45 lines
1.1 KiB
Plaintext
45 lines
1.1 KiB
Plaintext
Goal is to call ret2win from libpivot
|
|
we don't know where ret2win is, but we do know where foothold_function is
|
|
|
|
pivot is at 0x7f2041e78f10
|
|
0x0000000000400720 : foothold_function@plt
|
|
0x000000000000096a : foothold_function
|
|
|
|
resolve ret2win:
|
|
1: resolve foothold_function
|
|
resolved foothold: [0x400720 + 0x20091a]
|
|
offset of foothold vs
|
|
|
|
2: ret2win = [0x400720 + 0x20091a] + 279
|
|
|
|
64 rop chains possible at 0x7eff3d368f10
|
|
6 rop chains possible at buffer overflow
|
|
|
|
0x00000000004007c8 : pop rbp ; ret
|
|
0x00000000004007c1 : jmp rax
|
|
|
|
00000000004009bb <usefulGadgets>:
|
|
4009bb: 58 pop rax
|
|
4009bc: c3 ret
|
|
|
|
4009bd: 48 94 xchg rsp,rax
|
|
4009bf: c3 ret
|
|
|
|
4009c0: 48 8b 00 mov rax,QWORD PTR [rax]
|
|
4009c3: c3 ret
|
|
|
|
4009c4: 48 01 e8 add rax,rbp
|
|
4009c7: c3 ret
|
|
|
|
1: resolve foothold (2)
|
|
4: pop rax (rax is 0x400720 + 0x20091a)
|
|
5: pop rbp (rpb is 279)
|
|
6: add rax, rbp
|
|
7: mov rax, [rax]
|
|
8: jmp rax
|
|
|
|
|
|
2: pop rax (4)
|
|
3: xchg rsp,rax (5)
|
|
|