Premier sur le rop.
Skyrack should sucessfully run on any platform supporting Ruby and has been tested under Linux, Mac OS, Windows (but not by me ;).
Be sure to have ruby and the gem utility (sometimes packaged as rubygems).
$ gem install skyrack_file.gem
Dependencies will automatically be fetched and installed if you have an internet access.
If you have trouble installing sqlite3, you may want to add the sqlite3 headers to your system:
$ sudo aptitude install libsqlite3-dev
$ yum install sqlite3-devel'
You also need metasm:
$ hg clone https://metasm.googlecode.com/hg/ metasm
$ git clone git://github.com/jjyg/metasm.git
You'll then need yo set your Ruby path points to Metasm directory:
$ export RUBYLIB=$RUBYLIB:/path/to/metasm
Options can be seen by passing the '-h' or '--help' flag to each executable file.
Builds the gadget db of a binary file.
$ sky_build_db /path/to/libeay32.dll
Search a gadget db built with +sky_build_db+:: for specific instructions.
$ sky_search -f db/libeay32.dll.sqlite3 -a 'mov eax' -s ebp $ sky_search -f db/libeay32.dll.sqlite3 -a 'mov [eax]' -l -1 --preserve-eip
Interesting patterns found by sky_search should be redirected to a file :
$ sky_search -f db.sqlite3 -a 'xor ebx, ebx' -l 1 > result.txt
Consecutive instructions may be searched by adding the -a expression multiple times:
$ sky_search -f db.sqlite3 -a 'mov eax, [ebp+8]' -a 'jmp eax' > result.txt
Which will return the following instruction sequence:
mov eax, [ebp+8] jmp eax
Search a binary file for specific instructions. Assembled on the fly.
$ sky_search_raw -i "jmp eax" /path/to/libeay32.dll $ sky_search_raw --all -i 'call [eax+4]' /path/to/libeay32.dll
Converts the human readable payload into a binary file:
$ sky_generate -f ..sqlite3 result.txt > payload.bin
An offset may also be given (should correspond to the load address of the exploited library):
$ sky_generate -f ..sqlite3 -o 0x7ffff4b00 result.txt > payload.bin
Converts an exploit generated for a library to an exploit working with an other library. Eg you have a working exploit.txt generated with libssl0.9.8c, you can convert it to libssl0.9.8d:
$ sky_convert exploit.txt libssl0.9.8d.sqlite3 > exploit_new.txt
If you are lucky, you may even be able to convert it to a different library gadgets database.
You need to generate libssl0.9.8d gadget database in order to provide it to sky_convert:
$ sky_build_db libssl0.9.8d
If you can't find sky_* in your path, you may access it directly this way:
$ gem which skyrack /.../gems/ree-1.8.7-head/gems/skyrack-0.1.2.1/lib/skyrack.rb
bin/ directory is at the same level as lib/:
Skyrack is written by Jean-Baptiste Aviat, an HSC consultant. http://www.hsc.fr
* new generation method, now 10 times faster * database opening bug corrected
* sky_convert works better and faster * sky_convert does not need any more the original gadet database, only the destination one * bigfux: sky_generate did not work with using Ruby 1.8 * database is now looked for in current directory