Showing posts with label ROP. Show all posts
Showing posts with label ROP. Show all posts

Sunday, January 30, 2011

ROP retn+offset and impact on stack setup.

Ok so in short, I was playing with ROP chained exploits, in particular I was making an exploit for WM Downloader.

I finally finished it and then asked corelanc0d3r from the Corelan team to test it. The exploits was good, but there were some ROP gadgets that differed so we tried to replace them and this came up: http://www.exploit-db.com/exploits/16072/

Everything seems ok ... but something was weird, as you can see we have a ROP gadget containing:
# INC ESI # PUSH EAX # POP ESI # POP EBP # RETN 4

I had some issues with padding RETN 4, so I asked corelanc0d3r for a general padding rule, and then we realized that no one actually has one. ( Or not one that we know about. ) So we started documenting it and finally this came up: Corelan Site