So I have a Linux x86-64 binary linked with libc dynamically running on patched Ubuntu 16.04 remotely.
The executable makes one call to libc read and exits, allowing simple stack overflow into ROP. That's the only code compiled into the binary.
----------------------- gdb-peda$ checksec CANARY : disabled FORTIFY : disabled NX : ENABLED PIE : disabled RELRO : Partial -----------------------
Full ASLR is enabled.
I do not have access to a syscall gadget at any known address, and after hearing that vsyscall might work, I learned that vsyscall is now emulated in newer kernel versions and can't be used for a syscall gadget.
I've done manual searches for int 0x80, syscall, and sysenter hoping to find them in known executable section to no avail.
Does anyone know of any way to exploit this binary without any known address except for 'read'?
I suppose the only way that I can imagine is by somehow reading a libc address from the GOT and ROPing into dereferencing that address into a new function at a new offset... but I can't even find a gadget that will let me dereference.
I can't use partial address overwrite bruteforcing because x86-64 has too much entropy.
Is there some technique that I don't know of?
I'm banging my head against a wall on this one!