0

in oder to solve a CTF-Challenge I have to construct a small ROP-chain. The scope of the ROP chain is to print the content of the `flag` file. I already constructed the ROP-chain, but it seems that when I call the system function with the parameter `cat flag`, the result isn't printed to the console.

My ROP-chain: payload = b'A'*80 + pop_rdi + addr_cat_flag + systemPlt

As far as I know it should work this way, since it is a 64-Bit machine. But the strangest thing is that when insted of calling system I call for example puts then the content at address addr_cat_flag, which in this case is cat flag, is printed to the console. This means that the parameter is hand over corectly.
The address of systemPlt should also be correct.

Does anybody know were the problem could be?

1 Answer 1

0

It turned out, that in order to call system the stack has to be 16-byte aligned.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.