Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

(still) Missing call/jmp gadgets in msvcrt71.dll #45

Closed
dobin opened this issue Aug 2, 2016 · 1 comment
Closed

(still) Missing call/jmp gadgets in msvcrt71.dll #45

dobin opened this issue Aug 2, 2016 · 1 comment

Comments

@dobin
Copy link

dobin commented Aug 2, 2016

For the exploitlab we need to find a "call" gadgets in msvcrt71.dll. But even with the newest ropper, it does neither find "call" or "jmp" gadgets:

krafty@kraftyness:/opt/bins/java_6u20$ sudo pip install ropper --upgrade
Requirement already up-to-date: ropper in /usr/local/lib/python2.7/site-packages
Requirement already up-to-date: filebytes>=0.9.12 in /usr/local/lib/python2.7/site-packages (from ropper)
You are using pip version 8.1.0, however version 8.1.2 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
krafty@kraftyness:/opt/bins/java_6u20$ ropper
(ropper)> type rop
(ropper)> file msvcr71.dll
[INFO] Load gadgets from cache
[LOAD] loading... 100%
[LOAD] removing double gadgets... 100%
[INFO] File loaded.
(msvcr71.dll/PE/x86)> search call
[INFO] Searching for gadgets: call

(msvcr71.dll/PE/x86)> search jmp
[INFO] Searching for gadgets: jmp

(msvcr71.dll/PE/x86)> 
@dobin
Copy link
Author

dobin commented Aug 2, 2016

Nevermind, it works, freshly installed on an ubuntu 16.04:

(msvcr71.dll/PE/x86)> search call eax
[INFO] Searching for gadgets: call eax

[INFO] File: msvcr71.dll
0x7c359aa8: call eax; jmp 0x19ab3; xor eax, eax; inc eax; ret; 
0x7c341cd4: call eax; jmp 0x1cc5; pop esi; ret; 
0x7c348455: call eax; jmp 0x8460; xor eax, eax; inc eax; ret; 
0x7c3418d9: call eax; mov dword ptr [ebp - 0x20], eax; or dword ptr [ebp - 4], 0xffffffff; call 0x2346; ret; 
0x7c365beb: call eax; push 0x19; call 0x8f8e; pop ecx; ret; 
0x7c348ee0: call eax; push 0xff; call 0x8d3e; pop ecx; ret; 
0x7c341fe4: call eax; ret; 

@dobin dobin closed this as completed Aug 2, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant