niklasb / libc-database Goto Github PK

View Code? Open in Web Editor NEW

1.7K 32.0 194.0 2.39 MB

Build a database of libc offsets to simplify exploitation

Home Page: https://libc.rip/

License: MIT License

Shell 47.74% Dockerfile 0.61% Python 15.54% HTML 4.01% CSS 1.02% JavaScript 31.09%

pwn libc offsets ctf ctf-tools

libc-database's Introduction

Web interface

libc-database now has a web service and frontend. Visit https://libc.rip/ to try it out! Read https://github.com/niklasb/libc-database/tree/master/searchengine if you are interested in the API.

Building a libc offset database

If you're getting errors, please check the "Requirements" section below.

Fetch the desired libc categories and extract the symbol offsets. It will not download anything twice, so you can also use it to update your database:

$ ./get  # List categories
$ ./get ubuntu debian  # Download Ubuntu's and Debian's libc, old default behavior
$ ./get all  # Download all categories. Can take a while!

You can also add a custom libc to your database.

$ ./add /usr/lib/libc-2.21.so

Find all the libc's in the database that have the given names at the given addresses. Only the last 12 bits are checked because randomization usually works on page size level.

$ ./find printf 260 puts f30
archive-glibc (libc6_2.19-10ubuntu2_i386)

Find a libc from the leaked return address into __libc_start_main.

$ ./find __libc_start_main_ret a83
ubuntu-trusty-i386-libc6 (libc6_2.19-0ubuntu6.6_i386)
archive-eglibc (libc6_2.19-0ubuntu6_i386)
ubuntu-utopic-i386-libc6 (libc6_2.19-10ubuntu2.3_i386)
archive-glibc (libc6_2.19-10ubuntu2_i386)
archive-glibc (libc6_2.19-15ubuntu2_i386)

Dump some useful offsets, given a libc ID. You can also provide your own names to dump.

$ ./dump libc6_2.19-0ubuntu6.6_i386
offset___libc_start_main_ret = 0x19a83
offset_system = 0x00040190
offset_dup2 = 0x000db590
offset_recv = 0x000ed2d0
offset_str_bin_sh = 0x160a24

Check whether a library is already in the database.

$ ./identify /usr/lib/libc.so.6
local-f706181f06104ef6c7008c066290ea47aa4a82c5

Or find a libc using a hash (currently BuildID, MD5, SHA1 and SHA256 is implemented):

$ ./identify bid=ebeabf5f7039f53748e996fc976b4da2d486a626
libc6_2.17-93ubuntu4_i386
$ ./identify md5=af7c40da33c685d67cdb166bd6ab7ac0
libc6_2.17-93ubuntu4_i386
$ ./identify sha1=9054f5cb7969056b6816b1e2572f2506370940c4
libc6_2.17-93ubuntu4_i386
$ ./identify sha256=8dc102c06c50512d1e5142ce93a6faf4ec8b6f5d9e33d2e1b45311aef683d9b2
libc6_2.17-93ubuntu4_i386

Download the whole libs corresponding to a libc ID.

$ ./download libc6_2.23-0ubuntu10_amd64
Getting libc6_2.23-0ubuntu10_amd64
    -> Location: http://security.ubuntu.com/ubuntu/pool/main/g/glibc/libc6_2.23-0ubuntu10_amd64.deb
    -> Downloading package
    -> Extracting package
    -> Package saved to libs/libc6_2.23-0ubuntu10_amd64
$ ls libs/libc6_2.23-0ubuntu10_amd64
ld-2.23.so ... libc.so.6 ... libpthread.so.0 ...

Requirements

General

To run these scripts, you will need following command on your PATH:

readelf
objdump
strings
perl
find
grep
md5sum
sha1sum
sha256sum
file

Debian-based (Ubuntu, Debian, Kali Linux, ParrotSec)

mktemp
perl
wget
ar
tar
grep
zstd

RPM-based (category 'rpm')

mktemp
perl
wget
rpm2cpio
cpio
grep

CentOS-based

In addition to the RPM-Based requirements, you will need:

wget
gzip
grep

Pacman-based

mktemp
perl
grep
sed
cat
wget
zstd
xz-utils
tar

APK Based

mktemp
perl
wget
tar
gzip
grep

Launchpad-based

In addition to the Debian-based requirements, you will need:

