What to do next for this possible buffer overflow?

Question

I've been instructed to test a few of our newer applications before user release, and managed to find a buffer overflow on one of the fields.

Here is where I've run into a brick wall though, and wasn't sure what I could try next, if anything.

Initially I tried a partial EIP overwrite, but I can't find any useful jumps inside that space (nothing at all actually).

I then checked the DLLs included with the app to avoid ASLR altogether, but they don't have any jumps that I could use either.

For some temporary testing I decided to just hard code a current jump address, and worry about ASLR later. The issue HERE is that my current address space resides between 61xxxxxx and 76xxxxxx. While this isn't normally an issue, the field that causes the overflow automatically capitalizes each character, so anything in the 61-7A range is out.

Am I missing something obvious, if not, what should I try next?

Answer 1

There's not too much to be gained in actually exploiting it just for a demo. You should be able to demo making your system crash from a phone borrowed from your audience, and that should adequately appall your viewers.

If you really want the dogs and ponies to bark and trot, you could rig the demo using rebase on your module. That will let you move the address space to somewhere other than its current 61xxxxxx location, such as a nice and convenient 41xxxxxx. It's certainly dishonest, but it's also dramatic. If you feel guilty, tell them that it's almost no different than if someone added a new module at that address as part of a future feature enhancement.