2

I'm practicing exploit development and one of the scenario I am haing most difficulties with is stack pivoting besides the "ADD ESP, XXX" or something like that.

The question is, during the writing of a ROP chain, when you don't have any usable gadget that mess with ESP register (like ADD, MOV something in it) what can i try to move ESP back to my buffer and so start the ROP chain?

Im on a Intel IA-32 in a Windows environment (7+ with DEP enabled).

Anders
  • 64,406
  • 24
  • 178
  • 215
Kartone
  • 171
  • 8
  • This kind of question needs to at least specify the platform. I'm *guessing* you are on contemporary Intel CPUs and compatibles, but it would be far better if you just spelled it out. – user Sep 22 '17 at 09:10
  • Yeah, i'm sorry. You're right: Intel IA-32 in Windows environment (7+ with DEP enabled). – Kartone Sep 22 '17 at 09:16
  • If you happen to use Immunity, have you tried mona.py? I think I remember it having a feature of searching for stack pivots I found useful. Otherwise, maybe you can find some unintended instructions, or something like pop esp, or xchg esp, e*x ? – dreamist Sep 29 '17 at 04:35
  • @dreamist yeah, i’m using mona.py and yes, i tried to find that kind of gadget. :-/ – Kartone Sep 29 '17 at 05:42

1 Answers1

2

Assuming you're building a ROP chain that needs to manipulate the stack, you can always go for semantically equivalent gadgets, e.g. PUSH/POP, MOV ESP XXX, (SUB,ADD) ESP instructions to build the stack: https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/#chainingbasics http://neilscomputerblog.blogspot.com/2012/06/stack-pivoting.html

Also, for XXX/actual constants (immediates) for SUB/ADD ESP XXX, you can always LEA a register then even MOV ESP, XXX/REG:

https://web.archive.org/web/20171107030509/http://x86.renejeschke.de/html/file_module_x86_id_176.html

Last, depending on the DLL/EXE you're searching for gadgets in, if you can't easily ADD/SUB ESP you could do a slew of things (using volatile registers):

;ADD/INC ESP SEMANTICS EQUIVALENT 
POP EBX      ;semantically same as MOV EBX, ESP; ADD ESP 0x4
XOR EBX, EBX ;zeroes EBX if you wanna reuse the register

;SUB/DEC ESP SEMANTICS EQUIVALENT
PUSH EBX     ;semantically same as MOV ESP, EBX; SUB ESP 0x4

You can even get fancy and mov values into a volatile register, SHL/SHR/ROL/ROR it and then use LEA/PUSH. It's all up to you to be creative!

grepNstepN
  • 610
  • 4
  • 15