We have a program that is vulnerable to a one byte frame pointer overwrite. The stack is marked executable, the Linux machine has aslr disabled, stack cookies are disabled, and it's a little endian standard x86.
We may run:
buf[256];
for(int i=0; i <=256; i++)
buf[i] = argv[1][i];
However, I want to put my shellcode into buf
and then jump to it. If I would use a normal stack overflow, I could get exploit reliability by going to a loaded library which has the jmp $esp
instruction somewhere encoded, and then put my shellcode where the function arguments are and so forth. But this is not possible here.
So what do you do if it's a remote process (you can't hardcode the address values) and need exploit reliability? The only thing that came to mind is stack alignment where we could be able to predict the low bits (2 or 3 bits maybe?).
I just need to know the low byte of the frame pointer so I can overwrite it with a little smaller value control eip to point to jmp esp and at the instruction at esp would be like a short jump -0x80 or something such as that.
I have decreased the frame pointer => ret gets executed => control eip => point eip to jmp esp instruction => next instruction is the short jump -0xsomevalue execution => payload gets executed.
I thought about other heuristics like writing the pointer to jmp esp over and over into the buffer so that it's more likely to get control of eip, but that way my method of jmp -0xsomevalue wouldn't work anymore.