1

I'm trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses strcpy, so I cannot overwrite the $ra register with an address that contains null bytes (0x0040xxxx).

Any ideas how to overcome this issue?

Thanks

0

This is a classic badchars problem. So your goal is to make your final exploit to NOT contain any of the bad characters. Encoding can help you achieve that. A possible obvious solution to exploit this, is combining ROP + encoding. For example you can create an encode() function, that uses e.g. XOR, like the one below:

def encode(s, key):
    return ''.join(chr(ord(i)^key) for i in s)

and then search for possible gadgets that help you create the decoding function (e.g. search for xor gadgets):

def decode(address, key):
    """
    create a ROP-chain here 
    that XORs the XORed string
    """
    # create the ROP chain...
    return chain

and then in the main body of your exploit use something like this:

# ...skip...
# write_into_mem() is a just function that allows you to write into memory...
# write string (encoded/xored) into memory so you can avoid bad characters...
payload += write_into_mem(address,   encode('string_with_bad_chars', key))
for i in range(len('string_with_bad_chars')):
    payload += decode((address + i), key)

In this way you will avoid bad characters.

Note: The above code-snippets are in python. Use whatever language you prefer!!!

| improve this answer | |
  • Thanks for the response, but I'm not sure how useful it is. I can overwrite the return address register ($ra), but since ASLR in enabled I don't know the addresses of the libraries. The binary itself is loaded always at the same address, 0x00400000, but I can't overwrite with gadget frome the binary itself because of the leading 0x00 null byte. So my problem is to find valid location to jump to.. – takadito15 Sep 11 '19 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.