one_gadget level

Oct 21, 2025 · Dreamhack

#Pwnable

oneshot 가젯에서 일반적으로 사용하면

C
(pwn) amemoyoi ~$ one_gadget  ./libc.so.6 
0x583dc posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
constraints:
  address rsp+0x68 is writable
  rsp & 0xf == 0
  rax == NULL || {"sh", rax, rip+0x17302e, r12, ...} is a valid argv
  rbx == NULL || (u16)[rbx] == NULL

0x583e3 posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
constraints:
  address rsp+0x68 is writable
  rsp & 0xf == 0
  rcx == NULL || {rcx, rax, rip+0x17302e, r12, ...} is a valid argv
  rbx == NULL || (u16)[rbx] == NULL

0xef4ce execve("/bin/sh", rbp-0x50, r12)
constraints:
  address rbp-0x48 is writable
  rbx == NULL || {"/bin/sh", rbx, NULL} is a valid argv
  [r12] == NULL || r12 == NULL || r12 is a valid envp

0xef52b execve("/bin/sh", rbp-0x50, [rbp-0x78])
constraints:
  address rbp-0x50 is writable
  rax == NULL || {"/bin/sh", rax, NULL} is a valid argv
  [[rbp-0x78]] == NULL || [rbp-0x78] == NULL || [rbp-0x78] is a valid envp

다음과 같이 유망한 몇개가 나온다.

하지만, 우리가 pwn을 할때 다른 유망하지 않은 것을 시도해야 할 수도 있다.

이럴때

C
(pwn) amemoyoi ~$ one_gadget -l 1 ./libc.so.6 
0x583d5 posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
constraints:
  address rsp+0x68 is writable
  rsp & 0xf == 0
  {"sh", "-c", rip+0x17302e, r12, ...} is a valid argv
  rbx == NULL || (u16)[rbx] == NULL

0x583dc posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
constraints:
  address rsp+0x68 is writable
  rsp & 0xf == 0
  rax == NULL || {"sh", rax, rip+0x17302e, r12, ...} is a valid argv
  rbx == NULL || (u16)[rbx] == NULL

0x583e3 posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
constraints:
  address rsp+0x68 is writable
  rsp & 0xf == 0
  rcx == NULL || {rcx, rax, rip+0x17302e, r12, ...} is a valid argv
  rbx == NULL || (u16)[rbx] == NULL

0x583ea posix_spawn(rsp+0xc, "/bin/sh", rdx, rbx, rsp+0x50, environ)
constraints:
  address rsp+0x68 is writable
  rsp & 0xf == 0
  rcx == NULL || {rcx, (u64)xmm1, rip+0x17302e, r12, ...} is a valid argv
  rdx == NULL || (s32)[rdx+0x4] <= 0
  rbx == NULL || (u16)[rbx] == NULL

0x583ef posix_spawn(rsp+0xc, "/bin/sh", rdx, rbx, rsp+0x50, environ)
constraints:

...
C
one_gadget -l 1 ./libc.so.6

다음과 같이 -l 옵션을 붙여주면 훨씬 많은 것들이 나온다.