LayerOne 2023 - Intro to Memory Corruption and ROP (Jon King (jk))

Jon King presents a practical, real-time walkthrough of solving a binary exploitation CTF challenge called 'EasyWeb' (300 points). He demonstrates the complete workflow for exploiting a buffer overflow vulnerability in a web server binary running on port 8080.

The speaker begins with reconnaissance techniques—running the binary, analyzing its strings, and using checksec to identify security mitigations (stack canaries, NX, ASLR). He then sends malformed HTTP requests to trigger a segmentation fault, confirming a buffer overflow in the process_client function.

Using GDB integrated with pwntools (a Python exploitation library), he analyzes the crash to gain control of the return pointer by carefully crafting payloads. Since NX prevents executing injected shellcode, he pivots to Return-Oriented Programming (ROP)—chaining existing code fragments called gadgets to accomplish tasks.

The core technique demonstrated is ret2csu, a powerful ROP method using the __libc_csu_init function present in historically-compiled glibc binaries. This allows controlled function calls with arbitrary arguments. To bypass ASLR (which randomizes libc addresses), King constructs a ROP chain calling write() to leak a GOT entry address back to the attacker through the socket. By calculating the offset between this leaked address and known values, the attacker can determine libc's base address and access all needed functions.

The walkthrough uses Ghidra for binary analysis, ROPgadget for gadget discovery, and demonstrates x86-64 calling conventions (RDI, RSI, RDX for first three arguments). The speaker notes that ret2csu is becoming obsolete in Ubuntu 22.04 and later. Due to time constraints, the full exploitation chain remains incomplete, but the foundational techniques for bypassing modern mitigations are clearly demonstrated.