Questions tagged [rop]

Return-oriented programming (ROP) is a computer security exploit technique that allows an attacker to execute code in the presence of security defenses such as executable space protection and code signing.

Filter by
Sorted by
Tagged with
0 votes
0 answers
101 views

ROP-Attack on picoCTF challenge

I was trying to solve the picoCTF challenge filtered-shellcode. I started by trying to get the base-address of the libc library and executing system or execve. Important to note is that you can only ...
user avatar
  • 1
1 vote
1 answer
86 views

Rop: Handling a `push` in the middle of a gadget

In rop, often a gadget has an undesired pop or push in the middle. For a pop, we handle this simply by adding a dummy value to our chain: it is popped, and all is well. What about a push: What do we ...
user avatar
0 votes
0 answers
56 views

Why does my rop chain fails ? Is it because of alignment?

I used Ropper to generate a 64 bits ropchain to execve a shell. Unfortunately I get a segmentation fault in the middle of the chain. By inspecting in GDB I noticed the segv happens at a ret and rsp is ...
user avatar
  • 1
0 votes
1 answer
70 views

How can I build ROP chains on 64 bits if my payload is copied through strcpy? [duplicate]

It seems 64 bits adresses must end in two null bytes. But strcpy will copy only one null byte in the entire payload.
user avatar
  • 123
3 votes
2 answers
368 views

ROP executes system("/bin/sh") but does not attach to it

Here is the code: import struct buf = "" buf += "A" * 552 buf += struct.pack('<Q', 0x401493) # pop rdi; ret buf += struct.pack('<Q', 0x7ffff7f79152) # /bin/sh buf += ...
user avatar
  • 131
0 votes
0 answers
85 views

Question about RTL (or ROP) chaining order

I'm confused now about how the order is set up for the ROP chain. Let's say we'd like to make a chain below in C: open("myfile", O_RDONLY); read(3, buf, 100); in payload: p32(OPEN_ADDR) p32(...
user avatar
0 votes
0 answers
90 views

Should using a FIPS capable OpenSSL implementation be avoided?

The standard OpenSSL build with the FIPS option will use a base address for libeay64.dll of 0xFB00000. Since the FIPS module is not re-locatable, it cannot take part in Address Space Layout ...
user avatar
  • 101
0 votes
0 answers
151 views

Trouble understanding buffer overflow to print a string

I have the following program: #include<stdio.h> int main() { int i=0; foo(); printf("Hello there!"); func(); } int foo(void) { char str[14]; strncpy(str,&...
user avatar
  • 21
0 votes
1 answer
127 views

Segfault after reaching system

I'm doing a pretty bog-standard return-to-libc attack and I'm in a bit of a pickle. I first got the entire attack working with my local version of libc, then I used the version of libc provided by the ...
user avatar
  • 101
0 votes
0 answers
83 views

Retrieving data in a particular address found from ROPgadget

I am trying to solve a CTF challenge which involves return oriented programming. The challenge is here: https://ctflearn.com/challenge/1012 I used the ROPgadget tool to search for gadgets in the ...
user avatar
1 vote
2 answers
209 views

How do attackers determine ROP gadgets remotely?

Being gadgets change per each system and architecture (do they?), how would an attacker be able to determine the offsets of various Return Oriented Programming gadgets, would an attacker first need to ...
user avatar
-1 votes
1 answer
121 views

is it possible to call libc function with rop

let say hacker want to come over the aslr or he want to call function that doesn't exists in user program ,can he insert to the return address address to the share library function or this functions ...
user avatar
  • 34
1 vote
1 answer
506 views

Understanding ret2libc return address location

I recently was studying x86 buffer overflows + ret2libc attacks from https://www.ret2rop.com/2018/08/return-to-libc.html and I noticed the order is as follows: bytes to fill buffer + address of system ...
user avatar
  • 13
1 vote
1 answer
124 views

ROP on MIPS Doesn't Land Where Calculated

I am working on exploiting an application on MIPS to further my knowledge of ROP chaining. The library I am trying to build a ROP chain is libuClibc-0.9.30.3.so. I found a gadget that I want to use ...
user avatar
  • 121
0 votes
1 answer
128 views

Is it possible to use ROP to call legitimate functions even if the stack is not executable?

I read about the hardware protection that blocks the CPU from jumping to stack address. But hacker may still edit the return address to an address in code memory that shouldn't run at that moment. For ...
user avatar
  • 13
0 votes
0 answers
466 views

ROP execute a shell with execl() - /bin/sh: 0: Can't open

A vulnerable C program to stack buffer overflow, requires 112 byte stuffing to get to return address of the calling function. Here the Strcpy() is the vulnerable function. void f(char *name){ char ...
user avatar
1 vote
1 answer
520 views

ROP gadget for setuid(zero) - writing argument zero into the stack

Having a program vulnerable to stack based buffer overflow with setuid bit set, and want to fill the buffer with ROP gadgets. If setuid(0) is needed to spawn a shell with root privilege, then '0' ...
user avatar
2 votes
1 answer
836 views

segmentation fault at strcpy while perforforming a buffer overflow

I have this code that I need to use to perform a ret2libc #include <stdio.h> #include <string.h> int main(int argc, char *argv[]) { char buf[256]; printf("buff is at:%p\n",buf); ...
user avatar
  • 23
2 votes
1 answer
217 views

How to use "jmp" in ROP

I'm trying to put together a ROP chain. I'm looking for a gadget to do the following: mov rdi, rdx ; mov rbp, rsp ; ret; But instead, I have a gadget like this : mov rdi, rdx ; mov rbp, rsp ; ...
user avatar
  • 31
1 vote
0 answers
94 views

Kernel ROP crashes running OS

I was experimenting to see if I can make an ROP chain within the kernel. In the kernel debugging mode, I can make the first jump to an arbitrary gadget address without any problem. But the problem ...
user avatar
  • 31
2 votes
2 answers
657 views

Cannot build a ROP chain

My ROP exploit crashes with segmentation fault for unknown reason. This is a vulnerable code (compiled via command gcc h2.c -no-pie -fno-stack-protector -m32 -o h2): #include <stdio.h> #include &...
user avatar
  • 59
1 vote
1 answer
467 views

Remote Buffer Overflow w/out Memory Leak

I'm working on an exploit development challenge right now in which I've been presented with a compiled binary and I have to exploit it on a remote server. No stack protections have been enabled and ...
user avatar
1 vote
0 answers
147 views

puts(address of stack) does not print the string pointed by the address

I am trying to do ROP using gadget chaining technique on a 64-bit machine. This is the source code: #include<stdio.h> int main(){ char * str = "Hello World!"; char buf[4]; puts(str)...
user avatar
0 votes
0 answers
191 views

Is JIT-compiler required for JIT-ROP attack?

I have been studying up on the concept of Just-in-Time (JIT) ROP attack (https://cs.unc.edu/~fabian/papers/oakland2013.pdf), and came across this question which I have not been able to find the ...
user avatar
  • 1
4 votes
1 answer
1k views

Where in a binary can '/bin/sh' be written to get a shell?

I've come across some behaviour in a CTF challenge that seems very strange and I was wondering if someone could help me understand it. The CTF challenge was the can-you-gets-me challenge in ...
user avatar
  • 143
3 votes
1 answer
1k views

Return-oriented programming: Address of system() contains NULL byte

Disclaimer: I am asking this question solely for educational purposes. I am trying to chain some function calls using return-oriented programming, exploiting a vulnerable binary which uses strcpy(). ...
user avatar
  • 151
1 vote
1 answer
8k views

How to find address of system() in an executable - ROP exploit

I'm trying to find the address of system() in a code repo that I'm trying to exploit using Return Oriented Programming (for a course project). The code has included stdlib.h but it has not used system(...
user avatar
  • 13
3 votes
1 answer
3k views

Why ret2libc is not working in the below code on x86_64?

I am trying to bypass DEP in x86_64 (64 bit - ASLR OFF). I have my own vulnerable code and I have also written an exploit code with a basic ROP to jump into system() with parameter "/bin/sh",...
user avatar
  • 51
1 vote
1 answer
2k views

Dealing with NULL byte (0x00) in offsets

I'm trying to exploit a strcpy() buffer overflow vulnerability to test ROP attack. I found a very useful gadget at address 0x0000f26c so I am obliged to insert null bytes to the stack to override the ...
user avatar
  • 73
1 vote
1 answer
470 views

ROP Attack :Force the program to manipulate an instruction as a gadget

I'm doing basic exploitation test on a simple program with fiew lines of code. I intend to exploit a buffer overflow vulnerability to perform a ROP attack. To gather the available gadgets I use ...
user avatar
  • 73
3 votes
2 answers
2k views

Stack location range on linux for user process

In Linux, with ASLR enabled, is there a range of addresses where user stack address lies? What about heap, instruction addresses(text section)? In general, is it possible to look at an address and ...
user avatar
5 votes
1 answer
1k views

How does GCC's -mmitigate-rop work?

GCC 6 has a flag, -mmitigate-rop, which compiles binaries in a way that reduces the number gadgets exploitable by ROP. The GCC documentation explaining this feature is minimal: -mmitigate-rop Try ...
user avatar
  • 64k