Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been instructed to test a few of our newer applications before user release, and managed to find a buffer overflow on one of the fields.

Here is where I've run into a brick wall though, and wasn't sure what I could try next, if anything.

Initially I tried a partial EIP overwrite, but I can't find any useful jumps inside that space (nothing at all actually).

I then checked the DLLs included with the app to avoid ASLR altogether, but they don't have any jumps that I could use either.

For some temporary testing I decided to just hard code a current jump address, and worry about ASLR later. The issue HERE is that my current address space resides between 61xxxxxx and 76xxxxxx. While this isn't normally an issue, the field that causes the overflow automatically capitalizes each character, so anything in the 61-7A range is out.

Am I missing something obvious, if not, what should I try next?

share|improve this question
3  
Are you trying to solve the buffer overflow or trying to exploit it? Even if it cannot be used for malicious purposes it should be fixed. –  Ramhound Aug 2 '12 at 15:37
    
I'd like to exploit it just to provide the PoC, but I agree that it needs to be fixed regardless. –  doyler Aug 2 '12 at 15:40
2  
You have to use a ROP chain, gadgets don't only exist in DLL's, they also exist in the binary its self. Metasploit has a gadget finder. –  Rook Aug 2 '12 at 19:30
add comment

1 Answer

There's not too much to be gained in actually exploiting it just for a demo. You should be able to demo making your system crash from a phone borrowed from your audience, and that should adequately appall your viewers.

If you really want the dogs and ponies to bark and trot, you could rig the demo using rebase on your module. That will let you move the address space to somewhere other than its current 61xxxxxx location, such as a nice and convenient 41xxxxxx. It's certainly dishonest, but it's also dramatic. If you feel guilty, tell them that it's almost no different than if someone added a new module at that address as part of a future feature enhancement.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.