Stack overflow and ROP playbook. Use when exploiting buffer overflows to hijack control flow via return address overwrite, ROP chains, ret2libc, ret2csu, ret2dlresolve, or SROP on Linux userland binaries.

SKILL: Stack Overflow & ROP — Expert Attack Playbook AI LOAD INSTRUCTION : Expert stack based exploitation techniques. Covers classic buffer overflow, return to libc, ROP chain construction, ret2csu, ret2dlresolve, SROP, stack pivoting, and canary bypass. Distilled from ctf wiki advanced rop, real world CVEs, and CTF competition patterns. Base models often miss the nuance of gadget selection under constrained conditions. 0. RELATED ROUTING [format string exploitation](../format string exploitation/SKILL.md) — leak canary/libc/PIE base via format string before triggering overflow [binary protection bypass](../binary protection bypass/SKILL.md) — systematic bypass of NX, ASLR, PIE, canary, RELRO [arbitrary write to rce](../arbitrary write to rce/SKILL.md) — convert a write primitive (GOT, hooks, vtable) into code execution [heap exploitation](../heap exploitation/SKILL.md) — when the vulnerability is in heap rather than stack Advanced Reference Load [ROP ADVANCED TECHNIQUES.md](./ROP ADVANCED TECHNIQUES.md) when you need: Blind ROP (BROP) methodology against remote services without binary ret2vdso for ASLR bypass on 32 bit systems Partial overwrite techniques for PIE bypass JOP / COP alternative code reuse paradigms 1. STACK LAYOUT FUNDAMENTALS Element x86 (32 bit) x86 64 (64 bit) Return address size 4 bytes 8 bytes Saved frame pointer 4 bytes (EBP) 8 bytes (RBP) Canary size 4 bytes 8 bytes Calling convention args on stack RDI, RSI, RDX, RCX, R8, R9 then stack Syscall instruction int 0x80 syscall 2. RETURN TO LIBC When NX is enabled (stack not executable), redirect execution to libc functions. Classic ret2libc (32 bit) ret2libc (64 bit) — Need Gadgets for Arguments Libc Base Leak Methods Method Technique When puts@plt(puts@GOT) Leak resolved libc address GOT already resolved, puts in PLT write@plt(1, read@GOT, 8) Leak via write syscall write available printf("%s", GOT entry) Leak via format string printf controllable Partial overwrite Overwrite low bytes of return to reach leak gadget PIE enabled, known last 12 bits one gadget — Single Gadget RCE Constraints must be satisfied — check register/stack state before using. 3. ROP CHAIN CONSTRUCTION Tool Comparison Tool Strength Command ROPgadget Comprehensive search, chain generation ROPgadget binary elf ropchain ropper Semantic search, JOP/COP support ropper f elf search "pop rdi" pwntools ROP Automated chain building rop = ROP(elf); rop.call('system', ['/bin/sh']) xrop Fast gadget search xrop r elf Essential Gadget Patterns Purpose Gadget Use Case Set RDI (arg1) pop rdi; ret Most function calls Set RSI (arg2) pop rsi; pop r15; ret Two arg functions Set RDX (arg3) pop rdx; ret (rare) Three arg functions, use ret2csu Syscall syscall; ret Direct syscall invocation Stack pivot leave; ret Move RSP to controlled buffer Align stack ret (single ret gadget) Fix 16 byte alignment for movaps x86 64 stack alignment : system() and other libc functions use movaps which requires RSP % 16 == 0. Insert an extra ret gadget before the call if alignment is off. 4. ret2csu — Universal 3 Argument Control libc csu init exists in nearly all dynamically linked ELF binaries and provides controlled calls with up to 3 arguments. Key constraints : r12 must point to a pointer to the target function (e.g., GOT entry), not the function address directly. Set rbx=0 , rbp=1 to skip the loop. 5. ret2dlresolve Forge ELF dynamic linking structures to resolve an arbitrary function (e.g., system ) without a libc leak. Attack Flow 1. Control execution to call dl runtime resolve(link map, reloc offset) 2. Forge Elf Rel at known writable address pointing to fake Elf Sym 3. Forge Elf Sym with st name pointing to fake string "system\x00" 4. Set reloc offset so resolver uses forged structures 5. Argument ( /bin/sh ) placed on stack or in known buffer 32 bit vs 64 bit Differences Aspect 32 bit 64 bit Relocation type Elf32 Rel (8 bytes) Elf64 Rela (24 bytes) Symbol table entry Elf32 Sym (16 bytes) Elf64 Sym (24 bytes) Alignment Relaxed Strict (must satisfy ndx = (reloc offset) / sizeof(Elf64 Rela) , then sym = symtab[ndx] ) Version check Usually skippable VERSYM[sym index] must be valid or 0 6. SROP — Sigreturn Oriented Programming Abuse the sigreturn syscall to set all registers at once from a fake Signal Frame on the stack. When to use : limited gadgets, no pop rdx , static binary, or need to pivot stack to arbitrary address. 7. STACK PIVOTING Move the stack pointer to an attacker controlled buffer when overflow length is limited. Technique Gadget Precondition leave; ret mov rsp, rbp; pop rbp; ret Control saved RBP to point to fake stack xchg rsp, rax; ret Swap RSP with RAX Control RAX (via gadget chain) pop rsp; ret Direct RSP control Rare but powerful SROP pivot Set RSP in SigreturnFrame Only need sigreturn gadget leave;ret Pivot Pattern 8. CANARY BYPASS Technique Condition Method Brute force fork() server (canary same in child) Byte by byte (256 × 7 = 1792 attempts for 64 bit) Format string leak printf(user input) available %N$p to read canary from stack Stack reading One byte overflow or partial read Overwrite canary null byte, read via error/output Thread canary Overflow reaches TLS Overwrite stack guard in TLS (at fs:[0x28] ) simultaneously Information disclosure Uninitialized stack variable leak Canary included in leaked data 9. TOOLS QUICK REFERENCE 10. DECISION TREE

stack-overflow-and-rop