2

I was reading an article (exploitresearch.wordpress.com) about using ROP to bypass DEP/ASLR. Near the end he lays out the 33 steps for his payload. These are layed out in the order that the shellcode instructions are written in the final payload (also shown in the last HxD image @ offset 304). I am a little confused by the first few dwords:

1) 0x100016f0 (pop eax)
2) 0x01a19f7f (a value)
3) 0x10002fd7 (pop ecx)
4) 0x100bcc5a (another value)
5) mov [ecx], eax (*0x100bcc5a = 0x01a9f7f, delta between GetTimeZoneInformation and VirtualProtect)

How does pop eax followed by the address of a value save that value into eax? I thought you had to push the value then pop eax.

1

There's no need to perform any push operations since you control the stack already. You can have the data you wish to store within your registers already placed where you can conveniently perform operations with them.

In ROP, you find a series of useful code snippets present already within your target program that you can refer to as gadgets, which are typically the tail ends of normal subroutines that do operations you need for successful exploitation. You line up the addresses of the gadgets you wish to execute and the data you'd like to use with them inside a fake stack in memory you control before you perform a "stack pivot" to move your stack pointer (esp in x86) into your data.

After the stack pointer has been moved into your data, control of the program will be forfeited to your fake stack at the next ret. When this instruction executes, the top word/address on the stack (0x100016f0 in your example) will be popped of, and placed into the program counter to redirect it into a gadget on the tail end of some function looks like pop eax; ret;.

Where the next word on your stack is 2) 0x01a19f7f (a value), your stack pointer would already be pointing to this data when the pop instruction executes, storing this word inside your eax register.

Then, the ret to immediately follow pops off your next ROP gadget address to continue on in execution.

  • Ah that makes sense. Great explanation. I didn't put two and two together that our fake stack is where the pop refers to. Thanks! – Nitro Mar 21 '17 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.