Package: vagd
VAGDVirtuAlization GDb integrations in pwntoolsInstallationpipinstallvagdor from repo withgitclonehttps://github.com/gfelber/vagd
pipinstall./vagd/Usagevagd template [OPTIONS] [BINARY] [IP] [PORT]to generate a template, list OPTIONS with help-h#!/usr/bin/env pythonfrompwnimport*IP=''# remote IPPORT=0# remote PORTBINARY=''# PATH to local binary e.g. ./chalARGS=[]# ARGS supplied to binaryENV={}# ENVs supplied to binary# GDB SCRIPT, executed at start of GDB session (set breakpoint here)GDB=f"""c"""context.binary=exe=ELF(BINARY,checksec=False)# enable disable ASLR (works for GDB)context.aslr=Falsevm=Nonedefget_target(**kw):globalvmifargs.REMOTE:context.log_level='debug'returnremote(IP,PORT)fromvagdimportDogd,Qegd,Shgdifnotvm:# Dockervm=Dogd(exe.path,image="ubuntu:jammy",ex=True,fast=True)# or Qemuvm=Qegd(exe.path,img="https://cloud-images.ubuntu.com/jammy/current/jammy-server-cloudimg-amd64.img",ex=True,fast=True)# or SSHvm=Shgd(exe.path,user='user',host='localhost',port=22,ex=True,fast=True)returnvm.start(argv=ARGS,env=ENV,gdbscript=GDB,**kw)# returns a pwn.process (similar to pwn.process())t=get_target()t.interactive()vagd info BINARYto print info about binary# run as process in VM./exploit.py# run as gdb server in VM requires tmux./exploit.pyGDB# run on remote IP:PORT./exploit.pyREMOTEI recommend usingpwndbg.FilesAll created files ares stored in the local./.vagd/directory. Additional large files (e.g. cloudimages) are stored in the home directory~/.vagd/or handled by tools themselfs (e.g. Docker).CLIaliasvagd="python -m vagd"# or install with pip / pipx# help messagevagd-h# analyses the binary, prints checksec and .comment (often includes Distro and Compiler info)vagdinfoBINARY# creates template, for more info use: vagd template -hvagdtemplate[OPTIONS][BINARY][IP][PORT]# ssh to current vagd instance, for more info use: vagd ssh -hvagdssh[OPTIONS]# scp file to/from vagd instance, for more info use: vagd scp -h# e.g. vagd scp ./test_file vagd:./ # vagd:./ is default targetvagdscp[OPTIONS]SOURCE[TARGET]# stop and remove current vagd instance, for more info use: vagd clean -hvagdclean[OPTIONS]DocumentationBoxesA listed of known working Boxes can be found in theDocumentation.
Other images might also work but currently only distributions that useaptand alpine for Docker are supported.
This limitation may be circumvented by creating a target yourself (with the dependencies gdbserver, python, openssh) and creating a ssh connection via Shgd.Troubleshootingbackground processesall instances continue to run in the background (after a vagd object has been started), this improves the runtime greatly after the first execution of the exploit. But this means that instances must be killed manually e.g.:vagd cleangdb & gdbserverBecause gdbserver is used to run binaries on the instances it is advised to usepwndbg. Other well known gdb plugins likepedaandgefaren't compatible with gdbserver and therefore won't work.filesfiles on the virtual instance are never overwritten this has performance reason (so files aren't always copied if the exploit is run). If you need to updated files on the remote either usevagd scpor create use temporary directoriesDogd(..., tmp=True)gdb performanceUsing gdbserver and gdb to index libraries can be very slow. Therefore an experimental feature is available that mounts libraries locally:Dogd(..., ex=True, fast=True)Future planspre configured QEMU Images / Docker Imagecreated pre configured environments with preinstalled lib debug symbols and gdbserver to lower init runtime.Better Docker integrationcreated a Docker integration that allows loading existing Dockerfiles (maybe docker-compose), also add a feature that additionally visualizes (Qemu) them to change the used kernel.