Questions tagged [rop]

Return-oriented programming (ROP) is a computer security exploit technique that allows an attacker to execute code in the presence of security defenses such as executable space protection and code signing.

Filter by
Sorted by
Tagged with
1
vote
0answers
38 views

puts(address of stack) does not print the string pointed by the address

I am trying to do ROP using gadget chaining technique on a 64-bit machine. This is the source code: #include<stdio.h> int main(){ char * str = "Hello World!"; char buf[4]; puts(str)...
0
votes
0answers
55 views

Is JIT-compiler required for JIT-ROP attack?

I have been studying up on the concept of Just-in-Time (JIT) ROP attack (https://cs.unc.edu/~fabian/papers/oakland2013.pdf), and came across this question which I have not been able to find the ...
0
votes
0answers
38 views

Threat Model of -fstack-protector

In -fstack-protector the compiler skip instrumenting certain functions which are not deemed to be unsafe (using heurisitics such as filtering out functions not allocating stack buffers etc). What ...
3
votes
1answer
174 views

Where in a binary can '/bin/sh' be written to get a shell?

I've come across some behaviour in a CTF challenge that seems very strange and I was wondering if someone could help me understand it. The CTF challenge was the can-you-gets-me challenge in ...
1
vote
1answer
250 views

Return-oriented programming: Address of system() contains NULL byte

Disclaimer: I am asking this question solely for educational purposes. I am trying to chain some function calls using return-oriented programming, exploiting a vulnerable binary which uses strcpy(). ...
1
vote
1answer
395 views

How to find address of system() in an executable - ROP exploit

I'm trying to find the address of system() in a code repo that I'm trying to exploit using Return Oriented Programming (for a course project). The code has included stdlib.h but it has not used system(...
2
votes
1answer
609 views

Why ret2libc is not working in the below code on x86_64?

I am trying to bypass DEP in x86_64 (64 bit - ASLR OFF). I have my own vulnerable code and I have also written an exploit code with a basic ROP to jump into system() with parameter "/bin/sh", but it ...
1
vote
1answer
962 views

Dealing with NULL byte (0x00) in offsets

I'm trying to exploit a strcpy() buffer overflow vulnerability to test ROP attack. I found a very useful gadget at address 0x0000f26c so I am obliged to insert null bytes to the stack to override the ...
1
vote
1answer
248 views

ROP Attack :Force the program to manipulate an instruction as a gadget

I'm doing basic exploitation test on a simple program with fiew lines of code. I intend to exploit a buffer overflow vulnerability to perform a ROP attack. To gather the available gadgets I use ...
3
votes
2answers
211 views

Stack location range on linux for user process

In Linux, with ASLR enabled, is there a range of addresses where user stack address lies? What about heap, instruction addresses(text section)? In general, is it possible to look at an address and ...
3
votes
0answers
366 views

Full ASLR and ROP

How exactly do the exploit pieces connect when bypassing ASLR and DEP using ROP? It seems like there could be a number of ways. E.g. a full ROP based payload or a ROP payload that modifies a memory ...
5
votes
1answer
413 views

How does GCC's -mmitigate-rop work?

GCC 6 has a flag, -mmitigate-rop, which compiles binaries in a way that reduces the number gadgets exploitable by ROP. The GCC documentation explaining this feature is minimal: -mmitigate-rop Try ...