1

I'm trying to write a rop chain to bypass dep on Windows 7 x64 SP1.

I'm working on a SEH overwrite exploit and so, in the first place, i need to return back to my buffer after exception is triggered and ESP was moved away. My problem is, i cannot find a good stackpivot gadget due to badchars and distance too much large of existing gadget that i could use to pivoting back into my buffer.

During the overwrite i can see ECX register that points into my buffer and i know the offset. But it seems to me its value is changed in the same time ESP is moved away. So, i cannot return back into my buffer to start my rop chain.

How can i approach to solve this problem ? Any suggestions ?

Improve this question
3
  • Needs more info, I presume you have EIP control since you're saying it's a SEH. This is a puzzle and the right solution is any that works. It doesn't have to be done a specific way. Since ECX points to your buffer you could probably pull a xchg ecx, esp; ret or a number of similar moves. You don't have to reuse the existing stack.
    – wireghoul
    Jul 28, 2017 at 23:30
  • ECX points to my buffer before exception is raised. After the exception there is something like a context change (??) and all register are overwritten. Normally i would put some pointer to an ADD ESP, CONST - RET gadget in the SEH record so ESP would move back into my buffer and so start executing my rop-chain. I can control SEH and maybe put a P/P/R and come back to NSEH record but i cannot execute jump due to DEP.
    – Kartone
    Jul 31, 2017 at 6:41
  • Yeah that was exactly what my problem looked like to me until I found out it was because my buffer was too long. I'm not sure that's the issue but I wanted to bring it up just in case because I almost gave up until I tried it. I thought it was normal for an exception to clear the registers but maybe that's SafeSEH.
    – Patrick
    Sep 24, 2017 at 17:02

1 Answer 1

Reset to default
1

I feel like I had the same issue but managed to get it working in my case. The module with the overflow had DEP enabled so I thought it wasn't going to work.

All I did was point EIP to a JMP ECX in nSEH and SEH just to be sure but it wasn't working.

After thinking hope was lost I realized in my case there was an irrecoverable exception and it wasn't calling my SEH handler because my buffer overflow was going completely out of the bounds of the modules stack!

I found out the exact current stack size and modified my overflow to use less bytes so it ends just before leaving the stack frame.

This was all I needed to do and my JMP ECX inside the SEH successfully pivoted into my buffer and allowed me to start executing the rop chain I was working on. Hope this helps I stayed up all night working on it.

Improve this answer
3
  • The problem is: ECX point to the buffer during the overflow but when exception is raised, like all other registers, his value change. Basically i cannot move ESP back to my buffer.
    – Kartone
    Sep 7, 2017 at 7:10
  • How did you find the page frame end ?
    – Kartone
    Sep 27, 2017 at 19:06
  • stack size = ESP - EBP;EBP+stack size = end of the page frame. depending on the OS and version you should also see a stack cookie/canary.
    – grepNstepN
    Oct 14, 2017 at 21:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .