From a6439b8ec3713c3ed3bd4027dc0d11369deddf03 Mon Sep 17 00:00:00 2001
From: Brett Weiland <techcrazybsw@gmail.com>
Date: Fri, 18 Dec 2020 19:06:39 -0600
Subject: 	new file:   x86_64/pivot/exploit.py 	new file:  
 x86_64/pivot/gadgets

---
 x86_64/pivot/gadgets | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 x86_64/pivot/gadgets

(limited to 'x86_64/pivot/gadgets')

diff --git a/x86_64/pivot/gadgets b/x86_64/pivot/gadgets
new file mode 100644
index 0000000..7e442a8
--- /dev/null
+++ b/x86_64/pivot/gadgets
@@ -0,0 +1,44 @@
+Goal is to call ret2win from libpivot
+we don't know where ret2win is, but we do know where foothold_function is
+
+pivot is at 0x7f2041e78f10
+0x0000000000400720 : foothold_function@plt
+0x000000000000096a : foothold_function
+
+resolve ret2win:
+1:  resolve foothold_function
+    resolved foothold: [0x400720 + 0x20091a]
+    offset of foothold vs 
+
+2: ret2win = [0x400720 + 0x20091a] + 279 
+
+64 rop chains possible at 0x7eff3d368f10
+6 rop chains possible at buffer overflow
+
+0x00000000004007c8 : pop rbp ; ret
+0x00000000004007c1 : jmp rax
+
+00000000004009bb <usefulGadgets>:
+  4009bb:	58                   	pop    rax
+  4009bc:	c3                   	ret    
+
+  4009bd:	48 94                	xchg   rsp,rax
+  4009bf:	c3                   	ret    
+
+  4009c0:	48 8b 00             	mov    rax,QWORD PTR [rax]
+  4009c3:	c3                   	ret    
+
+  4009c4:	48 01 e8             	add    rax,rbp
+  4009c7:	c3                   	ret    
+
+1: resolve foothold (2)
+4: pop rax (rax is 0x400720 + 0x20091a)
+5: pop rbp (rpb is 279)
+6: add rax, rbp
+7: mov rax, [rax]
+8: jmp rax
+
+
+2: pop rax          (4)
+3: xchg rsp,rax     (5)
+ 
-- 
cgit v1.2.3