Collaborate Disseminate
[Ryan Miceli] wanted to build some reverse engineering skills by finding a new exploit for an original Xbox. Where he ended up was an exploit that worked across the network, …read more Continue reading Kickflips and Buffer Slips: An Exploit in Tony Hawk’s Pro Skater
Jump-oriented Programming: Why is it better/easier to jump to the dispatcher gadget than to jump from one functional gadget directly to another functional gadget?
My understanding of JOP:
In jump-oriented programming (as described in e.g. … Continue reading Jump-Oriented Programming: Why is it better/easier to jump to the dispatcher gadget than to jump from one functional gadget directly to another?
Full title: Jump-Oriented Programming: Is it harder than traditional return-oriented programming because you need to manually prepare all the addresses and registers or is there a different reason?
And does that mean that a large percentag… Continue reading Jump-Oriented Programming: Harder than ROP because the registers need to be prepared individually? + Turing complete, but large overhead/slow?
I am trying to do a returntolibc exploit. The goal is to gain a shell with root privilege by calling setuid(0) and then system("/bin/sh"). I have been agonizing over trying to get this thing to accept my payload, but bash keeps d… Continue reading Bash deletes null bytes in exploit input for ROP/returntolibc
I usually use a different method to push /bin/sh in rdi to get a shell, but I wanted to try this one :
Put in case that I can control the RIP and there are no limitations or filters. So I can execute the assembly code as I want.
mov rax, … Continue reading push /bin/sh to get a shell
I have found the padding payload to gain a buffer overflow. Now I need to execute the shellcode. I’m looking for a jmp rsp gadget but I haven’t found it. Can I directly put the rsp address manually or should I combine other gadgets (ASLR d… Continue reading No jmp rsp gadget in buffer overflow
Here is the elf summary of the program:
Arch: amd64-64-little
RELRO: Partial RELRO
Stack: No canary found
NX: NX enabled
PIE: No PIE (0x400000)
This is the main function of the disassembly of the p… Continue reading Trying to ret2text on 64bit program issues, can’t jump to shell
I’m trying to decide between AMD or Intel for a new build. I was reading about protection from ROP-attacks and it seems like Intel and AMD are handling this in different ways.
AMD Zen 3 and later processors support Shadow Stack protection…. Continue reading Intel CET more secure than AMD Shadow Stack?
I am facing a CTF challenge in which I have to conduct an attack using a ROP chain on this program below:
#include <stdio.h>
#include <stdint.h>
#include <stdbool.h>
#include <sys/stat.h>
#include <fcntl.h>
TLDR: With PIE and ASLR enabled, am I able to calculate the base address of other parts of an x64 elf binary (e.g data segment, stack) if I know the base address of libc?
I’m looking at an x64 elf binary with ASLR, PIE, and NX constraints…. Continue reading Find other addresses with libc address