WCU / Cybersecurity
HomeCSC 471CSC 472Search /
~/CSC 472/Lab 4
CSC 472 · Lab 4

Return-Oriented Programming (ROP)

attacker stackpadding A*N→ pop rdi ; retgadgetarg1in RDI→ pop rsi ; retgadgetarg2in RSI→ system()target.text / libcexisting code
A ROP chain: each 'ret' launches the next gadget already present in the code.

The goals of this lab:

  • Understand Return-Oriented Programming and why it defeats a non-executable stack (NX).
  • Build a ROP chain that calls several functions in sequence with controlled arguments.

Background

With NX enabled, injected shellcode will not execute. Instead we reuse code already in the binary: short instruction sequences ending in ret, called gadgets. By placing a series of gadget and target addresses on the stack, each ret launches the next, letting us call functions with arguments we choose. On x86-64 (System V), the first arguments go in RDI, RSI, RDX, so we use gadgets like pop rdi ; ret to load them.

The provided lab4_rop.c has three gated functions that must run in order and with the right magic arguments to assemble and execute the command /bin/bash:

  • add_bin(0x11111111, 0x22222222) appends "/bin"
  • add_bash(0x33333333) appends "/bash"
  • exec_string(0xdeadbeef, 0xcafebabe) runs system(cmd)

Experiment Setup

  • Log in to Badger CTF and copy the source and prebuilt binary: cp /workdir/ss2026/lab4/lab4_rop.c . cp /workdir/ss2026/lab4/lab4_rop .
  • Run ./lab4_rop and give it a long input; note the crash from the overwritten return address.
  • Find gadgets: ROPgadget —binary lab4_rop | grep "pop rdi" ROPgadget —binary lab4_rop | grep ": ret"

Lab Exercise

Target 1: Diagram your payload (4 points)

Draw a diagram of your ROP payload and explain why it works. Include:

  • the order of dummy bytes, gadgets, arguments, and target addresses on the stack;
  • the length of the dummy bytes needed to reach the return address.

Target 2: Launch the ROP attack (6 points)

Using the skeleton lab4_rop_exploit.py, build a chain that calls add_bin then add_bash then exec_string with the correct magic arguments, so you get a /bin/bash shell. Your final script must work outside GDB:

python3 lab4_rop_exploit.py
Q1: Show your ROP-chain diagram (Target 1) and the dummy length you found. (4 pts)
Q2: Provide your exploit script and a screenshot of the shell you obtained. Explain how you passed each magic argument into the right register. (4 pts)
Q3: Why does ROP work even though the stack is non-executable (NX on)? What defense would stop your chain, and how? (2 pts)

Hint

Review Class 07: Return-Oriented Programming and ret2libc. On x86-64 you may need an extra bare ret gadget for 16-byte stack alignment before a system call.

Deliverables

A PDF report with your diagram, answers, exploit script, and a screenshot of the shell.

Submission

  • The lab due date is available on our course website. Late submission will not be accepted.
  • Submit your assignment to D2L directly.
  • No copy or cheating is tolerated. If your work is based on others' or AI, please give clear attribution. Otherwise, you WILL FAIL this course.
BackCSC 472 home