2

I'm trying to learn ROP chaining on a 64 bit Linux machine and I've run into some issues. I'm using the following code for the buffer overflow (taken from this tutorial):

#include <string.h>
#include <stdio.h>
#include <stdlib.h>

char *not_used = "/bin/sh";

void not_called() {
    printf("Not quite a shell...\n");
    system("/bin/date");
}

void vulnerable_function(char* string) {
    char buffer[100];
    strcpy(buffer, string);
}

int main(int argc, char **argv) {
    vulnerable_function(argv[1]);
    return 0;
}

The issue I'm running into is that the address to the ROP gadget (from libc) is 0x7EFBF7B267DB which is the address for a pop %rax; pop %rdi; call %rax;. However if my payload is, for example: \x41\x41\x41.....\x41\x41\xdb\x67\xb2\xf7\xfb\x7e\x41\x41\x41\x41\x41\x41, then it tries to call 0x41417EFBF7B267DB instead of 0x7EFBF7B267DB. I don't know any ways around this. Any suggestions?

1 Answer 1

3

A 64 bit address means each address will be 8 byte long. The address that you want to point to is 0x00007EFBF7B267DB instead of 0x7EFBF7B267DB.
Change your input to \x41\x41\x41.....\x41\x41\xdb\x67\xb2\xf7\xfb\x7e \x00\x00\x41\x41\x41\x41 and your code should run fine.

EDIT after further analyzing the issue in comments:
This link from Reverse engineering SE shows that ROP for a 64 bit machine can be tricky especially if you have null bytes in the address and the exploit code has strcpy.
The link suggests using a series of bugs and creating a chain to fix the issue or if you just want to use a shell code, then writing a suggested harness to your shell code.

8
  • Thanks for the answer! Unfortunately the buffer overflow is done thru the strcpy function, so adding null bytes is not an option. Nov 28, 2016 at 0:18
  • @WilliamMoffitt the tutorial says "If you are attempting to follow along with this tutorial, it might be helpful to have a Linux machine you can compile and run 32 bit code on."
    – Limit
    Nov 28, 2016 at 3:54
  • I am not following along with that tutorial, I just linked to it because I am using their vulnerable code. Honestly, I don't think it is possible to perform this exploit on a 64 bit machine, I just wanted to see if there is some trick I didn't know about. If not I'll be changing strcpy to memcpy and moving on :). Nov 28, 2016 at 4:31
  • @WilliamMoffitt If your eventual goal is to generate a shell, you can try returning to the not_called method. Not sure though if you'll get a 8/7 byte address to jump to in that case!
    – Limit
    Nov 28, 2016 at 4:33
  • I think you might be confusing the not_called method with the one from the code earlier in that tutorial. not_called just calls /bin/date in this case. Also the address length shouldn't matter if it's the last thing in the payload (unless the previous return address on the stack is longer than the one I overwrite it with, which would be strange). Nov 28, 2016 at 5:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .