I am trying to get a ROP exploit to work on Ubuntu 18.04 LTS 64bit.
I have a 64 bit binary (Nx enabled, ASLR disabled) with vuln function as follows:
public vuln vuln proc near var_100= byte ptr -100h push rbp mov rbp, rsp sub rsp, 100h lea rdi, s ; "Gimme some data!" call _puts lea rax, [rbp+var_100] mov rdi, rax mov eax, 0 call _gets nop leave retn vuln endp
I need to overwrite the return pointer of vuln function with the libc base address where I will write parameters for execve call.
The buffer is 264 bytes long. So with 272 'A' I get the following position:
0x55555555471d <vuln+45> ret <0x4141414141414141>
00:0000│ rsp 0x7fffffffe2c8 ◂— 'AAAAAAAA'
But when I try to overflow with the libc address(0x7ffff7a3a000) it is giving a SIGSEGV and it is behaving the following way:
0x55555555471d <vuln+45> ret <0x3061785c3030785c>
00:0000│ rsp r11-6 0x7fffffffe2c8 ◂— 0x3061785c3030785c ('\\x00\\xa0') 01:0008│ 0x7fffffffe2d0 ◂— 0xefbdbfef3361785c 02:0010│ 0x7fffffffe2d8 ◂— 0x3030785cbdbf
I dont know where am I going wrong!!!! I have put so many days in it but to no extent. I have done buffer overflow before but never encountered this problem.
Following is my python script that is generating the payload (this is only to overflow the return address):
#! /usr/bin/env python2 from pwn import * payload = 'A' * 264 payload += p64(0x7ffff7a3a000) print(payload)
\\x00\\xa0at stack top instead of the actual \x00 and \xa0 bytes. How are you providing input if i may ask?