search
MathematicsCryptography

Exploitation

hashtag
Source

#include <stdio.h>

int win(int x, int y, int z) {
    if(z == 0xdeadbeefcafed00d) {
        puts("Awesome work!");
    }
}

int main() {
    puts("Come on then, ret2csu me");

    char input[30];
    gets(input);
    return 0;
}

Obviously, you can do a ret2plt followed by a ret2libc, but that's really not the point of this. Try calling win(), and to do that you have to populate the register rdx. Try what we've talked about, and then have a look at the answer if you get stuck.

hashtag
Analysis

We can work out the addresses of the massive chains using r2, and chuck this all into pwntools.

circle-info

Note I'm not popping RBX, despite the call. This is because RBX ends up being 0 anyway, and you want to mess with the least number of registers you need to to ensure the best success.

hashtag
Exploitation

hashtag
Finding a win()

Now we need to find a memory location that has the address of win() written into it so that we can point r15 at it. I'm going to opt to call gets() again instead, and then input the address. The location we input to is a fixed location of our choice, which is reliable. Now we just need to find a location.

To do this, I'll run r2 on the binary then dcu main to contiune until main. Now let's check permissions:

The third location is RW, so let's check it out.

The address 0x404028 appears unused, so I'll write win() there.

hashtag
Reading in win()

To do this, I'll just use the ROP class.

hashtag
Popping the registers

Now we have the address written there, let's just get the massive ropchain and plonk it all in

hashtag
Sending it off

Don't forget to pass a parameter to the gets():

hashtag
Final Exploit

And we have successfully controlled RDX - without any RDX gadgets!

hashtag
Simplification

As you probably noticed, we don't need to pop off r12 or r13, so we can move POP_CHAIN a couple of intructions along:

Last updated

Was this helpful?