Hack-The-Box-reversing-challenge[rauth]
Here's something encrypted, password is required to continue reading.
Hack-The-Box-pwn-challenge[antidote]
Here's something encrypted, password is required to continue reading.
A Simple ROP Exploit /bin/sh via syscall
为了用sys_execve syscall执行/bin/sh，需要解决一些障碍，根据参考，需要设置寄存器如下;
EAX = 11 (or 0x0B in hex) – The execve syscall number
EBX = Address in memory of the string “/bin/sh”
ECX = Address of a pointer to the string “/bin/sh”
EDX = Null (可选的指向描述环境的结构的指针)
一旦所有这些都设置好了，执行int 0x80指令应该会生成一个shell。
ROP Exploit MProtect() and Shellcode
基于上个ROP exploit建立的,学习编写ROP chains的另一种方法, 而不是using sys_execve to spawn a shell, 用sys_mprotect关掉NX保护, 并执行shellcode。
