0

i am trying to exploit a buffer overflow vulnerability in ubuntu (kernel version 3.0.0-12 generic i686) by using the method return to libc and the stack is not exploiting ?

By while exploiting i figured out that the address of system call and exit call is of size 3 byte due to which i think i am not able to exploit the stack in the proper way.. can anyone one help out how can i figure out this?? should i add a 0x00 in address

closed as unclear what you're asking by Anders, Steve, Xander, Rory Alsop May 8 '17 at 21:58

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

1

I'm not sure what you mean with the "address is 3 bytes" (unless you're on a 24bit system?) :) The memory addresses are probably 32 bit (4 bytes), but the addresses have probably a null byte in them, so you want a way to introduce a null byte in your shellcode.

What you can do, is a bit-shift on a register. This will - as the name implies- shift the bits to a direction that you want; right in this case, and fill up with zeroes. (0x11223344 -> 0x00112233)

The following code will make EAX into 0x00112233

05 44 33 22 11    add    $0x11223344,%eax
c1 e8 08          shr    $0x8,%eax

And as you can see in the hex codes, there's no null byte introduced in the shellcode.

Alternatively, you can work with lower registers (ax, al, ...) and rotate all the bits around. Of you can calculate the inverse value using a bitwise NOT, for example: 0xffedcba9 is the bitwise NOT value of 0x00123456. Or you could XOR 2 values to get to your address.

Not the answer you're looking for? Browse other questions tagged or ask your own question.