(Hopefully) simple ROP chaining demonstration, created by Johnny Chen.
Make sure Docker is installed! Navigate to the directory for the challenge you want to complete. To set up the image run setup.sh. To compile, run build.sh, and use the output payload.bin as an output for ropvuln (For challenge 2, this will be ropvuln_suid).
Simple challenge to familiarize yourself with GDB. Can you return to win() even though it's not called anywhere in the code?
Intro to ROP GDB Docs (Useful commands: disassemble, breakpoint, x command)
Bank of America just pushed this C code to their server, and it seems like we can gain access to their admin login somehow... Can you exploit the vulnerable function to authenticate as an admin user?
Note: Access the binary for this challenge through ropvuln_suid, which will be created inside the docker image.
(ex. ropvuln_suid my_payload.bin)
This server seems to offer a function for users to open a shell and run commands; can you figure out how to exploit the vulnerable function to gain access to a root shell?
Note 2: This exploit probably will not work from within GDB, when testing make sure to use the raw binary!
(Hint: Look into the --multibr flag for ROPgadget!)
Enjoy! Please let me know if any issues arise.