Spoiler-Free Guide to ROP Emporium :: Challenges 0 - 4

Introduction

This is part one of the two-part walkthrough series we’re writing for the wonderful challenges on ROP Emporium. As always, we’re offering spoiler-free hints and tips for those of you who just want some help without the entire challenge being spoiled!

There are eight challenges in total. This part covers the first four.

General advice

• If you’re just starting out, I recommend you read the Beginner’s Guide at least twice before proceeding to the challenges.
• Fully read each challenge’s page first. It’s full of essential and helpful tips (I needed to hear this too).
• If you need a good workflow to enumerate the binaries, I recommend the following:

# this extracts strings cleaner than `strings` does
# comes with radare2
rabin2 -z <challenge> 

# in gdb
checksec # to see what protections it has
info function # to see what functions we can use to our advantage

ret2win

This challenge covers the most basic form of ROP. Return to ret2win to win. If you’re feeling lost, I recommend reviewing the calling conventions on all the platforms that you’re doing the challenge on.

Remember that a basic ROP is just an overflow in which we gain control of the EIP and we simulate the stack frame for functions that we want to call.

x86

x64

split

This challenge covers calling a function with one argument!

So the author tells us that system and /bin/cat flag.txt are already present in the binary. All we need to do is to find them and stitch them together.

x86

x64

callme

x86

The challenge in this one is to chain function calls. In a single chain we’d do

"A" * 44  + first_function_address + second_function_address + func_1_arguments

But if we want to chain two functions, after the first one executes and returns, the stack will look like this

second_return_address + func_1_arguments

Ok, the program pops second_return_address and executes it, now the stack is

func_1_arguments

Which obviously will stop the chain because it’s not a valid function.

So the solution is to use pop gadgets to clean up the stack frame. For example, take a look at this two-function chain.

# pop_2 can point to a gadget like pop ecx ; pop edx ; ret
"A" * 40 + first_function + pop_2 + first_func_arg_1 + first_func_arg_2 
+ second_function + junk_return_address + second_func_arg

After first_function executes, the stack becomes

pop_2 + first_func_arg_1 + first_func_arg_2 
+ second_function + junk_return_address + second_func_arg

The pop_2 pops the next two arguments which have already been used by first_function. Now the stack is

second_function + pop_1 + second_func_arg

Which executes second_function just fine! And with this technique, we can construct a ROP chain however long we’d like (as long as there is enough space on the stack for it).

x64

The solution for x64 is surprisingly easier than the x86 one, because on x64 we don’t pass arguments on the stack, we do it via the registers. This means we don’t actually have to clean anything up and we can just chain on forever!

write4

In the previous challenges, the arguments (“flag.txt”, etc.) have always been conveniently in the executable, ready for us to reuse to our benefit. This time, it’s different. This challenge covers manually writing arbitrary data to memory.

How might we execute this arbitrary write? Say we’d like to write the string “bird” to the start of the data segment. One of the simplest chains could be:

pop eax ; "bird"
pop ebx ; address of the start of the data segment
mov [ebx], eax ; move "bird" into the address

x86

<offset> <arbitrary write for "flag"> <arbitrary write for ".txt"> 
<address of print_file> <junk return address> <address of "flag.txt" that you wrote>

x64

Tip: you can write an 8-byte string in one go because we’re on x64.