This is a classic badchars problem. So your goal is to make your final
exploit to NOT contain any of the bad characters. Encoding can help you achieve that.
A possible obvious solution to exploit this, is combining
ROP + encoding. For example you can create an encode()
function, that uses e.g. XOR,
like the one below:
def encode(s, key):
return ''.join(chr(ord(i)^key) for i in s)
and then search for possible gadgets that help you create the
decoding function (e.g. search for xor gadgets):
def decode(address, key):
"""
create a ROP-chain here
that XORs the XORed string
"""
# create the ROP chain...
return chain
and then in the main body of your exploit
use something like this:
# ...skip...
# write_into_mem() is a just function that allows you to write into memory...
# write string (encoded/xored) into memory so you can avoid bad characters...
payload += write_into_mem(address, encode('string_with_bad_chars', key))
for i in range(len('string_with_bad_chars')):
payload += decode((address + i), key)
In this way you will avoid bad characters.
Note: The above code-snippets are in python. Use whatever language you prefer!!!
strcpy
will write one\0
byte. Maybe that's enough? Other ideas: are heap or stack executable, and can you "heap spray" them - in other words, maybe there's more to this than written in the question.