we have a program that is vulnerable to a one byte framepointer overwrite (note: stack is marked executable, Linux machine with aslr disabled and stack cookies disabled also standard x86 so it's little endian, so no problem there)
for(int i=0; i <=256; i++) buf[i] = argv[i];
I want to put my shellcode into
buf and jump to it. If i would use a normal stack overflow i could get exploit reliability by going to a loaded library which has the
jmp $esp instruction somewhere encoded and put my shellcode where the function arguments are and so forth. But this is not posibble here.
So what do you do if it's a remote process (which means you can't hardcode the address values) and need exploit reliability, any ideas? The only thing that came to my mind is stack alignment with which we would be able to predict the low bits (like the lower 2 or 3 bits maybe?).
All i need would be to know the low byte of the frame pointer so i can overwrite it with a little smaller value controll eip to point to jmp esp and at the intruction at esp would be like a short jump -0x80 or something
so i have decrease framepointer => leave ret gets executed => control eip => point eip to jmp esp instruction => next instruction to be executed would be a short jump -0xsomevalue => payload gets executed
any ideas? I thought about other heuristics like writing the pointer to jmp esp over and over into the buffer so that it's more likely to get control of eip, but that way my method of jmp -0xsomevalue wouldn't work anymore.
If something is left unclear, i'll happily elaborate further if requested :)