1 of 1

Exploitation with Syscalls

The Source

To make it super simple, I made it in assembly using pwntools:

The binary contains all the gadgets you need! First it executes a read syscall, writes to the stack, then the ret occurs and you can gain control.

But what about the /bin/sh? I slightly cheesed this one and couldn't be bothered to add it to the assembly, so I just did:

Exploitation

As we mentioned before, we need the following layout in the registers:

To get the address of the gadgets, I'll just do objdump -d vuln. The address of /bin/sh can be gotten using strings:

The offset from the base to the string is 0x1250 (-t x tells strings to print the offset as hex). Armed with all this information, we can set up the constants:

Now we just need to populate the registers. I'll tell you the padding is 8 to save time:

And wehey - we get a shell!

Exploitation with Syscalls

The Source

To make it super simple, I made it in assembly using pwntools:

from pwn import *

context.arch = 'amd64'
context.os = 'linux'

elf = ELF.from_assembly(
    '''
        mov rdi, 0;
        mov rsi, rsp;
        sub rsi, 8;
        mov rdx, 300;
        syscall;
        ret;
        
        pop rax;
        ret;
        pop rdi;
        ret;
        pop rsi;
        ret;
        pop rdx;
        ret;
    '''
)
elf.save('vuln')

The binary contains all the gadgets you need! First it executes a read syscall, writes to the stack, then the ret occurs and you can gain control.

But what about the /bin/sh? I slightly cheesed this one and couldn't be bothered to add it to the assembly, so I just did:

Exploitation

As we mentioned before, we need the following layout in the registers:

To get the address of the gadgets, I'll just do objdump -d vuln. The address of /bin/sh can be gotten using strings:

The offset from the base to the string is 0x1250 (-t x tells strings to print the offset as hex). Armed with all this information, we can set up the constants:

Now we just need to populate the registers. I'll tell you the padding is 8 to save time:

And wehey - we get a shell!

Exploitation with Syscalls

hashtagThe Source

hashtagExploitation

Exploitation with Syscalls

hashtagThe Source

hashtagExploitation

The Source

Exploitation

The Source

Exploitation