14 lines
358 B
Markdown
14 lines
358 B
Markdown
Plan:
|
|
|
|
1. Manipulate stack position to store libc address
|
|
2. Transform address to point to one-gadget
|
|
3. possibly zero rcx
|
|
4. overwrite saved rip with one-gadget
|
|
|
|
one-gadget for libc version at offset:
|
|
0x4f29e execve("/bin/sh", rsp+0x40, environ)
|
|
constraints:
|
|
address rsp+0x50 is writable
|
|
rsp & 0xf == 0
|
|
rcx == NULL || {rcx, "-c", r12, NULL} is a valid argv
|