🏳️
The CTF Recipes
  • Introduction
  • Cryptography
    • Introduction
    • General knowledge
      • Encoding
        • Character encoding
          • ASCII
          • Unicode
          • UTF-8
        • Data encoding
          • Base16
          • Base32
          • Base64
      • Maths
        • Modular arithmetic
          • Greatest Common Divisor
          • Fermat's little theorem
          • Quadratic residues
          • Tonelli-Shanks
          • Chinese Remainder Theorem
          • Modular binomial
      • Padding
        • PKCS#7
    • Misc
      • XOR
    • Mono-alphabetic substitution
      • Index of coincidence
      • frequency analysis
      • Well known algorithms
        • 🔴Scytale
        • 🔴ROT
        • 🔴Polybe
        • 🔴Vigenere
        • 🔴Pigpen cipher
        • 🔴Affine cipher
    • Symmetric Cryptography
      • AES
        • Block Encryption procedure
          • Byte Substitution
          • Shift Row
          • Mix Column
          • Add Key
          • Key Expansion / Key Schedule
        • Mode of Operation
          • ECB
            • Block shuffling
              • Challenge example
            • ECB Oracle
              • Challenge example
          • CBC
            • Bit flipping
              • Challenge example
            • Padding oracle
              • Challenge example
          • OFB
            • Key stream reconstruction
            • Encrypt to Uncrypt
  • 🛠️Pwn
    • General knowledge
      • STACK
        • Variables storage
        • Stack frame
      • PLT and GOT
      • HEAP
        • HEAP operations
        • Chunk
        • Bins
        • Chunk allocation and reallocation
      • Syscall
    • Architectures
      • aarch32
        • Registers
        • Instruction set
        • Calling convention
      • aarch64
        • Registers
        • Instruction set
        • Calling convention
      • mips32
        • Registers
        • Instruction set
        • Calling convention
      • mips64
        • Registers
        • Instruction set
        • Calling convention
      • x86 / x64
        • Registers
        • Instruction set
        • Calling convention
    • Stack exploitation
      • Stack Buffer Overflow
        • Dangerous functions
          • gets
          • memcpy
          • sprintf
          • strcat
          • strcpy
        • Basics
          • Challenge example
        • Instruction pointer Overwrite
          • Challenge example
        • De Bruijn Sequences
        • Stack reading
          • Challenge example
      • Format string
        • Dangerous functions
          • printf
          • fprintf
        • Placeholder
        • Data Leak
          • Challenge example
        • Data modification
          • Challenge example
      • Arbitrary code execution
        • Shellcode
        • ret2reg
        • Code reuse attack
          • Ret2plt
          • Ret2dlresolve
          • GOT Overwrite
          • Ret2LibC
          • Leaking LibC
          • Ret2csu
          • Return Oriented Programming - ROP
          • Sigreturn Oriented Programming - SROP
          • Blind Return Oriented Programming - BROP
            • Challenge example
          • 🔴Call Oriented Programming - COP
          • 🔴Jump Oriented Programming - JOP
          • One gadget
        • Stack pivoting
    • 🛠️Heap exploitation
      • Heap overflow
        • Challenge example
      • Use after free
        • Challenge example
      • 🛠️Double free
      • 🔴Unlink exploit
    • Protections
      • Stack Canaries
      • No eXecute
      • PIE
      • ASLR
      • RELRO
    • Integer overflow
Powered by GitBook
On this page
  • How it works
  • POP RSP gadget
  • XCHG <reg>, RSP
  • LEAVE; RET
  1. Pwn
  2. Stack exploitation
  3. Arbitrary code execution

Stack pivoting

ROP with a small buffer

PreviousOne gadgetNextHeap exploitation

Last updated 2 years ago

Stack pivoting is a technique used when there is lack of space after RIP to conduct a full.

How it works

Stack pivoting consist to take the control of the RSP register and then "fake" the location of the .

The general target is to set RSP at the beginning of the vulnerable buffer.

There is some ways to do this.

POP RSP gadget

The simplest but also the least likely to exist.

If there is one pop rsp; ret gadget then the attacker can use it to pop the bytes after overwriting RIP.

This gadget requires 8 bytes after RIP.

ret       <-- overwrite RIP
pop rsp   <-- set RSP arbitrary value

XCHG <reg>, RSP

xchg gadget swap the values between the two registers.

This gadget requires 16 bytes after RIP.

ret                 <-- overwrite RIP
pop <reg>           <-- set a register to an arbitrary value
xchg <reg>, rsp     <-- swap rsp and register values

LEAVE; RET

This is the most likely to exist and interesting way to stack pivoting. And it do not requires bytes space after RIP

Every function, excepted main, end with a leave; ret gadget.

leave is equivalent to

mov rsp, rbp
pop rbp

A function ending therefore looks like

mov rsp, rbp
pop rbp
pop rip

That means, when RIP is overwrite, the 8 bytes before overwrite RBP. Then, using leave it's possible to overwrite rbp .

Note that before pop rbp there is a mov rsp, rbp instruction. This instruction set the rsp value at the rbp value. So, if RIP point to leave; ret again, the value of the overwrited rbp gets moved to RSP.

This gadget do not requires byte space after RIP.

🛠️
ROP chain
stack frame