[PWN] ropme rop chain problem

Hi guys,

I'm trying to solve the ropme challenge. I got it pretty much doing what I want. I can call arbitrary functions of glibc. Now I'm trying to spawn a shell using system. I pass the string via rdi, looks good to me when I bp system, but no shell is spawned. When I call puts with the same argument the string I'm trying to execute is printed.

Would really appreciate if somebody could give me a hint!

stack trace:

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── registers ────
$rax   : 0x0               
$rbx   : 0x0               
$rcx   : 0xf               
$rdx   : 0x00007f162f6fc8d0  →  0x0000000000000000
$rsp   : 0x00007ffcf6d450d0  →  0x00007f162f352120  →  <exit+0> lea rsi, [rip+0x3a85f1]        # 0x7f162f6fa718
$rbp   : 0x4141414141414141 ("AAAAAAAA"?)
$rsi   : 0x00007ffcf6d45070  →  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA[...]"
$rdi   : 0x00007f162f4c2e9a  →  0x0068732f6e69622f ("/bin/sh"?)
$rip   : 0x00007f162f35e440  →  <system+0> test rdi, rdi
$r8    : 0x00000000024576d9  →  0x0000000000000000
$r9    : 0x00007f162f6fc8d0  →  0x0000000000000000
$r10   : 0x00007f162f91c4c0  →  0x00007f162f91c4c0  →  [loop detected]
$r11   : 0x246             
$r12   : 0x0000000000400530  →  <_start+0> xor ebp, ebp
$r13   : 0x00007ffcf6d45170  →  0x0000000000000001
$r14   : 0x0               
$r15   : 0x0               
$eflags: [ZERO carry PARITY adjust sign trap INTERRUPT direction overflow resume virtualx86 identification]
$cs: 0x0033 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $fs: 0x0000 $gs: 0x0000 
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── stack ────
0x00007ffcf6d450d0│+0x0000: 0x00007f162f352120  →  <exit+0> lea rsi, [rip+0x3a85f1]        # 0x7f162f6fa718  ← $rsp
0x00007ffcf6d450d8│+0x0008: 0x00007ffcf6d4000a  →  0x0000000000000000
0x00007ffcf6d450e0│+0x0010: 0x0000000000000000
0x00007ffcf6d450e8│+0x0018: 0x0000000000000000
0x00007ffcf6d450f0│+0x0020: 0xf142e57213da8789
0x00007ffcf6d450f8│+0x0028: 0xf09756bca4048789
0x00007ffcf6d45100│+0x0030: 0x0000000000000000
0x00007ffcf6d45108│+0x0038: 0x0000000000000000
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── code:x86:64 ────
   0x7f162f35e435                  add    BYTE PTR [rax], 0x0
   0x7f162f35e438                  add    BYTE PTR [rbx-0x3d], bl
   0x7f162f35e43b                  nop    DWORD PTR [rax+rax*1+0x0]
 → 0x7f162f35e440 <system+0>       test   rdi, rdi
   0x7f162f35e443 <system+3>       je     0x7f162f35e450 <system+16>
   0x7f162f35e445 <system+5>       jmp    0x7f162f35deb0
   0x7f162f35e44a <system+10>      nop    WORD PTR [rax+rax*1+0x0]
   0x7f162f35e450 <system+16>      lea    rdi, [rip+0x164a4b]        # 0x7f162f4c2ea2
   0x7f162f35e457 <system+23>      sub    rsp, 0x8
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "ropme", stopped, reason: BREAKPOINT
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0x7f162f35e440 → system()
[#1] 0x7f162f352120 → lea rsi, [rip+0x3a85f1]        # 0x7f162f6fa718
[#2] 0x7ffcf6d4000a → add BYTE PTR [rax], al
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Breakpoint 1, 0x00007f162f35e440 in system () from /lib/x86_64-linux-gnu/libc.so.6
Tagged:
Sign In to comment.