There is a 32-bit linux application. It's possible to overwrite EIP easily. I will call this process: "send a string".

It's also possible to send about 10000 custom bytes to heap (it's possible to send a float, and I can send about 5000 before the dot, and about 5000 after the dot; I will call this process: "send a float"). Address of this float is different each time.

If I "send a string", I also can control 15 bytes before EIP in stack, but address of these bytes is different each time. I also can't control bytes AFTER new value for EIP in stack. But I see that first 1000+ bytes of this string overwrite data from "the float", that is before the dot. And this data will include data before new value of EIP, and new value of EIP, and data after new value of EIP.

If I send the float with 10000 bytes a couple of times, I see that bytes in heap are simply overwrited, so I can't do "heap spraying", as I understood. The final goal is to read a file. I'm able to create a shellcode, but I can't redirect the execution flow exactly to this shellcode.

Please provide me at least some ideas how to exploit this application.

PS. Solved. Found a hidden function in the file.

closed as unclear what you're asking by Tobi Nary, schroeder Feb 21 at 19:07

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.