[Pwnable] Gadget 구하기

ROPgadget (POP RET Gadget)

$ ROPgadget --binary [실행 파일] | grep "pop rdi"
0x0000000000000aa3 : pop rdi ; ret

 

objdump (.bss Section)

$ objdump -h [실행 파일] | grep .bss
 23 .bss          00000020  0000000000201010  0000000000201010  00001010  2**4
 
$ bss = 0x0000000000201010

 

One Gadget / Magic Gadget

$ one_gadget /lib/x86_64-linux-gnu/libc-2.31.so
0xe6c7e execve("/bin/sh", r15, r12)
constraints:
  [r15] == NULL || r15 == NULL
  [r12] == NULL || r12 == NULL

0xe6c81 execve("/bin/sh", r15, rdx)
constraints:
  [r15] == NULL || r15 == NULL
  [rdx] == NULL || rdx == NULL

0xe6c84 execve("/bin/sh", rsi, rdx)
constraints:
  [rsi] == NULL || rsi == NULL
  [rdx] == NULL || rdx == NULL

 

ReadELF (libc symbol)

$ readelf -s [라이브러리 주소] | grep "stdout"
   850: 00000000001ec6a0   224 OBJECT  GLOBAL DEFAULT   31 _IO_2_1_stdout_@@GLIBC_2.2.5
  1103: 00000000001ec788     8 OBJECT  GLOBAL DEFAULT   31 stdout@@GLIBC_2.2.5