Partial Overwrite
Overwriting the LSB of a address or register (E.g RIP)
We have a binary with PIE & NX enabled.
Looking at the source code, we can determine that we have a win_ptr and a obvious buffer_overflow with leak to buffer.
void challenge(void)
{
int win;
void *win_ptr;
ssize_t input;
undefined8 input_buffer;
undefined8 local_28;
undefined8 local_20;
undefined8 local_18;
undefined4 local_c;
input_buffer = 0;
local_28 = 0;
local_20 = 0;
local_18 = 0;
printf("[LEAK] Your input buffer is located at: %p.\n\n ",&input_buffer);
win_ptr = mmap((void *)0x0,312,3,34,0,0);
memcpy(win_ptr,&DAT_00103038,312);
result= mprotect(win_ptr,312,5);
if (result != 0) {
__assert_fail("mprotect(data.win_addr, 0x138, PROT _READ|PROT_EXEC) == 0","<stdin>",42,
"challenge");
}
input = read(0,&input_buffer,4096);
local_c = (undefined4)input;
puts("Leaving!");
return;
}
Since we have a buffer overflow, we can attempt to control RIP to try to stack pivot to our controlled buffer (input_buffer) where we can potentially place our ROP chain. Let's first look for a stack pivoting gadget by filtering for anything that deals with rsp.
We can use the leave; ret gadget since we control RBP and RIP.
We can also determine what is the offset from our leak the win pointer is by using a debugger like pwndbg
Knowing that we can simply "pivot" to the win pointer, we can come up with the following exploit chain.
Exploit Flow
Partial Overwrite last byte to go to our leave; ret gadget
Set RBP to an offset of leak-0x10 to account for POP RBP in leave; ret of the challenge function prologue
Execute leave; ret again via gadget so that we pivot to our win pointer and win
What I learned
RSP is adjusted each time a pop/push instruction is executed
for pop gadgets, the values don't have to be user-controlled/valid, stack always have garbage values - as long the pop gadgets are not used for a syscall etc
Think about what registers i have control of and how do i manipulate it to point to where i want (rsp -/+ offset so that i can align my pop gadgets properly and retn to the right ptr?)
Dont be fixed in terms of looking for certain gadgets (e.g lea rsp, [rbp - 0x18]; pop rbx; pop r12; pop r13; pop rbp; ret; - can be used for pivoting too)
Last updated