3
votes
Accepted
ROP Attack :Force the program to manipulate an instruction as a gadget
Short answer: yes.
Long answer:
Instructions on x86 processors vary in their length between 1 and many bytes.
(This works because no instruction can be a prefix of another instruction. Much like ...
- 1,111
2
votes
Accepted
Understanding ret2libc return address location
This is because on x86, stacks grow downwards (towards lower addresses), but buffers are filled upwards (towards higher addresses):
When writing out of the buffer, you are clobbering the return ...
- 643
2
votes
Accepted
Stack location range on linux for user process
Yes, there is a range, and you can determine that range trivially for any running process. Read a given process' /proc/<pid>/maps to see its memory layout, as well as the type of memory in each ...
- 66.5k
2
votes
Accepted
How to find address of system() in an executable - ROP exploit
Using print 'system@plt' is only valid if the program already has an existing function (called or not) that directly references system(). In your example that's not the case.
First, disable library ...
- 5,100
2
votes
Why ret2libc is not working in the below code on x86_64?
There are a few points to note:
1. The strcpy function stops copying stuff into the destination buffer as soon as it encounters a NULL byte. A NULL byte is 0x00 or \x00. In 64-bit machines, the ...
- 51
2
votes
Accepted
How can I build ROP chains on 64 bits if my payload is copied through strcpy?
You are correct. With strcpy() you can put at most one gadget.
The second null byte is often not a problem, as you often find a null byte there anyway from a previous address or integer.
If you need ...
- 1,111
2
votes
Accepted
Where in a binary can '/bin/sh' be written to get a shell?
You should be able to write to any writable page (unless the address contains some bad byte that the input vector will use as a delimiter or filter out). 0x80e9d60 is one such writable region.
There ...
- 544
1
vote
Rop: Handling a `push` in the middle of a gadget
If your gadgets addresses is known beforehand sending the ROP chain (i.e. a DEP without ASLR), you can also use a PUSH in a gadget, if you were able to POP into the same register before.
For example, ...
- 89
1
vote
Accepted
Rop: Handling a `push` in the middle of a gadget
Writing exploits is a bit like solving a puzzle where you get to make your own pieces. As long as it works it works. Of course the constraints for each vulnerable software does affect what you can and ...
- 5,939
1
vote
Return-oriented programming: Address of system() contains NULL byte
Is there some reason you need to leave the original process alive when your shellcode executes? Just call execve directly (assuming you can control the stack well enough), or one of its helper ...
- 46.3k
1
vote
ROP executes system("/bin/sh") but does not attach to it
If you have ASLR turned on (the default) for the system, those libc addresses in your exploit (e.g. 0x7ffff7e37e50) won't work. GDB will disable ASLR for the current debuggee, set by the disable-...
- 12.7k
1
vote
How do attackers determine ROP gadgets remotely?
Would an attacker need to determine:
The operating system?
If you mean like Linux vs. Windows, then definitely, since the executable format itself is going to differ across these platforms, and there ...
- 12.7k
1
vote
How do attackers determine ROP gadgets remotely?
ROP gadgets are based on the process' executable pages, which in practice usually means based on the process binary and the binaries of any libraries linked to it at runtime (there are exceptions with ...
- 46.3k
1
vote
Dealing with NULL byte (0x00) in offsets
Not that I am aware of but how about overwriting the return address with a "ret" gadget ? With a debugger try to find if there are null bytes above the return address...
If we consider rsp == 0x1000 ...
- 11
1
vote
Accepted
How does GCC's -mmitigate-rop work?
Looks like it was added:
https://gcc.gnu.org/ml/gcc-patches/2015-11/msg01773.html
I don't know if more was added later: but I think this code just looks for an instruction that can be re-interpreted ...
- 1,974
1
vote
ROP on MIPS Doesn't Land Where Calculated
Well, after talking to numerous people and playing around with Ghidra and a few top gadget finders. This appears to be a common occurrence and isn't actually surprising. I was able to find the gadget ...
- 121
1
vote
Accepted
Is it possible to use ROP to call legitimate functions even if the stack is not executable?
That code is a classic example of a buffer overflow vulnerability. Memory corruption is certainly possible in this case, but whether or not it's exploitable for remote code execution or arbitrary ...
- 12.7k
1
vote
Accepted
ROP gadget for setuid(zero) - writing argument zero into the stack
While the program itself may not have a format string vulnerability, you can still use the same technique to abuse printf's ability to write arbitrary data at relative offsets without even knowing the ...
- 12.7k
1
vote
Accepted
segmentation fault at strcpy while perforforming a buffer overflow
Edit: I was able to replicate what you saw in a debugger at first. I set a breakpoint at strcpy, and trying to step over it would result in a segfault. However, if I set a breakpoint on the ...
- 12.7k
1
vote
How to use "jmp" in ROP
Using jmp may not result in a ROP friendly return of control to your stack. You're better off finding alternate gadgets to achieve your goal.
Also for your proposed solution if your exploit is able ...
- 5,939
1
vote
Accepted
Cannot build a ROP chain
The problem was actually in Python 3 that couldn't output a raw bytes in a straightforward way like in Python 2.
Also, my theory about add esp, 8; pop ebx; ret gadget is correct :) This is an ...
- 59
1
vote
Cannot build a ROP chain
If you fix this issue, I believe you will be successful.
gef➤ ropper --search pop
[...]
0x0804901e: pop ebx; ret;
0x080491c4: pop edi; pop ebp; ret;
[...]
These gadgets don't "mess up" the stack ...
- 12.7k
1
vote
Remote Buffer Overflow w/out Memory Leak
In the end, it turns out that I was making an elementary mistake. Prefixing my shellcode with a NOP sled ended up successfully exploiting the remote instance of the vulnerable application.
- 366
Only top scored, non community-wiki answers of a minimum length are eligible