Differences
This shows you the differences between two versions of the page.
|
cns:labs:lab-04 [2020/11/09 14:10] razvan.deaconescu [Phase 6: Diverting control flow] |
cns:labs:lab-04 [2022/10/31 17:22] (current) mihai.dumitru2201 [Tasks] |
||
|---|---|---|---|
| Line 369: | Line 369: | ||
| <code asm> | <code asm> | ||
| + | BITS 64 | ||
| + | |||
| jmp string | jmp string | ||
| start: | start: | ||
| - | pop rcx ; pop address of `hello` variable in rcx | + | pop rsi ; pop address of `hello` variable in rsi (the 2nd syscall argument on 64 bits) |
| [...] | [...] | ||
| + | syscall ; do syscall on 64 bits | ||
| string: | string: | ||
| call start ; jump/trampoline back to start while storing the address of `hello` on the stack | call start ; jump/trampoline back to start while storing the address of `hello` on the stack | ||
| Line 378: | Line 381: | ||
| </code> | </code> | ||
| - | The call instruction will push the address of the next "instruction" (in this case, our string), onto the stack. | + | The ''call'' instruction will push the address of the next "instruction" (in this case, our string), onto the stack. |
| </note> | </note> | ||
| Line 386: | Line 389: | ||
| <code C> | <code C> | ||
| - | execve('/bin/sh', ['/bin/sh'], 0); | + | execve("/bin/sh", ["/bin/sh", NULL], NULL); |
| </code> | </code> | ||
| - | Where //['/bin/sh']// denotes the **address** of the string '/bin/sh'. | + | Where ''["/bin/sh", NULL]'' denotes the **address** of the array of two strings address: the address of the ''"/bin/sh"'' string and the ''NULL'' address. |
| <note tip> | <note tip> | ||
| - | You need to get the string '/bin/sh' on the stack. You can do this using the hack from the write challenge. | + | You need to get the address of the string ''"/bin/sh"'' on the stack. |
| + | You can do this using the hack from the write challenge. | ||
| </note> | </note> | ||
| <note tip> | <note tip> | ||
| - | You can browse around shellstorm for examples; however, keep in mind that they may not work due to some registers not being set properly. | + | You can browse around shellstorm for examples; |
| + | however, keep in mind that they may not work due to some registers not being set properly. | ||
| </note> | </note> | ||
| ==== 3. execve with no zeros ==== | ==== 3. execve with no zeros ==== | ||
