1

I am currently working on learning Windows Exploitation and am working in a Windows 7 VM. I was going through some tutorials and while they worked fine on Vista and below, they won't on Windows 7 due to a new restriction.

The restriction is that addresses that I could use for ROP are now mapped to 0x00 and which contains a NULL byte. This is also the same with potential gadgets like "call esp, jmp esp, etc"

!mona rop

# rop chain generated with mona.py - www.corelan.be
 rop_gadgets = [
   0x0045021d,  # POP EAX # RETN [Eureka Email.exe]
   0x004570a8,  # ptr to &VirtualAlloc() [IAT Eureka Email.exe]
   0x004124d4,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [Eureka Email.exe]
   0x004412d7,  # PUSH EAX # PUSHAD # XOR EAX,EAX # POP ESI # RETN [Eureka Email.exe]
   0x00446d9f,  # POP EBP # RETN [Eureka Email.exe]
   0x00415e82,  # & push esp # ret  [Eureka Email.exe]

How do I bypass this new restriction in Windows 7? In Linux I know this is "ASCII Guard" but I am not familiar with it in Windows nor did I know it was a thing.

1

Sometimes you just can't ROP if your vulnerable function breaks on null terminated strings.

However, you still have some other options:

  • Try to find a memory leak condition. You get at least one return address before the last null byte breaks your payload, and build a 2nd stage exploit
  • You could write a ROP chain including ASLR and re-based modules (if using mona, tell it to include modules regardless of their security: !mona -cm aslr=true,rebase=true and no nulls !mona -cp nonull) and shift relative base address offsets on the gadgets on the fly in some brute-force tries. You might get lucky and land just fine as 32 bits address space entropy is very reduced.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.