1 of 1

Exploit

Duplicating the Descriptors

Source

I'll include source.c, but most of it is socket programming derived from here. The two relevent functions - vuln() and win() - I'll list below.

Quite literally an easy ret2win.

Exploitation

Start the binary with ./vuln 9001.

Basic setup, except it's a remote process:

Testing Offset

I pass in a basic pattern and pause directly before:

Once the pause() is reached, I hook on with radare2 and set a breakpoint at the ret.

Ok, so the offset is 40.

Generate Exploit

Should be fairly simple, right?

What the hell?

But if we look on the server itself:

A shell was popped there! This is the we talked about before.

So we have a shell, but no way to control it. Time to use dup2.

I've simplified this challenge a lot by including a call to dup2() within the vulnerable binary, but normally you would leak libc via the and then use libc's dup2() rather than the PLT; this walkthrough is about the basics, so I kept it as simple as possible.

Duplicating File Descriptors

As we know, we need to call dup2(newfd, oldfd). newfd will be 4 (our connection fd) and oldfd will be 0 and 1 (we need to call it twice to redirect bothstdin and stdout). Knowing what you do about , have a go at doing this and then caling win(). The answer is below.

Using dup2()

Since we need two parameters, we'll need to find a gadget for RDI and RSI. I'll use ROPgadget to find these.

Plonk these values into the script.

Now to get all the calls to dup2().

And wehey - the file descriptors were successfully duplicated!

Final Exploit

Pwntools' ROP

These kinds of chains are where pwntools' ROP capabilities really come into their own:

Works perfectly and is much shorter and more readable!

Exploit

Duplicating the Descriptors

Source

I'll include source.c, but most of it is socket programming derived from here. The two relevent functions - vuln() and win() - I'll list below.

void vuln(int childfd) {
    char buffer[30];

    read(childfd, buffer, 500);
    write(childfd, "Thanks!", 8);
}

void win() {
    system("/bin/sh");
}

Quite literally an easy ret2win.

Exploitation

Start the binary with ./vuln 9001.

Basic setup, except it's a remote process:

Testing Offset

I pass in a basic pattern and pause directly before:

Once the pause() is reached, I hook on with radare2 and set a breakpoint at the ret.

Ok, so the offset is 40.

Generate Exploit

Should be fairly simple, right?

What the hell?

But if we look on the server itself:

A shell was popped there! This is the we talked about before.

So we have a shell, but no way to control it. Time to use dup2.

Duplicating File Descriptors

Using dup2()

Since we need two parameters, we'll need to find a gadget for RDI and RSI. I'll use ROPgadget to find these.

Plonk these values into the script.

Now to get all the calls to dup2().

And wehey - the file descriptors were successfully duplicated!

Final Exploit

Pwntools' ROP

These kinds of chains are where pwntools' ROP capabilities really come into their own:

Works perfectly and is much shorter and more readable!

Exploit

hashtagSource

hashtagExploitation

hashtagTesting Offset

hashtagGenerate Exploit

hashtagDuplicating File Descriptors

hashtagUsing dup2()

hashtagFinal Exploit

hashtagPwntools' ROP

Exploit

hashtagSource

hashtagExploitation

hashtagTesting Offset

hashtagGenerate Exploit

hashtagDuplicating File Descriptors

hashtagUsing dup2()

hashtagFinal Exploit

hashtagPwntools' ROP

Source

Exploitation

Testing Offset

Generate Exploit

Duplicating File Descriptors

Using dup2()

Final Exploit

Pwntools' ROP

Source

Exploitation

Testing Offset

Generate Exploit

Duplicating File Descriptors

Using dup2()

Final Exploit

Pwntools' ROP