1

I'm trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses strcpy, so I cannot overwrite the $ra register with an address that contains null bytes (0x0040xxxx).

Any ideas how to overcome this issue?

Thanks

1
  • strcpy will write one \0 byte. Maybe that's enough? Other ideas: are heap or stack executable, and can you "heap spray" them - in other words, maybe there's more to this than written in the question.
    – domen
    Oct 5, 2020 at 7:57

1 Answer 1

0

This is a classic badchars problem. So your goal is to make your final exploit to NOT contain any of the bad characters. Encoding can help you achieve that. A possible obvious solution to exploit this, is combining ROP + encoding. For example you can create an encode() function, that uses e.g. XOR, like the one below:

def encode(s, key):
    return ''.join(chr(ord(i)^key) for i in s)

and then search for possible gadgets that help you create the decoding function (e.g. search for xor gadgets):

def decode(address, key):
    """
    create a ROP-chain here 
    that XORs the XORed string
    """
    # create the ROP chain...
    return chain

and then in the main body of your exploit use something like this:

# ...skip...
# write_into_mem() is a just function that allows you to write into memory...
# write string (encoded/xored) into memory so you can avoid bad characters...
payload += write_into_mem(address,   encode('string_with_bad_chars', key))
for i in range(len('string_with_bad_chars')):
    payload += decode((address + i), key)

In this way you will avoid bad characters.

Note: The above code-snippets are in python. Use whatever language you prefer!!!

2
  • Thanks for the response, but I'm not sure how useful it is. I can overwrite the return address register ($ra), but since ASLR in enabled I don't know the addresses of the libraries. The binary itself is loaded always at the same address, 0x00400000, but I can't overwrite with gadget frome the binary itself because of the leading 0x00 null byte. So my problem is to find valid location to jump to..
    – takadito15
    Sep 11, 2019 at 8:48
  • Heap spray or infoleak are the standard approaches to this then you can jump to a fixed address like 0x0c0c0c0c or calculate the base address from the infoleak and use that to calculate the correct gadget location
    – wireghoul
    Jan 28, 2022 at 4:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.