ELF32 ROP


x86 Exploitation.

You have hopefully already ROPed on ELF64 binaries (https://pwn.college/program-security/return-oriented-programming/), but can you ROP on ELF32? This module serves as an introduction to the exploitation of 32 bit ELF binaries.



Challenges

Overflow a 32-bit binary and redirect execution into the win function.

Overflow a 32-bit binary and redirect execution into the win function with the correct arguments. Remember, arguments are typically passed differently on x86...

Overflow a 32-bit binary and redirect execution into system. Setuid has already been called for you!

Overflow a 32-bit binary and redirect execution into 2 functions.

Overflow a 32-bit binary and redirect execution into 2 functions with the correct arguments. Remember, arguments have to be manually cleaned up on x86!

Overflow a 32-bit binary to call setuid and system to obtain a shell.

Overflow a 32-bit binary to call setuid and system to obtain a shell. Use the PLT to bypass ASLR.

Overflow a 32-bit PIE binary to call setuid and system to obtain a shell. A PIE leak is provided, but no libc leak is given.

Hint: A saved register value on the stack is corrupted when a buffer overflow takes place. This value must be restored correctly when calling the PLT when PIE is enabled. Research System V i386 ABI standard conventions.


30-Day Scoreboard:

This scoreboard reflects solves for challenges in this module after the module launched in this dojo.

7-Day | 30-Day | All-Time

Hackers Crews
Rank Hacker Badges Score