I'm practicing Buffer Overflows using Free Float FTP Server 1.0 on Windows 7 SP 1. I have done simple jmp esp examples on Windows XP, where system DLLs are without rebase or Address Space Layout Randomization (ASLR).

I'm now trying to write a Buffer Overflow for Windows 7, where I haven't gotten any system DLL with rebase or ASLR disabled. I can still exploit it, but it won't survive reboot. As such, I'm very much left with opcode from the FTPServer.exe, but they all use low stack addresses (0x0040xxxx) and they all end with a NULL byte (e.g. 0xCE 11 40 00) and hence terminate my exploit.

What are the options now? Is there a workaround to the NULL bytes in the addresses I want to use? More specifically, I want to know whenever there is an option to use NULL bytes at the end of an address if it is listed as a bad character.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.