2

I'm practicing exploit development and one of the scenario I am haing most difficulties with is stack pivoting besides the "ADD ESP, XXX" or something like that.

The question is, during the writing of a ROP chain, when you don't have any usable gadget that mess with ESP register (like ADD, MOV something in it) what can i try to move ESP back to my buffer and so start the ROP chain?

Im on a Intel IA-32 in a Windows environment (7+ with DEP enabled).

  • This kind of question needs to at least specify the platform. I'm guessing you are on contemporary Intel CPUs and compatibles, but it would be far better if you just spelled it out. – a CVn Sep 22 '17 at 9:10
  • Yeah, i'm sorry. You're right: Intel IA-32 in Windows environment (7+ with DEP enabled). – Kartone Sep 22 '17 at 9:16
  • If you happen to use Immunity, have you tried mona.py? I think I remember it having a feature of searching for stack pivots I found useful. Otherwise, maybe you can find some unintended instructions, or something like pop esp, or xchg esp, e*x ? – dreamist Sep 29 '17 at 4:35
  • @dreamist yeah, i’m using mona.py and yes, i tried to find that kind of gadget. :-/ – Kartone Sep 29 '17 at 5:42
2

Assuming you're building a ROP chain that needs to manipulate the stack, you can always go for semantically equivalent gadgets, e.g. PUSH/POP, MOV ESP XXX, (SUB,ADD) ESP instructions to build the stack: https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/#chainingbasics http://neilscomputerblog.blogspot.com/2012/06/stack-pivoting.html

Also, for XXX/actual constants (immediates) for SUB/ADD ESP XXX, you can always LEA a register then even MOV ESP, XXX/REG:

https://web.archive.org/web/20171107030509/http://x86.renejeschke.de/html/file_module_x86_id_176.html

Last, depending on the DLL/EXE you're searching for gadgets in, if you can't easily ADD/SUB ESP you could do a slew of things (using volatile registers):

;ADD/INC ESP SEMANTICS EQUIVALENT 
POP EBX      ;semantically same as MOV EBX, ESP; ADD ESP 0x4
XOR EBX, EBX ;zeroes EBX if you wanna reuse the register

;SUB/DEC ESP SEMANTICS EQUIVALENT
PUSH EBX     ;semantically same as MOV ESP, EBX; SUB ESP 0x4

You can even get fancy and mov values into a volatile register, SHL/SHR/ROL/ROR it and then use LEA/PUSH. It's all up to you to be creative!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.