Disclaimer: I am asking this question solely for educational purposes.
I am trying to chain some function calls using return-oriented programming, exploiting a vulnerable binary which uses
strcpy(). One of these function calls should be a call to
system() (in order to execute some shell command). Unfortunately, the address of
system() contains a
NULL byte which will lead for
strcpy() to stop copying the payload once this byte is observed.
My question therefore is: what is the best approach to solve this issue?
I've already checked libc for functions similar to
system(), but have found nothing. Another idea of mine would be to call
wait() subsequently. This would however increase the complexity of the payload.