hacktricks/reversing-and-exploiting/linux-exploiting-basic-esp/one-gadget.md

One Gadget

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}

Basic Information

One Gadget inaruhusu kupata shell badala ya kutumia system na "/bin/sh". One Gadget itapata ndani ya maktaba ya libc njia fulani ya kupata shell (execve("/bin/sh")) kwa kutumia tu anwani moja.
Hata hivyo, kawaida kuna vizuizi fulani, ambavyo ni vya kawaida na rahisi kuepuka kama [rsp+0x30] == NULL Kwa kuwa unadhibiti thamani ndani ya RSP unahitaji tu kutuma thamani zaidi za NULL ili kuepuka vizuizi hivyo.

ONE_GADGET = libc.address + 0x4526a
rop2 = base + p64(ONE_GADGET) + "\x00"*100

Ili kupata anwani iliyoonyeshwa na One Gadget unahitaji kuongeza anwani ya msingi ambapo libc imepakuliwa.

{% hint style="success" %} One Gadget ni msaada mzuri kwa mbinu za Arbitrary Write 2 Exec na inaweza kurahisisha mnyororo wa ROP kwani unahitaji tu kuita anwani moja (na kutimiza mahitaji). {% endhint %}

{% hint style="success" %} Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze & fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}