I'm starting to learn about buffer overflow, and I'm trying to change the contents of the return address to a specific location using gdb, but the problem is that the address starts with some zeros.

For example, I want to change the return address to: 0x0000555555554816. I tried to use Perl and passing this address as $(perl -e 'print "\x00\x00\x55\x55\x55\x55\x48\x16" x 10') but bash ignored the \x00 because this is the null byte.

Does anyone know other alternatives to work around this problem?

  • How is the vulnerable program called? If you are passing that as an argument, it will not work under bash. You could modify the program to accept input from stdin instead. – multithr3at3d Jul 6 '20 at 15:04
  • Also, assuming this is a little endian system, you are inputting the address backwards. – multithr3at3d Jul 7 '20 at 3:17

This is a very prevalent problem while exploiting 64bit programs. My guess on why this is happening is , your vulnerable program is using strcpy , any null byte you provide as payload will act as string delimiter and there by stopping anymore overflow. There is no one universal way of overcoming this.I usually like to go about this way:

  • Find ROP gadgets that would effectively change the value on the stack to the return address you want.
  • Make sure the ROP gadaget's addresses do not have null bytes.
  • If the first step is too hard , use ROP gadgets directly to execute a execve syscall.

That's the problem with hardcoding return adddresses in your payload - the controllable memory region would normally contain zeros due to the way memory management works. Given that null bytes ('\x00') are considered as string terminators, anything that comes after will be ignored.

A cleaner way is to find the address of an instruction in the vulnerable program's code that contains some kind of jump instruction to a memory location you are successfully overwriting with your buffer. In stack-based buffer overflows, you would likely need to find a JMP ESP instruction that would take the execution flow to the top of the stack, which would execute your shellcode. Therefore, you need to overwrite the return address with the memory address of any JMP ESP within the program's instruction set (this is assuming you are not dealing with ASLR protection).

  • This is not the particular problem, since the null bytes are not even reaching the program. And, this only applies to buffer overflows caused by string functions. – multithr3at3d Jul 7 '20 at 1:07

First of all, you are passing the bytes in wrong order. x64 CPUs are little endian, so you need to pass 16 48 55.. That places the zeroes on the right side of your string. You get one "free" null byte from the string terminating Null character, and depending on your situation the address you are overwriting probably has zeroes there anyway, so you are probably fine with just overwriting the least significant bytes.

There are so many tutorials on entry level buffer overflows out there (like any walkthrough for overthewire narnia). Working through any of them will answer a lot of questions.

Have fun!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.