lisa.py An Exploit Dev Swiss Army Knife.
Installation Copy lisa.py and .lldbinit to ~/ Use the following commands: ant4g0nist$ cp lisa.py ~/lisa.py
ant4g0nist$ cp lldbinit ~/.lldbinit
ant4g0nist$ lldb
lllllll iiii
l:::::l i::::i
l:::::l iiii
l:::::l
l::::l iiiiiii ssssssssss aaaaaaaaaaaaa
l::::l i:::::i ss::::::::::s a::::::::::::a
l::::l i::::i ss:::::::::::::s aaaaaaaaa:::::a
l::::l i::::i s::::::ssss:::::s a::::a
l::::l i::::i s:::::s ssssss aaaaaaa:::::a
l::::l i::::i s::::::s aa::::::::::::a
l::::l i::::i s::::::s a::::aaaa::::::a
l::::l i::::i ssssss s:::::s a::::a a:::::a
l::::::li::::::is:::::ssss::::::sa::::a a:::::a
l::::::li::::::is::::::::::::::s a:::::aaaa::::::a
l::::::li::::::i s:::::::::::ss a::::::::::aa:::a
lllllllliiiiiiii sssssssssss aaaaaaaaaa aaaa
-An Exploit Dev Swiss Army Knife. Version: v-ni
(lisa)target create tests/binaries/abort
(lisa)process launch -s
Process 1660 stopped
* thread #1: tid = 0x10801, 0x00007fff5fc01000 dyld`_dyld_start, stop reason = signal SIGSTOP
frame #0: 0x00007fff5fc01000 dyld`_dyld_start
dyld`_dyld_start:
-> 0x7fff5fc01000 <+0>: pop rdi
0x7fff5fc01001 <+1>: push 0x0
0x7fff5fc01003 <+3>: mov rbp, rsp
0x7fff5fc01006 <+6>: and rsp, -0x10
Process 1660 launched: '/Users/v0id/Documents/Research/lisa.py/tests/binaries/abort' (x86_64)
Commands Available: **exploitable** : checks if the crash is exploitable
(lisa)exploitable
**shellcode**: Searches shell-storm for shellcode
(lisa)shellcode
Syntax: shellcode
(As of now, commiting exploitable command. Have to test the remaining code.) You can test lisa.py against CrashWranglers's test cases ant4g0nist$ cp lisa.py ~/lisa.py
ant4g0nist$ cp lldbinit ~/.lldbinit
ant4g0nist$ python test.py
Thanks: - Mona.py : https://github.com/corelan/mona
- Crashwrangler : https://developer.apple.com/library/mac/technotes/tn2334/_index.html
- Metasploit : https://github.com/rapid7/metasploit-framework
- PEDA : https://github.com/longld/peda
- Phillips : https://www.phillips321.co.uk/2013/04/02/recreating-pattern_create-rb-in-python/
- Jonathan Salwan : http://shell-storm.org/shellcode/
TODO: add support for macho in ropmaker
