I'm running into a challenge where I have control over the return address and the base pointer through my input, however the program null byte terminates and the addressing scheme only takes up 6 bytes. I'm using leave gadget to control the stack pointer and I'm looking for a gadget to null out the left two bytes. I do not control any other registers.

Current RBP/RSP: 0x11117fffffede0
Desired RBP/RSP: 0x00007fffffede0

Exploit Code:

'A'*50 + 'B'*50 + rbp + return

Any ideas? I'm not seeing any XOR gadgets or shift gadgets.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.