I'm trying to complete the picoCTF 2019 "leap-frog" challenge:

Binary: https://2019shell1.picoctf.com/static/ff335b3bb19a0112bdd86ca8b4f0b473/rop

Source: https://2019shell1.picoctf.com/static/ff335b3bb19a0112bdd86ca8b4f0b473/rop.c

I watched a video on how to solve it using gets but I want to learn how to do it using ROP chains- probably the "intended method".

I managed to build an exploit that was really complicated for me. It worked in gdb but not the actual binary. What's gdb doing and can I bypass this so that I can accurately develop an exploit without getting false positives from gdb?

Here's an example of what I'm running:


Also, 0x08048ac0 is the segfaulted address but it's supposed to be a valid ROP gadget. Not sure why the binary thinks it's not executable? It's part of the .text region, I think.

  • by default gdb disable randomization. Check the status of disable-randomization variable and turn if off to have the same behavior. – Paweł Łukasik Sep 1 '20 at 11:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.