one_gadget
Command-line tool that finds one-gadget RCE entry points in glibc binaries and outputs their register constraints clearly.
Technical Architecture & Overview
one_gadget is an open-source tool that finds one-gadget execve("/bin/sh", ...) candidates in glibc binaries. It reports the register and memory constraints required for each gadget to succeed and is built for CTF pwn challenges and exploit development against glibc.
Targeted Technical Use Cases
Finding one-gadget RCE candidates in specific glibc versions during exploit development.
Evaluation & Trade-offs
Core Strengths
- +Looks up gadgets from a libc file or from its BuildID.
- +Reports precise register and memory constraints for each candidate gadget.
- +Supports i386, amd64, aarch64, 32-bit ARM, RISC-V 64, and MIPS glibc builds.
Trade-Offs & Limitations
- -Targets glibc specifically; other libc implementations are outside its documented scope.
- -Gadget constraints may not be satisfiable in a given exploit context.
Defensive Security Application
Assessing the feasibility of one-gadget RCE in specific glibc versions to evaluate ASLR and libc hardening.
Frequently Asked Questions
What is one_gadget?→
one_gadget is an open-source tool that finds one-gadget execve("/bin/sh", ...) candidates in glibc binaries. It reports the register and memory constraints required for each gadget to succeed and is built for CTF pwn challenges and exploit development against glibc.
What is one_gadget used for?→
Finding one-gadget RCE candidates in specific glibc versions during exploit development.
What are the strengths of one_gadget?→
- +Looks up gadgets from a libc file or from its BuildID.
- +Reports precise register and memory constraints for each candidate gadget.
- +Supports i386, amd64, aarch64, 32-bit ARM, RISC-V 64, and MIPS glibc builds.
What are the limitations of one_gadget?→
- +Targets glibc specifically; other libc implementations are outside its documented scope.
- +Gadget constraints may not be satisfiable in a given exploit context.
How is one_gadget used defensively?→
Assessing the feasibility of one-gadget RCE in specific glibc versions to evaluate ASLR and libc hardening.