Binary Exploitation Tools

[TheVikingsofDW]

1. GDB + GEF
The GNU project debugger, known as GDB, offers the capability to observe the internal workings of a running program or to inspect the state of a program at the point of a crash. Supporting a wide array of programming languages such as Ada, Assembly, C, C++, D, Fortran, Go, Objective-C, OpenCL, Modula-2, Pascal, and Rust, GDB serves as a versatile tool for developers.
In conjunction with GDB, the GEF toolkit proves invaluable in augmenting the functionality of the debugger. Designed as a collection of commands tailored for x86/64, ARM, MIPS, PowerPC, and SPARC architectures, GEF leverages the Python API to furnish supplementary capabilities to GDB. This integration enhances the efficacy of dynamic analysis and facilitates exploit development within the realm of binary exploitation.

GDB INSTALLATION:
* Kali:

Code: Select all

apt search gdb
apt install gdb -y

* Arch Linux:

Code: Select all

pacman -Ss gdb
pacman -S gdb

GEF INSTALLATION:

Code: Select all

sh -c "$(wget http://gef.blah.cat/sh -O -)"
ls -lash ~/.gdbinit

Should any errors arise upon the initial launch of GDB with GEF, it's advised to execute the necessary 'pip install' commands to rectify the situation:

Code: Select all

gef➤  q
sudo apt install python3-pip -y
pip3 install keystone-engine unicorn ropper

Upon attempting to initiate GDB, one may observe the successful launch of GEF.

2. GHIDRA
Ghidra stands as a SRE framework meticulously crafted and upheld by the NSA's Research Directorate. Within this framework resides a comprehensive array of sophisticated software analysis tools, empowering users to scrutinize compiled code across diverse platforms such as Windows, macOS, and Linux. Its functionalities encompass disassembly, assembly, decompilation, graphing, scripting, and an extensive repertoire of additional features. Ghidra boasts compatibility with a broad spectrum of processor instruction sets and executable formats, accommodating operation in both interactive and automated modes.

GHIDRA INSTALLATION:
Proceed with the installation of Java:
* Kali:

Code: Select all

sudo apt update -y ; sudo apt upgrade -y ; sudo apt install default-jdk -y

* Arch Linux:

Code: Select all

java -version

Visit the primary website of Ghidra to acquire the zip file: https://www.ghidra-sre.org

Code: Select all

wget LINK LOCATION OF GHIDRA ZIP FROM MAIN PAGE
unzip GHIDRA ZIP

Subsequently, the ghidraRun binary is required at this juncture to initiate Ghidra:

Code: Select all

ls -l
cd ghidra_9.2.2_PUBLIC
ls
file ghidraRun
cat ghidraRun

To simplify the process, consider creating a symbolic link to a directory within the PATH environment:

Code: Select all

echo $PATH
sudo ln -s $(pwd)/ghidraRun /usr/bin/ghidra
ls -lash /usr/bin/ghidra
which ghidra

At this point, you may simply enter 'ghidra' in your terminal to launch the Ghidra application.

Quick tutorial on importing a binary file for disassembly in Ghidra:
a) Initiate the creation of a new project and assign it a designated directory location.
b) To conduct a test, copy a random binary file locally and proceed with its importation. Navigate to the green icon within the "Tool Chest," select "Go to file," and import the file accordingly.

Code: Select all

cp /bin/randomfile .
ls -lash randomfile

c) Go to the "File" menu, choose the binary file, and proceed to click on "Select File To Import." Within the prompt, specify the Format as "Executable and Linking Format (ELF)" and the Language as "x86:LE:64:default:gcc" then click OK. Subsequently, confirm by clicking on "Yes" and then "OK." Your binary file is now ready for disassembly.

3. Python Pwntools
Pwntools represents a Python CTF library meticulously crafted for expedited exploit development. This tool aids in the swift creation of exploits, leveraging its robust functionalities. Pwntools is available in both Python 2 and Python 3 versions.

PYTHON PWNTOOLS INSTALLATION:
The installation process is straightforward. Ensure that Python 3 and python3-pip are installed on your system, then proceed with the following commands:

Code: Select all

which python3 pip3
sudo pip3 install pwn

Below is the comprehensive documentation for Pwntools: https://docs.pwntools.com/en/stable/