Install everything

To install everything on Debian 10, run these commands:

apt-get update
apt-get install -y \
  binutils file \
  wget \
  rpm2cpio cpio \
  zstd jq

libc-database's People

Contributors

Stargazers

Watchers

Forkers

aminecherrai sigma-random ykram incertia marnitto syjzwjj 0xling pxx199181 tempbottle idkwim superkojiman lieanu bingtanguan m1ghtym0 kuteminh11 3xp10it iuhoagnaw lucabongiorni wflk melbshark skyroot youngc2015 zunc eatline holinder4s ww9210 0x9k msm595 rflaperuta zzoru spnow enovella javierprtd yodamaster topotam hayjcle 0xbadca7 yangy-xiao rkmylo mokhdzanifaeq nlazy wmikefish missxq131 johnhubcr jhong3842 youngcraft r00tk1ts go-for-it-gg droofe waywardsun j-grey tantantut dshtanger h4niz whb224117 hawking2013 darredevil reshahar viccon vccxx shuixi2013 ykankaya gr3yr0n1n matrixy sploitamos martin-0 wllidr blukat29 peterg75 coolboy4me lhlsec ayrx min-maxwell nnamon conghiaa tesuji d3siprox spiperac ph34n6x arunm201192 w4fz5uck5 matrix1001 taiji1985 decart-hub skysider coffeevapple zerocry nuhdv loneworld zxgio imnewer f0829 qr4 silience kh4nt7 amesianx nyamisty lhyandfyt eatmanctf bwry

libc-database's Issues

when use ./get, an error happen

Failed to get package version
Getting
-> Location: ubuntu-vivid-i386-libc6
-> ID:
-> Downloading package
Failed to download package from ubuntu-vivid-i386-libc6

Trusty is removed from packages.ubuntu.com

https://packages.ubuntu.com/

2019-04-23
Reflect disco release, add eoan, remove trusty.

Non-zero return code for launchpad (and possibly debian)

If at least one download fails for launchpad, the return code is non-zero. This does not happen for other categories like rpm. This inconsistency breaks automated scripts which use the return code unless if all errors are ignored which is probably not a good idea.

$ ./get launchpad
Will download or update for:
	* launchpad ; Requirements are met
Downloading/updating launchpad
Launchpad: Series impish
...
Getting launchpad-ubuntu-glibc-hoary
  -> Location: https://launchpad.net/ubuntu/+source/glibc/2.3.2.ds1-20ubuntu14/+build/95476/+files/libc6_2.3.2.ds1-20ubuntu14_i386.deb
  -> ID: libc6_2.3.2.ds1-20ubuntu14_i386
  -> Downloading package
Failed to download package from https://launchpad.net/ubuntu/+source/glibc/2.3.2.ds1-20ubuntu14/+build/95476/+files/libc6_2.3.2.ds1-20ubuntu14_i386.deb
Getting launchpad-ubuntu-glibc-hoary
  -> Location: https://launchpad.net/ubuntu/+source/glibc/2.3.2.ds1-20ubuntu15/+build/179595/+files/libc6_2.3.2.ds1-20ubuntu15_i386.deb
  -> ID: libc6_2.3.2.ds1-20ubuntu15_i386
  -> Already have this version, 'rm /home/mariusz/.libc-database/db/libc6_2.3.2.ds1-20ubuntu15_i386.*' to force
Launchpad: Series warty
Getting launchpad-ubuntu-glibc-warty
  -> Location: https://launchpad.net/ubuntu/+source/glibc/2.3.2.ds1-13ubuntu2.2/+build/73022/+files/libc6_2.3.2.ds1-13ubuntu2.2_i386.deb
  -> ID: libc6_2.3.2.ds1-13ubuntu2.2_i386
  -> Already have this version, 'rm /home/mariusz/.libc-database/db/libc6_2.3.2.ds1-13ubuntu2.2_i386.*' to force
Getting launchpad-ubuntu-glibc-warty
  -> Location: https://launchpad.net/ubuntu/+source/glibc/2.3.2.ds1-13ubuntu2.3/+build/179681/+files/libc6_2.3.2.ds1-13ubuntu2.3_i386.deb
  -> ID: libc6_2.3.2.ds1-13ubuntu2.3_i386
  -> Already have this version, 'rm /home/mariusz/.libc-database/db/libc6_2.3.2.ds1-13ubuntu2.3_i386.*' to force
Getting launchpad-ubuntu-glibc-warty
  -> Location: https://launchpad.net/ubuntu/+source/glibc/2.3.2.ds1-13ubuntu2/+build/57040/+files/libc6_2.3.2.ds1-13ubuntu2_i386.deb
  -> ID: libc6_2.3.2.ds1-13ubuntu2_i386
  -> Already have this version, 'rm /home/mariusz/.libc-database/db/libc6_2.3.2.ds1-13ubuntu2_i386.*' to force
$ echo $?
1

