1

I have recently discovered a Buffer Overflow vulnerability that leads to Remote Code Execution. However, due to the structure of the application assessed, a lot of so-called 'bad chars' came up. The list is as follows:

\x00\x0a\x1a\x0d\x22\x2f\x2a\x26\x2e\x3a\x5c\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a

It basically eliminated the whole uppercase alphabet A-Z, since the application turns these letters to lowercase.

The question is, is exploitation still possible in such a case? If so, what are the methods to achieve it?

Improve this question
1
  • 2
    I'm not quite clear what you are asking. Is your list a list of the characters used in the exploit? A list of characters that show up as a result of the exploit? Is this an attackers attempt to evade a WAF? Why not just fix the overflow vulnerability? Also, I don't think anyone can tell you whether or not it is still exploitable without knowing more about the code in question.
    – Conor Mancone
    Commented Mar 18, 2020 at 14:47

1 Answer 1

Reset to default
1

It's impossible to tell whether this specific case is exploitable, but the answer is usually yes. Generating exploit code that avoids certain bad characters is a well-known problem with mature solutions. The exploit payload generator in Metasploit includes an encoding step which takes care of this: you tell it what characters to avoid and it builds a decoder that avoids these characters. You can try it out for yourself.

If you're new to this, keep in mind that just because you don't manage to build an exploit doesn't mean that there isn't one. A good black hatter can often find solutions even where Metasploit gives up.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .