I'm trying to exploit a strcpy() buffer overflow vulnerability to test ROP attack. I found a very useful gadget at address 0x0000f26c so I am obliged to insert null bytes to the stack to override the return address of the vulnerable function. For the moment I failed doing this because strcpy() uses 0x00 as a string terminator.
Is there any other method to do this?
Not that I am aware of but how about overwriting the return address with a "ret" gadget ? With a debugger try to find if there are null bytes above the return address...
If we consider rsp == 0x1000 when you are about to branch to the return address:
0x1010: 0x???????????????? <-- are these null-bytes ? if yes ...
0x1008: 0x???????????????? <-- are these null-bytes ? if yes overwrite first 2 bytes with "\x6c\xf2" if not overwrite with ret gadget...
0x1000: *return address* <--- overwrite with a ret gadget
