Exploiting Return Oriented Programming (ROP) tutorial - Binary Exploitation PWN101

ROP tutorial step by step, explained in detail. We will understand how Return Oriented Programming works and how to use this exploitation technique to abuse (exploit) vulnerable binaries. We will understand the theory behind the technique and later put it into practice by exploiting an actual challenge from ROPEmporium. In order to understand ROP, the most important thing is to understand what the RET instruction does (which are its effects) when it gets executed. Knowing how the ESP/RSP and EIP/RIP registers are affected by it is fundamental. We can achieve the desired behavior by chaining together ROP gadgets (creating a ROP chain), abusing a buffer overflow and hijacking the exaction flow.

Some quick notes after uploading the video:
- A ROP gadget is any instruction sequence that ends with an instruction that modifies the RIP register, typically a RET (but it could be any other instruction, like JMP). In the video, in order to keep things simple, I mentioned only the RET case.
- Yes, around 14:45 I mispronounce the word "contriving" :(

References to learn more about ROP:

Tools to find gadgets within a binary:

00:00 - Intro
00:47 - More references to learn ROP
01:29 - What is ROP?
02:55 - What are ROP gadgets and chains?
04:19 - The RET instruction
06:06 - Drawing the RET instruction (legit epilogue)
07:53 - Drawing the attack
12:43 - Checking binary protections
13:43 - Executing the binary
13:56 - Crashing the binary
14:15 - Reversing the binary
14:50 - Spotting the vulnerability
15:30 - Reversing the binary
16:00 - Spotting a call to system()
16:36 - Starting to write the exploit
17:22 - Reversing the binary
17:37 - Calling convention of x64
18:24 - Checking strings
18:33 - Spotting the command to pass to system()
19:10 - Tools to find ROP gadgets
20:07 - Finding ROP gadgets in the binary
21:20 - Writing the exploit
22:38 - Drawing the exploit
25:00 - Executing the exploit
25:17 - Exploitation successful
26:00 - Outro[*]

Exploit code, not people.
Twitter: @Razvieu
*Outro track: Etsu - Selcouth
GG

[RazviOverflow]

Some quick notes after uploading the video:
- A ROP gadget is any instruction sequence that ends with an instruction that modifies the RIP register, typically a RET (but it could be any other instruction, like JMP). In the video, in order to keep things simple, I mentioned only the RET case.
- Yes, around 14:45 I mispronounce the word "contriving" :(

[antisec]

This is by far the clearest explanation of ROP ive ever seen and you are the only channel ive seen to break it down into the very basics, and make it super clear to understand. Glad to be one of your first 500 subs, but you deserve more than the big CTF youtubers out there and I can see your channel blowing up. Thanks a lot!

[thecamera-gw]

This is seriously the best explanation i've found on ROP. The explanation is so clear and detailed. So helpful 😄 Loved it!

[MysteryMooCows]

Wow. I cant wait for your channel to explode! You have a deep understanding of what you're doing and present the material in a clear and approachable way. I really enjoyed this, thank you!

[mattanderson]

Every single one of your videos has taught me 10 x anything I have ever learned from any other instructor. Your approach with explaining each subject and all of the complex details is just phenomenal. So grateful to have stumbled across you. Working my way through your content and loving every minute.

[migwe]

Thank you so much, this is by far the clearest rop tutorial ive ever seen. keep up the good work

[pgteugj]

Wow - this is by far the best explanation if seen on the topic so far. Thank you very much!

[harjotsaraon]

Your content is super clear and well explained. Thanks for explaining the rop concept in the best possible way.

[atharavhedage]

Truely said, you deserve subs more than top CTF YouTubers out there, absolutely clear content, loved it!

[kushagrasingh]

Woah! loved the explanation, you surely deserve more number.

[regas]

Excellent content, this actually helped me a lot. Please keep posting!

[zeshanahmednabin]

Can you make a Cutter setup video. My cutter shows addresses relative to stack. Which is pretty confusing... I was wondering why isn't my exploit working...
It shows var void *buf @ stack - 0x28 whereas on yours it shows var void *buf @ rbp - 0x20 @14:53

[danielcmihai]

Nice one once again. Looking forwards to more content.

[Obeeron]

Extremely clear explanations thank you for this video

[Ouroboros]

Can somebody advice the debugger for NASM?

[nathandaugherty]

Possibly already pointed out - at around 8:30 the picture of the stack being overflowed is backwards. The stack grows from high memory addresses to low. Everything that was drawn into the stack should be flipped upside down. Nonetheless, still a great video and explanation.

[cgrbro]

hello, thanks for all but where is the file i didn't find . Can u share please ?

[AdiSings]

Hello! One of the best videos about ROPs. One thing I would like o mention:
After:
payload = b"A" * 0x28
I also need an address of just 'ret' got with ROPgadget so:
payload += return_address.
Moreover I need to push it further to "usefulFunction" address. So:
payload += usefullFunction_address
So now I can add the other 3 addresses that you have in your video. I don't know why it is not working with what you just present there...

[polmarin]

Hola Razvi! Volverás a meterle caña al otro canal o ya lo has abandonado del todo? Se te echa de menos!

[ragnarlothbrok]

i dont understand a shit from all of this, i don't know what is the flow or next instruction when you talk about things, i don't see the context