┌──(ph03n1x㉿kali)-[~/tools/pwnpasi]
└─$ python pwnpasi.py -l ~/Desktop/test/pwn
/home/ph03n1x/tools/pwnpasi/pwnpasi.py:92: SyntaxWarning: invalid escape sequence '\ '
____ ____ _
| _ \ __ ___ _| _ \ __ _ ___(_)
| |_) |\ \ /\ / / '_ \ |_) / _` / __| |
| __/ \ V V /| | | | __/ (_| \__ \ |
|_| \_/\_/ |_| |_|_| \__,_|___/_|
Automated Binary Exploitation Framework v3.0
by Security Research Team
https://github.com/heimao-box/pwnpasi
[] [11:42:49] target binary: /home/ph03n1x/Desktop/test/pwn
[] [11:42:49] local exploitation mode
[*] [11:42:49] detecting libc path automatically
[+] [11:42:49] libc path detected: /lib/x86_64-linux-gnu/libc.so.6
┌────────────────────────────────────────────────────────────┐
│ BINARY ANALYSIS PHASE │
└────────────────────────────────────────────────────────────┘
[] [11:42:49] setting executable permissions
[] [11:42:49] collecting binary security information
[*] [11:42:49] collecting binary information
┌────────────────────────────────────────────────────────────┐
│ BINARY SECURITY ANALYSIS │
└────────────────────────────────────────────────────────────┘
Feature | Status | Risk Level
Stack Canary | No canary found | HIGH
NX Bit | NX enabled | LOW
PIE | PIE enabled | LOW
RWX Segments | Unknown | LOW
┌────────────────────────────────────────────────────────────┐
│ FUNCTION ANALYSIS │
└────────────────────────────────────────────────────────────┘
[] [11:42:49] scanning PLT functions
[] [11:42:49] analyzing PLT table and available functions
┌────────────────────────────────────────────────────────────┐
│ FUNCTION ANALYSIS │
└────────────────────────────────────────────────────────────┘
Function | Address | Available
write | N/A | NO
puts | 0000000000001110 | YES
printf | N/A | NO
main | 0000000000001331 | YES
system | N/A | NO
backdoor | N/A | NO
callsystem | N/A | NO
[*] [11:42:49]
┌────────────────────────────────────────────────────────────┐
│ ROP GADGET DISCOVERY │
└────────────────────────────────────────────────────────────┘
[] [11:42:49] searching for x64 ROP gadgets
[] [11:42:49] searching for ROP gadgets (x64)
┌────────────────────────────────────────────────────────────┐
│ ROP GADGETS (x64) │
└────────────────────────────────────────────────────────────┘
Gadget Type | Address | Instruction
ret | 0x000000000000101a | ret
[*] [11:42:49]
┌────────────────────────────────────────────────────────────┐
│ PADDING CALCULATION │
└────────────────────────────────────────────────────────────┘
[] [11:42:49] performing dynamic stack overflow testing
[] [11:42:49] testing for stack overflow vulnerability
┌────────────────────────────────────────────────────────────┐
│ STACK OVERFLOW DETECTION │
└────────────────────────────────────────────────────────────┘
[] Testing overflow: [██████████████████████████████] 100%[] [11:42:50]
[+] [11:42:50] stack overflow detected! Padding: 8 bytes
[*] [11:42:50] performing assembly-based overflow analysis
┌────────────────────────────────────────────────────────────┐
│ STRING ANALYSIS │
└────────────────────────────────────────────────────────────┘
[] [11:42:50] searching for /bin/sh string in binary
[] [11:42:50] checking for /bin/sh string
[!] [11:42:50] /bin/sh string not found in binary
[*] [11:42:50] testing for stack overflow vulnerability
┌────────────────────────────────────────────────────────────┐
│ STACK OVERFLOW DETECTION │
└────────────────────────────────────────────────────────────┘
[] Testing overflow: [██████████████████████████████] 100%[] [11:42:50]
[+] [11:42:50] stack overflow detected! Padding: 8 bytes
[*] [11:42:50] performing assembly-based overflow analysis
┌────────────────────────────────────────────────────────────┐
│ EXPLOITATION PHASE │
└────────────────────────────────────────────────────────────┘
[*] [11:42:50] initializing exploitation attempts
┌────────────────────────────────────────────────────────────┐
│ LOCAL STACK OVERFLOW EXPLOITATION │
└────────────────────────────────────────────────────────────┘
[*] [11:42:50] executing local stack overflow exploitation
┌────────────────────────────────────────────────────────────┐
│ EXPLOITATION: ret2libc (puts) - x64 │
└────────────────────────────────────────────────────────────┘
