn shellcraft .r amd64.linux.bindsh 9095 #Bind SH to port
|
|
|
|
```
|
|
|
|
|
|
|
|
**Can select:**
|
|
|
|
|
|
|
|
* shellcode and arguments for the shellcode
|
|
|
|
* Out file
|
|
|
|
* output format
|
2021-10-18 11:21:18 +00:00
|
|
|
* debug (attach dbg to shellcode)
|
2021-11-30 16:46:07 +00:00
|
|
|
* before (debug trap before code) 
|
2020-07-15 15:43:14 +00:00
|
|
|
* after
|
2021-10-18 11:21:18 +00:00
|
|
|
* avoid using opcodes (default: not null and new line)
|
2020-07-15 15:43:14 +00:00
|
|
|
* Run the shellcode
|
|
|
|
* Color/no color
|
2021-11-30 16:46:07 +00:00
|
|
|
* list syscalls 
|
|
|
|
* list possible shellcodes 
|
2020-07-15 15:43:14 +00:00
|
|
|
* Generate ELF as a shared library
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
## Pwn template 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
Get a python template 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-10-18 11:21:18 +00:00
|
|
|
```
|
2020-07-15 15:43:14 +00:00
|
|
|
pwn template
|
|
|
|
```
|
|
|
|
|
|
|
|
**Can select:** host, port, user, pass, path and quiet
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
## Pwn unhex 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
From hex to string 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
2021-10-18 11:21:18 +00:00
|
|
|
```
|
2020-07-15 15:43:14 +00:00
|
|
|
pwn unhex 686f6c61
|
|
|
|
```
|
|
|
|
|
2021-11-30 16:46:07 +00:00
|
|
|
## Pwn update 
|
2020-07-15 15:43:14 +00:00
|
|
|
|
|
|
|
To update pwntools
|
|
|
|
|
2021-10-18 11:21:18 +00:00
|
|
|
```
|
2020-07-15 15:43:14 +00:00
|
|
|
pwn update
|
|
|
|
```
|