Triage

triage.sh

#!/bin/bash

# Force libc to output fatal errors to stderr instead of
# writing to the terminal directly
export LIBC_FATAL_STDERR_=1

# Should be set as the path to the exploitable binary
EXPLOITABLE=~/exploitable/exploitable/exploitable/exploitable.py

# Ghetto script so -d has to be first
# it takes a directory, and just runs the script with xargs and -p,
# with the last argument set to each file in the directory
if [ "$1" == "-d" ]; then
        DIR="$2"
        shift 2
        ls "$DIR" | xargs -n 1 $BASH_SOURCE -p $@
        exit
fi

# Print filename before each line, for use with xargs
# secret option used by -d to get it to print the name first
if [ "$1" == "-p" ]; then
        # hack to get last argument
        for last; do true; done
        echo -n "$last "
        shift 1
fi

OUTPUT=$(gdb -q -batch -ex "source $EXPLOITABLE" -ex "tty /dev/null" -ex "run" -ex 'x/i $rip' -ex where -ex exploitable --args $@ 2>&1)
EXPLOITABILITY=$(echo "$OUTPUT" | grep Exploitability | cut -d ":" -f 2 | tr -d ' ')
FUNC=$(echo "$OUTPUT" | grep '#0' | cut -b 5-)
ADDR=$(echo "$OUTPUT" | grep '=>' | cut -b 3- | cut -d ":" -f 1 | cut -b 2-)

#echo "$OUTPUT"


if [ "$EXPLOITABILITY" != "" ]; then
        echo "$EXPLOITABILITY CRASH at $ADDR ($FUNC)"
else
        echo "SUCCESS"
fi