Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses strcpy, so I cannot overwrite the $ra register with an address that contains null bytes (0x0040xxxx).
Any ideas how to overcome this issue?
Thanks
This is a classic badchars problem. So your goal is to make your final
exploit to NOT contain any of the bad characters. Encoding can help you achieve that.
A possible obvious solution to exploit this, is combining
ROP + encoding. For example you can create an encode() function, that uses e.g. XOR,
like the one below:
def encode(s, key):
return ''.join(chr(ord(i)^key) for i in s)
and then search for possible gadgets that help you create the decoding function (e.g. search for xor gadgets):
def decode(address, key):
"""
create a ROP-chain here
that XORs the XORed string
"""
# create the ROP chain...
return chain
and then in the main body of your exploit use something like this:
# ...skip...
# write_into_mem() is a just function that allows you to write into memory...
# write string (encoded/xored) into memory so you can avoid bad characters...
payload += write_into_mem(address, encode('string_with_bad_chars', key))
for i in range(len('string_with_bad_chars')):
payload += decode((address + i), key)
In this way you will avoid bad characters.
Note: The above code-snippets are in python. Use whatever language you prefer!!!