This seems to be because some of the get_all_* functions have a sleep .1 after each download, but launchpad and debian do not.

can't find 'system 390' which in libc6_2.23-0ubuntu10_amd64 or libc6_2.23-0ubuntu11_amd64

./find system 390

https://libc.blukat.me/?q=system%3A390

Failed to download package (rpm)

Getting rpm
  -> Location: http://rpmfind.net/linux/openmandriva/cooker/repository/x86_64/main/release/glibc-2.33-4-omv4040.x86_64.rpm
  -> ID: libc-2.33-4-omv4040.x86_64
  -> Downloading package
  -> Extracting package
  -> Writing libc /tmp/tmp.dyI8IxHGco/lib64/libc.so.6 to db/libc-2.33-4-omv4040.x86_64.so
  -> Writing symbols to db/libc-2.33-4-omv4040.x86_64.symbols
  -> Writing version info
Getting rpm
  -> Location: http://rpmfind.net/linux/fedora/linux/updates/testing/34/Everything/x86_64/Packages/g/glibc-2.33-4.fc34.x86_64.rpm
  -> ID: libc-2.33-4.fc34.x86_64
  -> Downloading package
Failed to download package from http://rpmfind.net/linux/fedora/linux/updates/testing/34/Everything/x86_64/Packages/g/glibc-2.33-4.fc34.x86_64.rpm
The command '/bin/sh -c ~/.libc-database/get all' returned a non-zero code: 1

Architectures other than x86

Hi! Are there any plans for adding other architectures than x86? I currently have the need to download them (not for offsets), but while I'm at it I might open a PR. Is this something you would be interested in @niklasb?

arch linux with rpm-tools-4.15.1-3

With arch linux and the package rpm-tools-4.15.1-3 the requirements for centos and rpm are not met.
The error message are:

Will download or update for:
/usr/bin/rpm2cpio
Requirements for download or update 'x' are not met. Please, refer to README.md for installation instructions

如何删除 ./add 添加的libc库呢

把文件删除了运行脚本还是显示存在，该怎么处理呢？

Symbol collision

Low priority issue: symbols with multiple values

Observations

In libc6_2.27-3ubuntu1_amd64, there are two values for fmemopen:

$ grep fmemopen libc-database/db/libc6_2.27-3ubuntu1_amd64.symbols
fmemopen 0000000000089f20
fmemopen 0000000000089b00

This is because readelf provides two symbols for fmemopen:

$ readelf -Ws libc-database/db/libc6_2.27-3ubuntu1_amd64.symbols | grep fmemopen
1218: 0000000000089f20   550 FUNC    GLOBAL DEFAULT   13 fmemopen@GLIBC_2.2.5
1219: 0000000000089b00   595 FUNC    GLOBAL DEFAULT   13 fmemopen@@GLIBC_2.22

Where one of these symbols probably corresponds to __old_fmemopen in glibc's source.

There are a significant number of duplicate symbols for this libc, as well as other libcs (just testing 2.27 & 2.28 here):

$ symbols_with_dupes(){ for symb in $(sed 's/ .*//' < "$1" | sort | uniq -d); do grep ^$symb\  "$1"; done | sed 's/ .*//' | sort | uniq; }
$ symbols_with_dupes db/libc6_2.27-3ubuntu1_amd64.symbols
fmemopen
glob
glob64
nftw
nftw64
posix_spawn
posix_spawnp
pthread_cond_broadcast
pthread_cond_destroy
pthread_cond_init
pthread_cond_signal
pthread_cond_timedwait
pthread_cond_wait
quick_exit
realpath
regexec
sched_getaffinity
sched_setaffinity
_sys_nerr
sys_nerr
$ for f in db/libc6_2.27*.symbols db/libc6_2.28*.symbols; do symbols_with_dupes "$f" | wc -l; done
20
94
20
94
20
94
20
95
20
95

Solutions

No idea. For glibc in particular, it might be possible to prefer symbols that aren't tied to __old_* functions, but I see no solution for this issue in general.

Error downloading libc

When running get I'm running into some errors when attempting to download various libc's via get

Getting package location for ubuntu-xenial-i386
Getting ubuntu-xenial-i386-libc6
  -> Location: http://security.ubuntu.com/ubuntu/pool/main/g/glibc/libc6_2.23-0ubuntu10_i386.deb
  -> ID: libc6_2.23-0ubuntu10_i386
  -> Downloading package
  -> Extracting package
  -> Writing libc to db/libc6_2.23-0ubuntu10_i386.so
  -> Writing symbols to db/libc6_2.23-0ubuntu10_i386.symbols
  -> Writing version info
Getting package location for ubuntu-xenial-amd64
Failed to get package version
Getting 
  -> Location: ubuntu-xenial-amd64-libc6
  -> ID: 
  -> Downloading package
Failed to download package from ubuntu-xenial-amd64-libc6

I'm guessing that the download links are stale

./get ubuntu cannot be downloaded

Will download or update for:
Requirements for download or update 'ubuntu' are not met. Please, refer to README.md for installation instructions
Read the readme.md, but there is no solution in the document

Not only libc.so.6

For some security research, we not only need the libc.so.6, but also need the corresponding ld.so.

In your amazing project I find that it has already downloaded all libs but only reserved libc.so.6.

Maybe it should reserve all those libs.

Is it an acceptable idea to make a directory for each version of libs in db ?

Failed to decompress package (rpm)

hi,
ubuntu 20.04:
./get.sh rpm

Getting rpm
-> Location: http://rpmfind.net/linux/fedora/linux/updates/35/Everything/x86_64/Packages/g/glibc-2.34-29.fc35.x86_64.rpm
-> ID: libc-2.34-29.fc35.x86_64
-> Already have this version, 'rm /home/wzsx150/bin/libc-database/db/libc-2.34-29.fc35.x86_64.*' to force
Getting rpm
-> Location: http://rpmfind.net/linux/centos-stream/9-stream/BaseOS/x86_64/os/Packages/glibc-2.34-25.el9.x86_64.rpm
-> ID: libc-2.34-25.el9.x86_64
-> Downloading package
-> Extracting package
error: pkg.rpm: signature hdr data: BAD, no. of bytes(27320) out of range
error reading header from package
rpm2cpio failed
cpio: 归档非正常终止
cpio failed
Cannot locate the libc file

how to fix it?

One URL fails then exit

Firstly thanks for your great tool!

When I used ./get to fetch libc for the first time, I came across failure when:
get_current_ubuntu yakkety i386 libc6
I have not went to see why the above fails, but I found that the die() function in db/libc.sh will make the whole script exit and die() is used in get_ubuntu(). So just like in my case, one fails and the rest would not continue to download. Maybe there is some better solution?

Thank you anyway!

Failed to get package version for rpm musl

This bug is revealed once the fix #42 is applied.

$ ./get rpm
...
Getting rpm
  -> Location: http://rpmfind.net/linux/openmandriva/cooker/repository/x86_64/main/release/musl-1.2.2-1-omv4040.x86_64.rpm
  -> ID: musl-1.2.2-1-omv4040.x86_64
  -> Already have this version, 'rm /root/.libc-database/db/musl-1.2.2-1-omv4040.x86_64.*' to force
Getting package musl locations
Retrying...
Retrying...
Retrying...
Failed to get package version

We could (similarly to #42) have this be a non-critical failure but it is more debatable whether this is a good idea.

Name collision

While debugging #25, I identified an issue.

To verify that the regex was matching everything, I compared the extracted symbols with an old DB. The issue is that for the same file (same name), I got 2 different address for the same symbol.

$ ls -la ./db/musl_1.2.0-1_amd64.so ./db.1/musl_1.2.0-1_amd64.so 
-rwx------. 1 user group 723440 16 août  00:23 ./db.1/musl_1.2.0-1_amd64.so
-rwx------. 1 user group 719344  8 sept. 22:51 ./db/musl_1.2.0-1_amd64.so
$ readelf -Ws ./db/musl_1.2.0-1_amd64.so | grep '\bprintf\b'
   578: 000000000005d990   195 FUNC    GLOBAL DEFAULT    9 printf
$ readelf -Ws ./db.1/musl_1.2.0-1_amd64.so | grep '\bprintf\b'
   578: 000000000005e980   199 FUNC    GLOBAL DEFAULT    9 printf

This happens only for musl_1.2.0-1_amd64.so. This file parsed file was previously provided by http://security.ubuntu.com/ubuntu/pool/universe/m/musl//musl_1.2.0-1_amd64.deb and, now, it's provided by https://http.kali.org/pool/main/m/musl//musl_1.2.0-1_amd64.deb.

