Hot answers tagged

3

ropper bases the binary at address 0. This can be changed using the -I flag. This value of the base can be picked up from Ghidra to reflect in ropper's output In Ghidra go to Window > Memory Map. In this case libc is loaded at base address 0x100000. From ropper $ ropper -I 0x100000 --nocolor --file ./libc.so.6 Now the output can be directly used with G ...


2

If you change your process startup to p = process(["strace", "-o", "strace.out", "./bof"]) and check the resulting strace.out file, you will see: close(0) = 0 open("/dev/tty", O_RDWR|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC) = 0 execve("/bin/sh", NULL, NULL) = 0 ... ...


1

I think you might have an alignment problem. Find the address of a ret-only gadget and try putting it in your second payload as follows: ret = p64(0x?????) payload = junk + ret + pop_rdi + sh_addr + system_addr References: https://research.csiro.au/tsblog/debugging-stories-stack-alignment-matters/ https://stackoverflow.com/questions/54393105/libcs-system-...


Only top voted, non community-wiki answers of a minimum length are eligible