system("/bin/cat flag.txt"). For 32-bit binaries, the arguments for a function call is stored on the stack. Pictorially, the stack frame looks like the following:
exit(). It is okay to use
b"B" * 4to replace
exit()for this challenge. However, this dummy padding would destory a process in real-world scenarios, so make sure you always use
exit()as the return address for
"/bin/cat flag.txt"in RDI before calling
system(). The trick is to use a
pop rdi ; retgadget. This gadget can be easily found with ROPgadget if it exists in the binary.
retgadget here is a padding that makes sure the stack is properly aligned. Keep this in mind, it will save you a lot of time from debugging.