IoT Penetration Testing Cookbook

Getting ready

As mentioned earlier, to perform ROP, we need to be able to identify the useful ROP gadgets which can be chained together. To find these specific gadgets, we can look at various locations in the libc or other libraries manually, or even use automated tools and scripts which can help us do the same.

To keep things simple, we will take a very simple example with a vulnerable program on ARM and then also later look at some other examples which will help us deepen our understanding of ROP-based exploitation.

Some of the components that we will require for this are as follows:

• GDB-Multiarch: This is the GDB for various architectures
• BuildRoot: This is used to compile our vulnerable program for ARM architecture
• PwnDbg: This is the ...