Buffer overflow with zeros

Question

I'm starting to learn about buffer overflow, and I'm trying to change the contents of the return address to a specific location using gdb, but the problem is that the address starts with some zeros.

For example, I want to change the return address to: 0x0000555555554816. I tried to use Perl and passing this address as $(perl -e 'print "\x00\x00\x55\x55\x55\x55\x48\x16" x 10') but bash ignored the \x00 because this is the null byte.

Does anyone know other alternatives to work around this problem?

Answer 1

This is a very prevalent problem while exploiting 64bit programs. My guess on why this is happening is , your vulnerable program is using strcpy , any null byte you provide as payload will act as string delimiter and there by stopping anymore overflow. There is no one universal way of overcoming this.I usually like to go about this way:

• Find ROP gadgets that would effectively change the value on the stack to the return address you want.
• Make sure the ROP gadaget's addresses do not have null bytes.
• If the first step is too hard , use ROP gadgets directly to execute a execve syscall.

Answer 2

First of all, you are passing the bytes in wrong order. x64 CPUs are little endian, so you need to pass 16 48 55.. That places the zeroes on the right side of your string. You get one "free" null byte from the string terminating Null character, and depending on your situation the address you are overwriting probably has zeroes there anyway, so you are probably fine with just overwriting the least significant bytes.

There are so many tutorials on entry level buffer overflows out there (like any walkthrough for overthewire narnia). Working through any of them will answer a lot of questions.

Have fun!

Answer 3

That's the problem with hardcoding return adddresses in your payload - the controllable memory region would normally contain zeros due to the way memory management works. Given that null bytes ('\x00') are considered as string terminators, anything that comes after will be ignored.

A cleaner way is to find the address of an instruction in the vulnerable program's code that contains some kind of jump instruction to a memory location you are successfully overwriting with your buffer. In stack-based buffer overflows, you would likely need to find a JMP ESP instruction that would take the execution flow to the top of the stack, which would execute your shellcode. Therefore, you need to overwrite the return address with the memory address of any JMP ESP within the program's instruction set (this is assuming you are not dealing with ASLR protection).