Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [rop]

Return-oriented programming (ROP) is a computer security exploit technique that allows an attacker to execute code in the presence of security defenses such as executable space protection and code signing.

Filter by
Sorted by
Tagged with
0 votes
0 answers
64 views

Bash deletes null bytes in exploit input for ROP/returntolibc

I am trying to do a returntolibc exploit. The goal is to gain a shell with root privilege by calling setuid(0) and then system("/bin/sh"). I have been agonizing over trying to get this thing ...
germphjd's user avatar
0 votes
0 answers
82 views

push /bin/sh to get a shell

I usually use a different method to push /bin/sh in rdi to get a shell, but I wanted to try this one : Put in case that I can control the RIP and there are no limitations or filters. So I can execute ...
tpau's user avatar
  • 1
0 votes
0 answers
87 views

Trying to ret2text on 64bit program issues, can't jump to shell

Here is the elf summary of the program: Arch: amd64-64-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x400000) This is the ...
Nsion's user avatar
  • 1
0 votes
0 answers
593 views

Intel CET more secure than AMD Shadow Stack?

I'm trying to decide between AMD or Intel for a new build. I was reading about protection from ROP-attacks and it seems like Intel and AMD are handling this in different ways. AMD Zen 3 and later ...
Cass9000's user avatar
0 votes
1 answer
293 views

64-bit ROP-based Buffer Overflow Attack

I am facing a CTF challenge in which I have to conduct an attack using a ROP chain on this program below: #include <stdio.h> #include <stdint.h> #include <stdbool.h> #include <sys/...
justsobad's user avatar
0 votes
0 answers
182 views

Buffer Overflow with ROP Chain Output Problem

I have the following problem: I have this C program and I have done buffer overflow using ROP gadgets. I have a problem with the output. I want to stop the printf() call in the vuln function to get ...
Flowless Man's user avatar
0 votes
1 answer
414 views

ROP - ret VS ret 0

I'm doing a binary challenge from pwnable.kr and I'm examining a some ROP gadget. Until now I've always used gadget ending with ret or syscall/int 0x80, but now ROPgadget gave me a gadget ending with ...
Marco Balo's user avatar
1 vote
2 answers
869 views

Rop: Handling a `push` in the middle of a gadget

In rop, often a gadget has an undesired pop or push in the middle. For a pop, we handle this simply by adding a dummy value to our chain: it is popped, and all is well. What about a push: What do we ...
SRobertJames's user avatar
0 votes
1 answer
378 views

How can I build ROP chains on 64 bits if my payload is copied through strcpy? [duplicate]

It seems 64 bits adresses must end in two null bytes. But strcpy will copy only one null byte in the entire payload.
boredaf's user avatar
  • 143
2 votes
2 answers
2k views

ROP executes system("/bin/sh") but does not attach to it

Here is the code: import struct buf = "" buf += "A" * 552 buf += struct.pack('<Q', 0x401493) # pop rdi; ret buf += struct.pack('<Q', 0x7ffff7f79152) # /bin/sh buf += ...
Toma's user avatar
  • 121
0 votes
0 answers
163 views

Question about RTL (or ROP) chaining order

I'm confused now about how the order is set up for the ROP chain. Let's say we'd like to make a chain below in C: open("myfile", O_RDONLY); read(3, buf, 100); in payload: p32(OPEN_ADDR) p32(...
user257164's user avatar
0 votes
1 answer
596 views

Segfault after reaching system

I'm doing a pretty bog-standard return-to-libc attack and I'm in a bit of a pickle. I first got the entire attack working with my local version of libc, then I used the version of libc provided by the ...
nickelpro's user avatar
  • 111
1 vote
2 answers
579 views

How do attackers determine ROP gadgets remotely?

Being gadgets change per each system and architecture (do they?), how would an attacker be able to determine the offsets of various Return Oriented Programming gadgets, would an attacker first need to ...
asd40732's user avatar
-1 votes
1 answer
243 views

is it possible to call libc function with rop

let say hacker want to come over the aslr or he want to call function that doesn't exists in user program ,can he insert to the return address address to the share library function or this functions ...
daniel's user avatar
  • 34
1 vote
1 answer
1k views

Understanding ret2libc return address location

I recently was studying x86 buffer overflows + ret2libc attacks from https://www.ret2rop.com/2018/08/return-to-libc.html and I noticed the order is as follows: bytes to fill buffer + address of system ...
asd_665's user avatar
  • 13
1 vote
1 answer
328 views

ROP on MIPS Doesn't Land Where Calculated

I am working on exploiting an application on MIPS to further my knowledge of ROP chaining. The library I am trying to build a ROP chain is libuClibc-0.9.30.3.so. I found a gadget that I want to use ...
joshu's user avatar
  • 121
0 votes
1 answer
351 views

Is it possible to use ROP to call legitimate functions even if the stack is not executable?

