Skip to content

Instantly share code, notes, and snippets.

@cyberheartmi9

cyberheartmi9/Ret2libc bypass setuid

Last active April 4, 2018 00:47
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save cyberheartmi9/d7bb73f40df0f5afe225a0cbacb35b72 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save cyberheartmi9/d7bb73f40df0f5afe225a0cbacb35b72 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Ret2libc bypass setuid
|printf|pop-ret|%5$n|execl|exit|/bin/sh/|/bin/sh|execl-last-arg|
---------------------- | stack grow
|execl-last-arg | |
|--------------------- |
|/bin/sh | |
|--------------------- |
|/bin/sh | |
|--------------------- |
|exit | |
|--------------------- |
|execl | v
|---------------------
|%5$n |
|---------------------
|pop ret |
|---------------------
|printf |
|---------------------
|printf|pop-ret|%6$n|printf|ppr|%8$n|setuid|pop-ret|setuid-arg|execl|exit|/bin/sh|/bin/sh|execl-last-arg|
-------------------------- | stack grow
| execl-last-arg(null) | |
|------------------------- |
|/bin/sh | |
|------------------------- |
|/bin/sh | |
|------------------------- |
|exit | |
|------------------------- |
|setuid-arg | |
|------------------------- v
|pop ret |
|-------------------------
|setuid |
|-------------------------
| %8$n |
|-------------------------
|pop ret |
|-------------------------
|printf |
|-------------------------
|%6$n |
|-------------------------
|pop ret |
|-------------------------
|printf |
|-------------------------
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment