Return Oriented Programming (PicoCTF 2022 #48 'ropfu')

[@chriskaprys]

12:07 For those starting out in gdb, as I am: I believe what he was looking for there was x/500b (or x/500xb). It was already printing in xw (hex, word) mode, so x/500 (i.e. x/500xw) gave the *hex* of the 500 *words* at that address. b = byte h = half-byte (2 bytes) w = word (4 bytes) g = giant word (8 bytes) 👍 13:18 or, as Scooby would say, the "ROPportunities" 😜

[@aminel2a]

28:25 I'm just like* why not sh(), but I was too hasty, great work john💖

[@FurikuriYugi]

Awesome as always my friend.

[@moosematrix]

Currently on my binary exploitation journey and this was engaging!! Thank you John

[@sikkavilla3996]

hey john, have you tried using the command cyclic to find the padding size for your buffer? I would recommend that if you need to find the length quicker for easier calculations. Overall a great video, and keep up the good work!

[@AlmostEpic89]

In early today, was awesome seeing you at the Ninja one summit!

[@davidyoder5890]

Ninja does summits now?!

[@themightiestofbooshes9443]

There he is!

[@timothysnyders1426]

JOHN!!!!!! I don't really understand what you did.. but you talking us through this challenge is inspiring.. This must be what my employers think when I'm explaining things to them haha.. Love you man!! Keep doing this because I'm going to be here to watch and listen... Maybe stay away from binary bruv :)

[@KFLawless1412]

Thank you for the awesome and educational video, John. I have a question that you or maybe someone else could answer (and I'll post it elsewhere too) Considering the stack was exectuable, could you not have done the following instead of using ROP? 1. Load the shellcode for "cat flag.txt" in your initial input instead of the 500 'C' bytes 2. For your injected return address after the buffer of 'A' bytes, simply put the address (in the stack) of the shellcode you just injected Maybe I'm missing something, but assuming that ASLR isn't enabled since you were able to discern the address of the jump instruction, you could know the address in memory of the stack location you pushed your initial input to in the first place. Maybe I'm not making any sense, but thank you again.

[@getellied]

Okay, this one was really freaking cool

[@secinject814]

Hey Hey My. Hammond! Excuse any typos as I am barely awake right now. But I just wanted to ask if you knew any good reverse engineering/binary exploitation books/e-books out there. Or the best youtubers that showcase, explain, and demonstrate how binary exploit/reverse exploit works. As I have focused far more on web exploit like XSS, SSRF, LFI etc... Thanks again as always for all the educational content and hope you continue being an inspiration!! Thanks!!

[@fhajji]

This was really interesting!

[@j3r3miasmg]

I don't get it why the stack canary is not accusing *** stack smashing detected *** when you overflow the buffer, canary and the return address. Did I miss something?

[@sepp104]

The stack canary is not present in the vuln-function. it is only present in some library-functions.

[@j3r3miasmg]

@@sepp104 I only know it's not present because his exploit worked (I didn't looked into the binary). But if you look at 02:20, it clearly says "Canary found". Something is misleading me.

[@christiansanchez4883]

@@j3r3miasmg yeah there are specific things that 'checksec' looks for when it's looking for a canary, and it found a canary "somewhere" in the file, but luckily for us, not in the vuln() function. Or for any function that would naturally be called for that matter. So there essentially is no Canary. Try using ghidra to disassemble and you'll see what i mean

[@j3r3miasmg]

@@christiansanchez4883 Thanks for your answer. A little bit misleading this if there is no canary in the function, but checksec did his best for us... ^^

[@v01d_r34l1ty]

NICE!~ANOTHER VIDEO LETS GO JOHN!

[@hugos6717]

omg this is fuckin cool, i love it

[@PaulBeesley-x2w]

Are you simple?

[@lethanhat361]

What is 16 bytes of nop for ? At first, I didn't use any nop instructions before the shell code and it failed. After that i tried adding 2 bytes of nop and it worked miraculously. Does it have anything to do with stack alignment ?

[@weirdstuffsforyou]

That depends. processor can jump to any point. Just for safer side we can use long NOPs so that our shell code will not get effected by it.

[@zer001]

Cool, now i know that there is a Bird in my (HayStack). Nice. :)

[@坂井正樹-g1y]

This video is just great ! How do you write a python script to solve this challenge ?

[@learn-with-noob-007]

Sir i am getting problems in Forensics last one left in 300 pts and one 400 pts

[@sireynolds7334]

Your Rop-Fu is strong.

[@SESUAV]

Pardon my noob question but I would like to know if this exploit will work if we replace the "A" with a NOP sled.. It would automatically enter the buffer then. Would it not? We wouldn't need the short jump then

[@ani-zxk]

how did you automatically know to jmp 10 bytes forward?

[@BryanChance]

Hmmmmm..i have no idea what's going on but it looks very interesting! And who are you talking to? LOL

[@franciscolucarini8761]

When the Solfire challenge?

[@vanievors2476]

How did you overwrite the EIP pointer if the executable is Canary-Protected??

[@christiansanchez4883]

The function we are using "vuln()" is not canary protected. A different function in the file is.

[@Dr.DomAPI]

Make video on cryptography 😍

[@jaroslavhromatka3257]

Hi, I enjoy your content but lately you've been having issues with audio. Please, can you normalize audio before you upload the video? For example, this video sound levels are so low that in order to listen to it I had to put volume to 100% and put even +12dB gain on my external mixer... when youtube played an ad in the middle of the video, it almost made me deaf... :-( just FYI: for example I listen to movies on Netflix or videos on other KZbin channels on 25-40% volume (usually no more than 50%)...

[@aminel2a]

best comment 👌

[@davidyoder5890]

💯

[@davidbellecy1709]

I have to connect my phone to a USB speaker and put both at 100%.

[@Joel-gf4zl]

I'm on my phone and hear it fine at 45% volume while in the same room as a loud TV. It is a little lower, but not that low. For me anyway.

[@fjr2go]

interesting!

[@guilherme5094]

👍

[@bhagyalakshmi1053]

Wos1,2,3?

[@Johnstuart2023]

hey, can you tell me what does the short jump do and why do we need it in this case ?

[@weirdstuffsforyou]

It's used for jumping from new_eip to NOPs as payload will get back to eax from short_jump so that we can add return address to stack for execution

[@Dr.DomAPI]

Hi

[@bhagyalakshmi1053]

Ret vlu Designer explain powerful

[@bhagyalakshmi1053]

Binck mins root madal Bank "credit card"filles ?

[@bhagyalakshmi1053]

Atti. Time files?

[@bhagyalakshmi1053]

John lon please

[@ani-zxk]

i dont understand, why do the most interesting videos you post have get the least amount of views!

[@bhagyalakshmi1053]

Please assembly code file's

[@bhagyalakshmi1053]

Str

[@rsvv6828]

Why he took \xeb\x08

[@weirdstuffsforyou]

It's for a short jump. Short jump can be used like EB 0 to EB 7F. He used eb 08 which jumped to the next address as mentioned and written as \xeb\x08.

[@rsvv6828]

@@weirdstuffsforyou Thanks for your answer

[@bhagyalakshmi1053]

Dword ptr this fu ?

[@bhagyalakshmi1053]

Emi lon please request 🎄🎁 give me lon please request

[@SplitUnknown]

Ohh my god how do you do that @john 🫣 To hard for me to understand 😅🤣

[@vanievors2476]

How did you overwrite the EIP pointer if the executable is Canary-Protected??

[@christiansanchez4883]

If you disassemble the source code in ghidra, you'll see that there is no canary in the vuln() function