In Buffer overflow exploitation what if JMP ESP address contains bad characters?

Question

I was writing an exploit for BOF. The server accepts only ASCII payloads. FInally I wnted to jump to my shellcode which is clearly in the stack. But only one module is available without ASLR and DEP which has address starting from 56566577. I got JUMP ESP, suppose in 5757578E, this doesn't work. Becuase the 0x8E outside the scope of ASCII 0x00 to 0x7F. Consider no other register has the shellcode. How can I deal with certain situations?

To create ASCII shellcode I use below:

msfvenom -p windows/shell_bind_tcp -a x86 -f perl --platform windows LHOST=192.168.1.1 LPORT=8181 -b "\x00" EXITFUNC=seh -e x86/alpha_upper

But this also has character above 0x7F. How can I generate shellcode within 0x00 - 0x7F.

Answer 1

Find a different pivot, such as call esp or pop eax; call eax; maybe a blind ret will work. There are several other alternatives to jmp esp, you just have to find one that works for you.

If you control a value in any of the other registers you can usually find a gagdet that will call the registry at an offset f.ex: call [eax+0x16]; and adjust the value in said register to point to jmp esp with the offset applied.