1

I'm trying to exploit a strcpy() buffer overflow vulnerability to test ROP attack. I found a very useful gadget at address 0x0000f26c so I am obliged to insert null bytes to the stack to override the return address of the vulnerable function. For the moment I failed doing this because strcpy() uses 0x00 as a string terminator.

Is there any other method to do this?

Improve this question

1 Answer 1

Reset to default
1

Not that I am aware of but how about overwriting the return address with a "ret" gadget ? With a debugger try to find if there are null bytes above the return address...

If we consider rsp == 0x1000 when you are about to branch to the return address:

0x1010: 0x???????????????? <-- are these null-bytes ? if yes ...
0x1008: 0x???????????????? <-- are these null-bytes ? if yes overwrite first 2 bytes with "\x6c\xf2" if not overwrite with ret gadget... 
0x1000: *return address*   <--- overwrite with a ret gadget
Improve this answer
2
  • No. In ROP attack I have to chain all the gadget the one after the other and place the data needed by each gadget on the stack also, so all what I will place after the ret gadget have to be useful. In 32-bit arch, if I put 0x0000f26c and then 0x00004acc what I will get as a return address is 0xf26c4acc, the null bytes will be eliminated. I want to solve this issue. If it is a fgets instead of strcpy the problem is solved because the string terminator for fgets is not 0x00. For strcpy it seems to have no solution.
    – Ahmed
    May 29, 2018 at 8:24
  • ret gadgets do not need any data as it's simply a ret instruction, assuming you have a ret gadget without any null bytes in the address, you could as I said simply chain any number of ret gadgets needed on the stack until you reach a point when you know you will find null bytes, at that point you can put your useful gadget, also assuming that useful gadget does not require any data, in that case I don't see how you could do it.
    – JeanPic
    May 29, 2018 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.