I've been instructed to test a few of our newer applications before user release, and managed to find a buffer overflow on one of the fields.
Here is where I've run into a brick wall though, and wasn't sure what I could try next, if anything.
Initially I tried a partial EIP overwrite, but I can't find any useful jumps inside that space (nothing at all actually).
I then checked the DLLs included with the app to avoid ASLR altogether, but they don't have any jumps that I could use either.
For some temporary testing I decided to just hard code a current jump address, and worry about ASLR later. The issue HERE is that my current address space resides between 61xxxxxx and 76xxxxxx. While this isn't normally an issue, the field that causes the overflow automatically capitalizes each character, so anything in the 61-7A range is out.
Am I missing something obvious, if not, what should I try next?