LibcSearcher3

(Search libc function offset)

CTFPython 3.7

LibclibcLibc.so12

libc-database

$ git clone https://github.com/Ro0tk1t/LibcSearcher3.git
$ pip3 install -e LibcSearcher3

or

$ pip3 install LibcSearcher3

$ libcsearch --init

from LibcSearcher import *

#,12(d90)int
obj = LibcSearcher("fgets", 0x7ff39014bd90)

obj.dump("system")        #system 
obj.dump("str_bin_sh")    #/bin/sh 
obj.dump("__libc_start_main_ret")    

$ libcsearch --help
usage: libcsearch [-h] [-i] [-f FUNC] [-d ADDR] [-t TO_LEAK]

optional arguments:
  -h, --help            show this help message and exit
  -i, --init            libc
  -l LOCAL_LIBC, --local LOCAL_LIBC
                        libc
  -f FUNC, --func FUNC  
  -d ADDR, --addr ADDR  
  -t TO_LEAK, --to_leak TO_LEAK
                        

$ libcsearch -f fgets -d 0x7ff39014bd90 -t system
Multi Results:
 0: kali-glibc (id libc6-x32_2.31-3_amd64)
 1: ubuntu-old-eglibc (id libc6-amd64_2.13-0ubuntu13.2_i386)
 2: kali-glibc (id libc6-x32_2.31-3_i386)
 3: ubuntu-old-glibc (id libc6_2.19-10ubuntu2_amd64)
 4: archive-glibc (id libc6-amd64_2.23-0ubuntu10_i386)
Please supply more info using 
        add_condition(leaked_func, leaked_address).
You can choose it by hand
Or type 'exit' to quit: 0
[+] kali-glibc (id libc6-x32_2.31-3_amd64) be choosed.
[+] system offset:  0x40130

libc

$ libcsearch -l /usr/lib32/libc-2.31.so
Adding local libc /usr/lib32/libc-2.31.so (id local-189747720230b84e629b7fb77ecb4006416e3ada  /usr/lib32/libc-2.31.so)
  -> Writing symbols to ../db/local-189747720230b84e629b7fb77ecb4006416e3ada.symbols
  -> Writing version info

libcadd_condition(leaked_func, leaked_address)libc

bug

linuxlibc