All right.
It's done.
So after a couple of rewrites, we're going to redo our rock chain and our canary.
And is this.
That's not the way.
So what we're going to do, since we're able to leak the canary, as we've seen before, is we're going
to copy and paste that code.
Right here.
And now begin adding our rock chain.
So what we want to do is we need to bugger Bowen to our control, see the map.
Now we have our base address.
So set callsign base equals this address and we're going to add the variable.
Let's see, base address
equals this.
Now we need to look for our gadgets.
So let's look for our shell gadget.
So fine, fine shell, that's your absolute value.
So we're going to do is print hex this FC value minus base and that is our offset.
If you're really curious, you can actually print in decimal, you'll find out that it's this many bytes
away from the base address of the C Standard Library.
So we're going to save this just like we did in our first rock chain exercise.
So be fine, show equals let's see, base address plus this offset.
We're also going to look for system P system.
So the print packs absolute address minus space, and we have this offset.
Equals Seabass address.
Plus this.
Want to look for our exit function?
Hex minus the base dress.
Exit equals seabass address.
Plus this.
And we need to look for two more gadgets.
So let's go look, eavesdropper.
So let's exit this and please Teamdogs.
So let's see.
Right here.
Rocker file.
Let's see.
Standard library.
We're just doing the same exact drop chain that we're using in our original Bret Lipsey attack in the
previous module.
Man.
This takes a while.
All right, so I want to do search def one of return.
This one, they'll be fine.
That equals remember can move the colon.
And let's see base address pluses offset.
And then we need our pop RTI instructions.
So search step one Pop VI.
So it will be RTI.
Let's see this address plus this offset.
So at this point, what we're going to do is construct our rope chain.
Well, actually, right now we have all of our necessary gadgets and we can leak the base, the stack
canary.
We can now put this in a new module.