buffer overflow in MIPS - jump to address 0x0040xxxx

Question

I'm trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses strcpy, so I cannot overwrite the $ra register with an address that contains null bytes (0x0040xxxx).

Any ideas how to overcome this issue?

Thanks

Answer 1

This is a classic badchars problem. So your goal is to make your final exploit to NOT contain any of the bad characters. Encoding can help you achieve that. A possible obvious solution to exploit this, is combining ROP + encoding. For example you can create an encode() function, that uses e.g. XOR, like the one below:

def encode(s, key):
    return ''.join(chr(ord(i)^key) for i in s)

and then search for possible gadgets that help you create the decoding function (e.g. search for xor gadgets):

def decode(address, key):
    """
    create a ROP-chain here 
    that XORs the XORed string
    """
    # create the ROP chain...
    return chain

and then in the main body of your exploit use something like this:

# ...skip...
# write_into_mem() is a just function that allows you to write into memory...
# write string (encoded/xored) into memory so you can avoid bad characters...
payload += write_into_mem(address,   encode('string_with_bad_chars', key))
for i in range(len('string_with_bad_chars')):
    payload += decode((address + i), key)

In this way you will avoid bad characters.

^{_{Note: The above code-snippets are in python. Use whatever language you prefer!!!}}