1

Trying to give a command line program an address to overwrite a return address saved in the stack. I could successfully overflow the input argument into the exact return address position but the address I want to give contains zeros (starts with with zeros eg 0x0000555555554bce).

I give the address in from of string, the 00 must be a NUL character (\0) but I can't give that using the command line. Any idea on how can I achieve that?

Improve this question

1 Answer 1

Reset to default
0

If I understood correctly the problem has to do with packing your input. You can use any scripting language to pack your input. For example in python you can do (assuming x64-bit arch):

cat <(python -c 'from pwn import p64; print your_padding_here + p64(0x555555554bce)') - | ./your_program

or if for any reason you prefer only built-in modules:

cat <(python -c 'print your_padding_here + __import__("struct").pack("I", 0x555555554bce)') - | ./your_program

Also you can accomplish the same thing by writing the buffer to a file and then pass the file as input.

Improve this answer
6
  • Thanks a lot for the answer. Well I used perl to do the same thing basically using perl -e 'print "x\ce\x4b\x55\x55\x55\x55\x00\x00"x10' but the problem is that no matter what i use the "\x00" Byte is a NUL character and it doesn't get printed!
    – Glen E. Renner
    Mar 24, 2018 at 10:00
  • Thats the memory content before the overflow i want to overwrite the address in the right: 0x7fffffffdd50: 0x00007fffffffdd90 0x000055555555488e And this is it after the overflow: 0x7fffffffdd50: 0x00007fffffffdd90 0x5555555555554bce
    – Glen E. Renner
    Mar 24, 2018 at 10:04
  • hm..., maybe it has to do with stack alignment, are sure you have found the correct offset to overwrite that certain address ? I've had the same issue once with format-string exploit and I had used wrong padding...
    – game0ver
    Mar 24, 2018 at 12:16
  • well in 32bits architecture it's easy because addresses are 4 bytes long. you get no extra zeros in the end, I always get it to work. But in this case addresses are 6 bytes long so you always get two extra bytes that need to get a NUL character in order to make it align perfectly. I guess I'll take some time out and learn about this before trying buffer overflows in 64bit architectures. Anyway thanks a lot for your answers @game0ver it was valuable.
    – Glen E. Renner
    Mar 24, 2018 at 22:09
  • You are welcome!! Well in x64 bit, addresses are actually 8 bytes long (not 6) and also there are some other differences (like in how syscalls are performed and how arguments are passed etc...) but if you are familiar with 32 bit arch it won't be difficult to learn x64 also. Anyway I hope I've been of some help!
    – game0ver
    Mar 24, 2018 at 23:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .