From 11cbb37694aab501681435375679c49989cdfc91 Mon Sep 17 00:00:00 2001
From: Brett Weiland <techcrazybsw@gmail.com>
Date: Sat, 19 Dec 2020 23:19:58 -0600
Subject: 	modified:   x86_64/pivot/exploit.py 	new file:  
 x86_64/pivot/exploit2.py 	deleted:    x86_64/pivot/stest 	deleted:   
 x86_64/pivot/test 	new file:   x86_64/pivot/todo 	new file:  
 x86_64/ret2csu/exploit.py 	new file:   x86_64/ret2csu/gadgets

---
 x86_64/ret2csu/gadgets | 86 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 86 insertions(+)
 create mode 100644 x86_64/ret2csu/gadgets

(limited to 'x86_64/ret2csu/gadgets')

diff --git a/x86_64/ret2csu/gadgets b/x86_64/ret2csu/gadgets
new file mode 100644
index 0000000..87a3bb8
--- /dev/null
+++ b/x86_64/ret2csu/gadgets
@@ -0,0 +1,86 @@
+First three arguments: 
+rdi   0xdeadbeefdeadbeef
+rsi   0xcafebabecafebabe
+rdx   0xd00df00dd00df00d
+
+
+weird-ass instructions:
+0x0000000000000a08 : retf 0xbabe
+
+
+ret2win@plt: 0000000000400510
+
+0x00000000004006a3 : pop rdi ; ret 
+0x00000000004006a1 : pop rsi ; pop r15 ; ret 
+
+
+
+
+ret2csu:     file format elf64-x86-64
+
+
+Disassembly of section .init:
+
+Disassembly of section .plt:
+
+Disassembly of section .text:
+
+0000000000400640 <__libc_csu_init>:
+  400640: 41 57                 push   r15
+  400642: 41 56                 push   r14
+  400644: 49 89 d7              mov    r15,rdx
+  400647: 41 55                 push   r13
+  400649: 41 54                 push   r12
+  40064b: 4c 8d 25 9e 07 20 00  lea    r12,[rip+0x20079e]        # 600df0 <__frame_dummy_init_array_entry>
+  400652: 55                    push   rbp
+  400653: 48 8d 2d 9e 07 20 00  lea    rbp,[rip+0x20079e]        # 600df8 <__do_global_dtors_aux_fini_array_entry>
+  40065a: 53                    push   rbx
+  40065b: 41 89 fd              mov    r13d,edi
+  40065e: 49 89 f6              mov    r14,rsi
+  400661: 4c 29 e5              sub    rbp,r12
+  400664: 48 83 ec 08           sub    rsp,0x8
+  400668: 48 c1 fd 03           sar    rbp,0x3
+  40066c: e8 5f fe ff ff        call   4004d0 <_init>
+  400671: 48 85 ed              test   rbp,rbp
+  400674: 74 20                 je     400696 <__libc_csu_init+0x56>
+  400676: 31 db                 xor    ebx,ebx
+  400678: 0f 1f 84 00 00 00 00  nop    DWORD PTR [rax+rax*1+0x0]
+  40067f: 00 
+ _______this shit is importaint!!!!!!
+\/
+  400680: 4c 89 fa              mov    rdx,r15
+  400683: 4c 89 f6              mov    rsi,r14
+  400686: 44 89 ef              mov    edi,r13d
+  400689: 41 ff 14 dc           call   QWORD PTR [r12+rbx*8]
+_________________________
+  40068d: 48 83 c3 01           add    rbx,0x1
+  400691: 48 39 dd              cmp    rbp,rbx
+  400694: 75 ea                 jne    400680 <__libc_csu_init+0x40> 
+  400696: 48 83 c4 08           add    rsp,0x8                       
+_________________________
+  40069a: 5b                    pop    rbx
+  40069b: 5d                    pop    rbp
+  40069c: 41 5c                 pop    r12
+  40069e: 41 5d                 pop    r13
+  4006a0: 41 5e                 pop    r14
+  4006a2: 41 5f                 pop    r15
+  4006a4: c3                    ret    
+
+Disassembly of section .fini:
+
+calling x86: 
+
+controlling rdx: 
+1: 0x00000000004006a3
+  rdi : 0xdeadbeefdeadbeef 
+
+2: 0x40069a
+  rbx: 0                          <--
+  rbp: whatever
+  r12: 0x601020                   <-- next location. lets try to make it ret2win
+  r13: 0xdeadbeef                 <-- would be nice if we could use a 64 bit value
+  r14: 0xcafebabecafebabe                 
+  r15: 0xd00df00dd00df00d         <--
+
+
+3: 0x0000000000400510 (ret2win) 
-- 
cgit v1.2.3