We should have something to avoid this.

Solutions that I see quickly (without thinking about the feasibility or the which one will be the most optimal) are:

We can add the distribution name to the downloaded file.
We rename libs using a checksum (without lots of collision, as sha256) and keep an index (as a file <HASH>.index keeping a trace of distribution providing the file (as done with the .url file). Or we can only rename the file and use the .url file to keep a listing of distributions providing the file (when many distributions are providing the same file).

The "get" script no longer works

Seems like one of the URL's is broken and the get script quits early in the process. Here's the output:

$ ./get
Getting package libc6 location for ubuntu-xenial-amd64
Getting ubuntu-xenial-amd64-libc6
  -> Location: http://security.ubuntu.com/ubuntu/pool/main/g/glibc/libc6_2.23-0ubuntu10_amd64.deb
  -> ID: libc6_2.23-0ubuntu10_amd64
  -> Downloading package
  -> Extracting package
  -> Writing libc to db/libc6_2.23-0ubuntu10_amd64.so
  -> Writing symbols to db/libc6_2.23-0ubuntu10_amd64.symbols
  -> Writing version info
Getting package libc6-i386 location for ubuntu-xenial-amd64
Getting ubuntu-xenial-amd64-libc6-i386
  -> Location: http://security.ubuntu.com/ubuntu/pool/main/g/glibc/libc6-i386_2.23-0ubuntu10_amd64.deb
  -> ID: libc6-i386_2.23-0ubuntu10_amd64
  -> Downloading package
  -> Extracting package
  -> Writing libc to db/libc6-i386_2.23-0ubuntu10_amd64.so
  -> Writing symbols to db/libc6-i386_2.23-0ubuntu10_amd64.symbols
  -> Writing version info
Getting package libc6 location for ubuntu-xenial-i386
Getting ubuntu-xenial-i386-libc6
  -> Location: http://security.ubuntu.com/ubuntu/pool/main/g/glibc/libc6_2.23-0ubuntu10_i386.deb
  -> ID: libc6_2.23-0ubuntu10_i386
  -> Downloading package
  -> Extracting package
  -> Writing libc to db/libc6_2.23-0ubuntu10_i386.so
  -> Writing symbols to db/libc6_2.23-0ubuntu10_i386.symbols
  -> Writing version info
Getting package libc6 location for ubuntu-bionic-amd64
Getting http://ftp.osuosl.org/pub/ubuntu/pool/main/g/glibc/libc6_2.27-3ubuntu1_amd64.deb
  -> Location: http://mirrors.kernel.org/ubuntu/pool/main/g/glibc/libc6_2.27-3ubuntu1_amd64.deb
  -> ID: libc6_2.27-3ubuntu1_amd64
  -> Downloading package
  -> Extracting package
  -> Writing libc to db/libc6_2.27-3ubuntu1_amd64.so
  -> Writing symbols to db/libc6_2.27-3ubuntu1_amd64.symbols
  -> Writing version info
Getting package libc6-i386 location for ubuntu-bionic-amd64
Getting http://ftp.osuosl.org/pub/ubuntu/pool/main/g/glibc/libc6-i386_2.27-3ubuntu1_amd64.deb
  -> Location: http://mirrors.kernel.org/ubuntu/pool/main/g/glibc/libc6-i386_2.27-3ubuntu1_amd64.deb
  -> ID: libc6-i386_2.27-3ubuntu1_amd64
  -> Downloading package
  -> Extracting package
  -> Writing libc to db/libc6-i386_2.27-3ubuntu1_amd64.so
  -> Writing symbols to db/libc6-i386_2.27-3ubuntu1_amd64.symbols
  -> Writing version info
Getting package libc6 location for ubuntu-bionic-i386
Getting http://ftp.osuosl.org/pub/ubuntu/pool/main/g/glibc/libc6_2.27-3ubuntu1_i386.deb
  -> Location: http://mirrors.kernel.org/ubuntu/pool/main/g/glibc/libc6_2.27-3ubuntu1_i386.deb
  -> ID: libc6_2.27-3ubuntu1_i386
  -> Downloading package
  -> Extracting package
  -> Writing libc to db/libc6_2.27-3ubuntu1_i386.so
  -> Writing symbols to db/libc6_2.27-3ubuntu1_i386.symbols
  -> Writing version info
Getting package libc6 location for ubuntu-disco-amd64
Getting http://ftp.osuosl.org/pub/ubuntu/pool/main/g/glibc/libc6_2.29-0ubuntu2_amd64.deb
  -> Location: http://mirrors.kernel.org/ubuntu/pool/main/g/glibc/libc6_2.29-0ubuntu2_amd64.deb
  -> ID: libc6_2.29-0ubuntu2_amd64
  -> Downloading package
Failed to download package from http://mirrors.kernel.org/ubuntu/pool/main/g/glibc/libc6_2.29-0ubuntu2_amd64.deb

