1

I'm trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses strcpy, so I cannot overwrite the $ra register with an address that contains null bytes (0x0040xxxx).

Any ideas how to overcome this issue?

Thanks

1
  • strcpy will write one \0 byte. Maybe that's enough? Other ideas: are heap or stack executable, and can you "heap spray" them - in other words, maybe there's more to this than written in the question.
    – domen
    Oct 5, 2020 at 7:57

1 Answer 1

0

This is a classic badchars problem. So your goal is to make your final exploit to NOT contain any of the bad characters. Encoding can help you achieve that. A possible obvious solution to exploit this, is combining ROP + encoding. For example you can create an encode() function, that uses e.g. XOR, like the one below:

def encode(s, key):
    return ''.join(chr(ord(i)^key) for i in s)

and then search for possible gadgets that help you create the decoding function (e.g. search for xor gadgets):

def decode(address, key):
    """
    create a ROP-chain here 
    that XORs the XORed string
    """
    # create the ROP chain...
    return chain

and then in the main body of your exploit use something like this:

# ...skip...
# write_into_mem() is a just function that allows you to write into memory...
# write string (encoded/xored) into memory so you can avoid bad characters...
payload += write_into_mem(address,   encode('string_with_bad_chars', key))
for i in range(len('string_with_bad_chars')):
    payload += decode((address + i), key)

In this way you will avoid bad characters.

Note: The above code-snippets are in python. Use whatever language you prefer!!!

2
  • Thanks for the response, but I'm not sure how useful it is. I can overwrite the return address register ($ra), but since ASLR in enabled I don't know the addresses of the libraries. The binary itself is loaded always at the same address, 0x00400000, but I can't overwrite with gadget frome the binary itself because of the leading 0x00 null byte. So my problem is to find valid location to jump to..
    – takadito15
    Sep 11, 2019 at 8:48
  • Heap spray or infoleak are the standard approaches to this then you can jump to a fixed address like 0x0c0c0c0c or calculate the base address from the infoleak and use that to calculate the correct gadget location
    – wireghoul
    Jan 28, 2022 at 4:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .