Differences

This shows you the differences between two versions of the page.

--- session:solution:10 [2015/07/07 20:00]
Razvan Deaconescu
+++ session:solution:10 [2020/07/19 12:49] (current)
@@ Line 1: / Line 1: @@
 ====== Session 10 Solutions ======
-===== ret-to-libc =====
+===== ret-to-plt =====
-TODO
+Idea: The stack would need to look like:
+  * address of puts (in place of the return address)
+  * address of exit
+  * argument to puts call (address of string)
-===== ret-to-plt =====
+===== ret-to-libc =====
+Idea: The stack would need to look like:
+  * address of system (in place of the return address)
+  * address of exit
+  * argument to system call (address of string)
-TODO
+To find the ''%%"/bin/sh"%%'' string use the ''searchmem'' command in GDB PEDA.
 ===== Brute Force =====
-TODO
+Idea: Used fixed addresses for ''system()'' and ''%%"/bin/sh"%%'' and run the exploit test command until the addresses match.
 ===== mprotect =====
-TODO
+Idea: The stack would need to look like:
+  * address of ''mprotect()''
+  * address of buffer start (where the shellcode is located)
+  * first argument of ''mprotect()''
+  * 2nd argument of ''mprotect()''
+...

Security Summer School