0

I'm running into a challenge where I have control over the return address and the base pointer through my input, however the program null byte terminates and the addressing scheme only takes up 6 bytes. I'm using leave gadget to control the stack pointer and I'm looking for a gadget to null out the left two bytes. I do not control any other registers.

Current RBP/RSP: 0x11117fffffede0
Desired RBP/RSP: 0x00007fffffede0

Exploit Code:

'A'*50 + 'B'*50 + rbp + return

Any ideas? I'm not seeing any XOR gadgets or shift gadgets.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.