Collaborate Disseminate
I’m running into a challenge where I have control over the return address and the base pointer through my input, however the program null byte terminates and the addressing scheme only takes up 6 bytes. I’m using leave gadget to control th… Continue reading Rop With Null Bytes
I have the following problem: I have this C program and I have done buffer overflow using ROP gadgets. I have a problem with the output.
I want to stop the printf() call in the vuln function to get the right output but how can I achieve t… Continue reading Buffer Overflow with ROP Chain Output Problem
I’m doing a binary challenge from pwnable.kr and I’m examining a some ROP gadget.
Until now I’ve always used gadget ending with ret or syscall/int 0x80, but now ROPgadget gave me a gadget ending with ret 0.
What’s the difference wrt ret?
I was trying to solve the picoCTF challenge filtered-shellcode.
I started by trying to get the base-address of the libc library and executing system or execve. Important to note is that you can only use 2 Byte assembler commands, since the… Continue reading ROP-Attack on picoCTF challenge
In rop, often a gadget has an undesired pop or push in the middle.
For a pop, we handle this simply by adding a dummy value to our chain: it is popped, and all is well.
What about a push: What do we do to our chain to handle it? It seems t… Continue reading Rop: Handling a `push` in the middle of a gadget
I used Ropper to generate a 64 bits ropchain to execve a shell.
Unfortunately I get a segmentation fault in the middle of the chain. By inspecting in GDB I noticed the segv happens at a ret and rsp is not 16 bytes aligned so this implies t… Continue reading Why does my rop chain fails ? Is it because of alignment?
I used Ropper to generate a 64 bits ropchain to execve a shell.
Unfortunately I get a segmentation fault in the middle of the chain. By inspecting in GDB I noticed the segv happens at a ret and rsp is not 16 bytes aligned so this implies t… Continue reading Why does my rop chain fails ? Is it because of alignment?
It seems 64 bits adresses must end in two null bytes. But strcpy will copy only one null byte in the entire payload.
Continue reading How can I build ROP chains on 64 bits if my payload is copied through strcpy?
I want to understand how we are supposed to do a reverse shell during a ropchain and how to catch it back.
I found this tutorial
So if I understand well, we just have to:
dup2 stdin and stdout to our socket fd
write in memory /bin/sh if i… Continue reading Writing a reverse shell in the case of a remote ropchain [closed]
I am working on a blind ROP exploit, but I’m stuck at writing the ropchain.
I have 2 options:
ret2libc
writing a ropchain
I leaked 50% of the libc and the entire binary but my problem is that I can’t open libc in ida, and can’t use ROPga… Continue reading Writing a remote rop chain x64