Cannot download some libs.

cccccyd@CYDsLaptop:~/LibcSearcher/libc-database$ ./download libc6_2.23-0ubuntu10_amd64
Getting libc6_2.23-0ubuntu10_amd64
Invalid ID, maybe the library was fetched in an older version or added manually?

It just says its an invalid ID, I don't know why this happened...

The server does not seem to be working now

api response like this：

▶ curl -X POST -H 'Content-Type: application/json' \
--data '{"symbols": ["strcat"]}'
'https://libc.rip/api/libc/libc6_2.27-3ubuntu1.2_amd64'
{
"detail": "The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.",
"status": 500,
"title": "Internal Server Error",
"type": "about:blank"
}

can't find certain libc

I try to type in the ./find printf 260 puts f30 as you did in README.md. But it turns out I don't have certain libc as it showed in README.md ... （Of course, I have downloaded libc-database by using the command ./get ）
Could you please help me??

Getting more versions of glibc

Hi. I noticed that there are certain versions of glibc not included in the download script. For example, glibc 2.25 is not on Ubuntu, but on Fedora, so it's not downloaded. Is there anyway you can add this to the script? Thank you!

Here's the link to glibc 2.25 on Fedora:
https://fedora.pkgs.org/26/fedora-i386/glibc-2.25-6.fc26.i686.rpm.html

Add package url to searchengine api

Package url can be retrieved from api by replacing suffix .so with .url in "download_url" (though it's not documented). It would be useful to have easier access to this, directly from https://libc.rip/api/find endpoint. Maybe under "package_url" or "libs_url"?
This .url file was added in this PR: #10

TypeError: string indices must be integers

[+] There are multiple libc that meet current constraints :
Traceback (most recent call last):
File "/root/Desktop/PwnExploits/ciscn_2019_n_5.py", line 27, in
libbase = real_addr - libc.dump('puts')
File "/usr/local/lib/python3.10/dist-packages/LibcSearcher/LibcSearcher.py", line 68, in dump
self.determine_the_libc()
File "/usr/local/lib/python3.10/dist-packages/LibcSearcher/LibcSearcher.py", line 108, in determine_the_libc
self.select_libc()
File "/usr/local/lib/python3.10/dist-packages/LibcSearcher/LibcSearcher.py", line 76, in select_libc
print(str(index) + " - " + libc['id'])
TypeError: string indices must be integers

every online searcher , like LibcSearcher , LibcSearcherX is reporting this error.And found
https://libc.rip/api/
is reporting 404 Not Found.
Is server offline or sth else ?

Position independent scripts

All the scripts are currently using cd "$(dirname "$0")", so all files are downloaded into libc-database directory. Maybe current working directory should be as the base path for download and identify scripts?

libc.rip interval server error 500

$ curl 'https://libc.rip/api/find' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0' -H 'Accept: */*' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Referer: https://libc.rip/' -H 'Content-Type: application/json' -H 'Origin: https://libc.rip' -H 'Connection: keep-alive' -H 'Pragma: no-cache' -H 'Cache-Control: no-cache' --data-raw '{"symbols":{"__libc_start_main":"0xdeadbeef"}}'
{
  "detail": "The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.",
  "status": 500,
  "title": "Internal Server Error",
  "type": "about:blank"
}

Cannot search through web GUI nor programmatically. @niklasb is the web service still maintained? It was very useful.