Court of Analysis and Testing

When I was scrolling through my twitter feed 2 weeks ago I noticed that azeria just release new material on her website and it's about ROP in ARM. As you know we talk a lot about ROP in several posts on ARM buffer overflow thus I think this could be a good opportunity for me to learn the basic again about ROP again and without a second thought, I took my favorite notebook, click the link and start learning(check it out in link ). The author also put some challenges about how to construct ROP exploitation in an ARM architecture to test our skills and in this post, I will show you how I approach these challenges. When you boot up the qemu emulator you can find the two binary in the challenges directory Note: Before you continue this post make sure you turn off ASLR mode in the QEMU emulator Challenge1: 1st approach(Without ROP)    At the first challenge, we got 32 bit ARM binary, not stripped and the PIE protection is on. Basically, PIE enables the program ...

This is the third part of smash the tux series, in this post lets continue our work and try to finish 0x03 - 0x06 challenge Challenge 0x03: from this source code, we can see that there is a limit of input length in the program. If we try to input with a length that exceeds 512 bytes, the program will terminate itself. We can safely assume that 512 is the length that we need to overwrite the EIP register let's try to test the program by inputting just 512 bytes and see what happen to it. so what happens in here? this vulnerability is called "off by one byte" if the programmer knows that it takes 512 bytes and above to overwrite the EIP, they should not put a check like this (strlen(text) > 512) that means we can still input with length 512, to do the correct checking it supposed to be like this (strlen(text) >= 512) this will make sure that input with length 512 and above is properly sanitized Let's try to determine how much length we a...