I read about the hardware protection that blocks the CPU from jumping to stack address. But hacker may still edit the return address to an address in code memory that shouldn't run at that moment. For ...
for the's user avatar
  • 13
0 votes
1 answer
871 views

ROP execute a shell with execl() - /bin/sh: 0: Can't open

A vulnerable C program to stack buffer overflow, requires 112 byte stuffing to get to return address of the calling function. Here the Strcpy() is the vulnerable function. void f(char *name){ char ...
Marco_81's user avatar
1 vote
1 answer
1k views

ROP gadget for setuid(zero) - writing argument zero into the stack

Having a program vulnerable to stack based buffer overflow with setuid bit set, and want to fill the buffer with ROP gadgets. If setuid(0) is needed to spawn a shell with root privilege, then '0' ...
Marco_81's user avatar
2 votes
1 answer
2k views

segmentation fault at strcpy while perforforming a buffer overflow

I have this code that I need to use to perform a ret2libc #include <stdio.h> #include <string.h> int main(int argc, char *argv[]) { char buf[256]; printf("buff is at:%p\n",buf); ...
Luigi 's user avatar
  • 23
2 votes
1 answer
461 views

How to use "jmp" in ROP

I'm trying to put together a ROP chain. I'm looking for a gadget to do the following: mov rdi, rdx ; mov rbp, rsp ; ret; But instead, I have a gadget like this : mov rdi, rdx ; mov rbp, rsp ; ...
perplex's user avatar
  • 31
1 vote
0 answers
128 views

Kernel ROP crashes running OS

I was experimenting to see if I can make an ROP chain within the kernel. In the kernel debugging mode, I can make the first jump to an arbitrary gadget address without any problem. But the problem ...
perplex's user avatar
  • 31
2 votes
2 answers
1k views

Cannot build a ROP chain

My ROP exploit crashes with segmentation fault for unknown reason. This is a vulnerable code (compiled via command gcc h2.c -no-pie -fno-stack-protector -m32 -o h2): #include <stdio.h> #include &...
Asm .'s user avatar
  • 59
1 vote
1 answer
650 views

Remote Buffer Overflow w/out Memory Leak

I'm working on an exploit development challenge right now in which I've been presented with a compiled binary and I have to exploit it on a remote server. No stack protections have been enabled and ...
leaustinwile's user avatar
1 vote
0 answers
318 views

puts(address of stack) does not print the string pointed by the address

I am trying to do ROP using gadget chaining technique on a 64-bit machine. This is the source code: #include<stdio.h> int main(){ char * str = "Hello World!"; char buf[4]; puts(str)...
pankul garg's user avatar
0 votes
0 answers
267 views

Is JIT-compiler required for JIT-ROP attack?

I have been studying up on the concept of Just-in-Time (JIT) ROP attack (https://cs.unc.edu/~fabian/papers/oakland2013.pdf), and came across this question which I have not been able to find the ...
zzang3's user avatar
  • 1
4 votes
1 answer
2k views

Where in a binary can '/bin/sh' be written to get a shell?

I've come across some behaviour in a CTF challenge that seems very strange and I was wondering if someone could help me understand it. The CTF challenge was the can-you-gets-me challenge in ...
Zack's user avatar
  • 143
3 votes
1 answer
2k views

Return-oriented programming: Address of system() contains NULL byte

Disclaimer: I am asking this question solely for educational purposes. I am trying to chain some function calls using return-oriented programming, exploiting a vulnerable binary which uses strcpy(). ...
foobar's user avatar
  • 151
1 vote
1 answer
12k views

How to find address of system() in an executable - ROP exploit

I'm trying to find the address of system() in a code repo that I'm trying to exploit using Return Oriented Programming (for a course project). The code has included stdlib.h but it has not used system(...
Nikhil's user avatar
  • 13
3 votes
1 answer
3k views

Why ret2libc is not working in the below code on x86_64?

I am trying to bypass DEP in x86_64 (64 bit - ASLR OFF). I have my own vulnerable code and I have also written an exploit code with a basic ROP to jump into system() with parameter "/bin/sh",...
bsdboy's user avatar
  • 51
1 vote
1 answer
3k views

Dealing with NULL byte (0x00) in offsets

I'm trying to exploit a strcpy() buffer overflow vulnerability to test ROP attack. I found a very useful gadget at address 0x0000f26c so I am obliged to insert null bytes to the stack to override the ...
Ahmed's user avatar
  • 83
1 vote
1 answer
698 views

ROP Attack :Force the program to manipulate an instruction as a gadget

I'm doing basic exploitation test on a simple program with fiew lines of code. I intend to exploit a buffer overflow vulnerability to perform a ROP attack. To gather the available gadgets I use ...
Ahmed's user avatar
  • 83
3 votes
2 answers
3k views

Stack location range on linux for user process

In Linux, with ASLR enabled, is there a range of addresses where user stack address lies? What about heap, instruction addresses(text section)? In general, is it possible to look at an address and ...
abjoshi - Reinstate Monica's user avatar
5 votes
1 answer
1k views

How does GCC's -mmitigate-rop work?

GCC 6 has a flag, -mmitigate-rop, which compiles binaries in a way that reduces the number gadgets exploitable by ROP. The GCC documentation explaining this feature is minimal: -mmitigate-rop Try ...
forest's user avatar
  • 66.8k