WCU / Cybersecurity
~/CSC 472/Class 07/KP 07
Class 07 · KP 07 / 18

A ROP Chain on the Stack

attacker stackpadding A*N→ pop rdi ; retgadgetarg1in RDI→ pop rsi ; retgadgetarg2in RSI→ system()target.text / libcexisting code
A ROP chain: each 'ret' launches the next gadget already present in the code.

Chain to call system("/bin/sh") on x86-64:

{ Read top to bottom = execution order. Each ret

consumes one entry and jumps to the next gadget.}