1

I recently started practicing binary exploitation on 64 bit linux. Problem is while chaining ROP gadgets we have to get their address on stack. But since 64 bit addresses are 6 bytes plus 2 null bytes. It's not possible to get null bytes on stack with strcpy like functions. Anyone able to do something about it yet ?

1
  • Short answer: It's extremely possible and dare I say commonly practiced. Yes, the problem you pose is real and thus you have to get creative in how you craft your chains
    – Henry F
    Mar 30 '18 at 5:53
1

String-handling functions aren't the only way to perform a buffer overflow. If you find a vulnerability in how a program handles binary data (eg. a missing bounds check on a call to memcpy()), there's no problem putting null bytes on the stack.

1
  • Yeah. But what if source has string functions and i can't change source code. Will it still be possible somehow or i should just search for some other vulnerability? Feb 27 '18 at 22:48
1

Doing a partial overwrite you might get ONE gadget into the return address. That gadget can pivot somewhere else.

0

Refer here: Return to libc chaining on 64 bit linux. Strcpy will give problems because it won't copy null bytes. You ca use one gadget in that case. It will still work the same with functions which copy null bytes.

https://teamultimate.in/return-to-libc/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.