[PAYLOAD] [11:42:50] preparing ret2libc exploit using puts function
[*] [11:42:50] using detected libc: /lib/x86_64-linux-gnu/libc.so.6
[CRITICAL] [11:42:50] unexpected error: int() can't convert non-string with explicit base
┌──(ph03n1x㉿kali)-[~/tools/pwnpasi]
└─$ python pwnpasi.py -l ~/Desktop/test/pwn
/home/ph03n1x/tools/pwnpasi/pwnpasi.py:92: SyntaxWarning: invalid escape sequence '\ '
[] [11:42:49] target binary: /home/ph03n1x/Desktop/test/pwn
[] [11:42:49] local exploitation mode
[*] [11:42:49] detecting libc path automatically
[+] [11:42:49] libc path detected: /lib/x86_64-linux-gnu/libc.so.6
┌────────────────────────────────────────────────────────────┐
│ BINARY ANALYSIS PHASE │
└────────────────────────────────────────────────────────────┘
[] [11:42:49] setting executable permissions
[] [11:42:49] collecting binary security information
[*] [11:42:49] collecting binary information
┌────────────────────────────────────────────────────────────┐
│ BINARY SECURITY ANALYSIS │
└────────────────────────────────────────────────────────────┘
Feature | Status | Risk Level
Stack Canary | No canary found | HIGH
NX Bit | NX enabled | LOW
PIE | PIE enabled | LOW
RWX Segments | Unknown | LOW
┌────────────────────────────────────────────────────────────┐
│ FUNCTION ANALYSIS │
└────────────────────────────────────────────────────────────┘
[] [11:42:49] scanning PLT functions
[] [11:42:49] analyzing PLT table and available functions
┌────────────────────────────────────────────────────────────┐
│ FUNCTION ANALYSIS │
└────────────────────────────────────────────────────────────┘
Function | Address | Available
backdoor | N/A | NO
callsystem | N/A | NO
[*] [11:42:49]
┌────────────────────────────────────────────────────────────┐
│ ROP GADGET DISCOVERY │
└────────────────────────────────────────────────────────────┘
[] [11:42:49] searching for x64 ROP gadgets
[] [11:42:49] searching for ROP gadgets (x64)
┌────────────────────────────────────────────────────────────┐
│ ROP GADGETS (x64) │
└────────────────────────────────────────────────────────────┘
Gadget Type | Address | Instruction
[*] [11:42:49]
┌────────────────────────────────────────────────────────────┐
│ PADDING CALCULATION │
└────────────────────────────────────────────────────────────┘
[] [11:42:49] performing dynamic stack overflow testing
[] [11:42:49] testing for stack overflow vulnerability
┌────────────────────────────────────────────────────────────┐
│ STACK OVERFLOW DETECTION │
└────────────────────────────────────────────────────────────┘
[] Testing overflow: [██████████████████████████████] 100%[] [11:42:50]
[+] [11:42:50] stack overflow detected! Padding: 8 bytes
[*] [11:42:50] performing assembly-based overflow analysis
┌────────────────────────────────────────────────────────────┐
│ STRING ANALYSIS │
└────────────────────────────────────────────────────────────┘
[] [11:42:50] searching for /bin/sh string in binary
[] [11:42:50] checking for /bin/sh string
[!] [11:42:50] /bin/sh string not found in binary
[*] [11:42:50] testing for stack overflow vulnerability
┌────────────────────────────────────────────────────────────┐
│ STACK OVERFLOW DETECTION │
└────────────────────────────────────────────────────────────┘
[] Testing overflow: [██████████████████████████████] 100%[] [11:42:50]
[+] [11:42:50] stack overflow detected! Padding: 8 bytes
[*] [11:42:50] performing assembly-based overflow analysis
┌────────────────────────────────────────────────────────────┐
│ EXPLOITATION PHASE │
└────────────────────────────────────────────────────────────┘
[*] [11:42:50] initializing exploitation attempts
┌────────────────────────────────────────────────────────────┐
│ LOCAL STACK OVERFLOW EXPLOITATION │
└────────────────────────────────────────────────────────────┘
[*] [11:42:50] executing local stack overflow exploitation
┌────────────────────────────────────────────────────────────┐
│ EXPLOITATION: ret2libc (puts) - x64 │
└────────────────────────────────────────────────────────────┘
[PAYLOAD] [11:42:50] preparing ret2libc exploit using puts function
[*] [11:42:50] using detected libc: /lib/x86_64-linux-gnu/libc.so.6
[CRITICAL] [11:42:50] unexpected error: int() can't convert non-string with explicit base