1

I am trying to do ROP using gadget chaining technique on a 64-bit machine.

This is the source code:

#include<stdio.h>
int main(){
    char * str = "Hello World!";
    char buf[4];
    puts(str);
    gets(buf);

}

The code is compiled with -fno-stack-protector -no-pie and ASLR is turned off on the system as well.

Here is the disassembly of the binary: enter image description here

I want to print a string of my choice using gadget chaining. I plan to do this using puts and I found the relevant gadgets for the same. enter image description here

puts needs an address which is pointing to a string terminated with NULL. So I put my string on the buffer followed by a NULL and then overwrite the RET address with pop rdi;ret which is then followed by the value I want to put into RDI register. From the code, I found the address of the buffer and gave that address as input. So, now rdi contains the address to buffer. But when I call puts I am not getting any output.

Below are the value of registers before puts is called(using gadget). enter image description here

x/s address of buffer gives me the string I passed in as input

On changing the address of rdi from the buffer to the string within the code I am able to see HelloWorld getting printed twice.

Here is the payload: enter image description here

Here is the output: enter image description here

What goes wrong when the address is pointing to the stack? Is it not possible to print something that is already on the stack?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.