Lion Cipher Lab

Pop a shell with Sigreturn-Oriented Programming (SROP)

• Penetration Testing / Red Team
• Advanced
• ~90 min
• Free · no account required

Why it matters

Every rung of the binary-exploitation ladder so far has needed the RIGHT gadgets: ROP needed a `pop rdi` to set an argument, ret2libc needed that plus a leak. But real targets — especially tiny statically-linked binaries, embedded firmware, or the tail end of a chain where you have almost nothing left — sometimes hand you no useful `pop` gadgets at all. SROP (Sigreturn-Oriented Programming) is the technique for exactly that famine. It exploits a design feature of Unix signal handling: when the kernel delivers a signal it dumps ALL of the CPU's registers into a structure called a sigcontext on…

What you'll learn

• understanding the signal-handling mechanism SROP abuses: when the kernel delivers a signal it saves ALL registers into a `sigcontext` frame on the user stack, and on `rt_sigreturn` it restores every one of them (rax, rdi, rsi, rdx, rip, rsp, flags...) from that frame -- so whoever controls the stack controls the frame
• why SROP is the right tool when gadgets are scarce: instead of hunting a `pop rdi`, a `pop rsi`, a `pop rdx` and a syscall, you need only ONE `syscall` instruction plus a way to set rax=15, and a single sigreturn then loads an entire register state you laid out yourself
• the two magic numbers for x86-64 Linux: rax=15 is `rt_sigreturn` (executing a `syscall` with rax=15 triggers the frame restore), and rax=59 is `execve` (what your forged frame sets up to run execve("/bin/sh", NULL, NULL))
• building the forged frame the standard way with pwntools' SigreturnFrame(): set frame.rax/rdi/rsi/rdx/rip, then bytes(frame) is the exact sigcontext to place at rsp when the sigreturn syscall fires
• measuring the overflow offset yourself with a cyclic pattern rather than trusting a hardcoded number, because stack layout and padding differ per compiler and machine
• chaining it end to end: overflow -> `pop rax ; ret` -> 15 -> `syscall ; ret` (fires sigreturn) -> forged frame -> execve("/bin/sh") -> an interactive shell where `id` runs on YOUR box
• the judgment: when SROP beats ROP, how the original Framing Signals research framed both the attack and its defenses, and why sigreturn is rarely a directly reachable primitive on hardened real-world targets

Steps in this lab

1. Where the arc left you — and what SROP is
2. Get the Linux toolchain and pwntools
3. Write the vulnerable program — and hand it a syscall gadget
4. Find the overflow offset yourself
5. Locate the syscall gadget and the way to set rax=15
6. Forge the fake sigcontext with SigreturnFrame()
7. Run the exploit and pop a shell
8. When SROP beats ROP — and how it is defended
9. What you learned — and the next rung

Open the full interactive lab →