WCU / Cybersecurity
HomeCSC 471CSC 472Search /
~/CSC 472/Lab 5
CSC 472 · Lab 5

Multi-Stage Exploitation: Info Leak, GOT Overwrite, and ret2libc

attacker stackpadding A*N→ pop rdi ; retgadgetarg1in RDI→ pop rsi ; retgadgetarg2in RSI→ system()target.text / libcexisting code
A ROP chain: each 'ret' launches the next gadget already present in the code.

The goals of this lab:

  • Understand why modern targets (with ASLR + NX) require chaining multiple primitives.
  • Perform an information leak to defeat ASLR and compute the libc base.
  • Use GOT overwrite / ret2libc to get a shell on a remote server and read a flag.

Server details

  • Target host/port: provided on the course website
  • Vulnerable program: lab5_vuln (lab5_vuln.c)
  • Target file: flag.txt
  • ASLR / NX: On StackGuard / PIE: Off RELRO: Partial
  • Remote libc: provided with the lab (use it for offsets)

Background

Because ASLR randomizes the libc base each run, hardcoded addresses fail. So the exploit has two stages: (1) leak a known GOT entry (e.g., puts) using the program's own output, then compute libc_base = leaked_addr - libc.symbols[func]; (2) with libc located, return into system("/bin/sh") (or a one_gadget), or overwrite a GOT entry, to get a shell. The PLT/GOT mechanism (lazy binding through a writable GOT under Partial RELRO) is what makes both the leak and the overwrite possible.

Experiment Setup

  • Log in to Badger CTF and copy the binary and the remote libc for offset calculation: cp /workdir/ss2026/lab5/lab5_vuln . cp /workdir/ss2026/lab5/libc.so.6 .
  • Do not recompile lab5_vuln.c for the remote attack — compiler/libc differences shift addresses. You may compile a local copy to practice with process().
  • Develop locally, then switch to the remote target. A skeleton (lab5_exp.py) is provided; it reads the host/port from LAB5_HOST/LAB5_PORT and toggles remote with python3 lab5_exp.py REMOTE.

Lab Exercise

Objective 1: Information leakage (4 points)

Leak a libc address and compute the libc base.

Q1: Which GOT entry did you leak, and how? Show the leaked value and your computed libc base. (2 pts)
Q2: How did you obtain the correct offset for that symbol in the remote libc? Why can you not use Badger's local libc offsets? (2 pts)

Objective 2: Get a shell and read the flag (6 points)

Use ret2libc (or GOT overwrite) to spawn a shell, then retrieve flag.txt.

Q3: Describe your second stage (ret2libc or GOT overwrite). Show the relevant part of your script. (3 pts)
Q4: Provide your full exploit and a screenshot showing the shell and the contents of flag.txt. (3 pts)

Hints

Review Class 05: Exploit Mitigations and Class 08: Multi-Stage Exploitation. Useful tools: pwntools ELF/ROP, one_gadget, and a libc-offset database. Match your local libc to the remote one before porting.

Deliverables

A comprehensive PDF report documenting every stage with screenshots, code snippets, your computed libc base, and the contents of flag.txt.

Submission

  • The lab due date is available on our course website. Late submissions will not be accepted.
  • Submit your assignment to D2L directly.
  • No copy or cheating is tolerated. If your work is based on others' or AI, please give clear attribution. Otherwise, you WILL FAIL this course.
BackCSC 472 home