0

Using a buffer overflow, I have been able to override return addresses. But the problem is that Windows addresses contain zeros at the beginning (e.g. 0x00401020). As a result, the objdump of any C binary will contain zero's. This makes it very difficult to execute shellcode inside a buffer as a shellcode cannot contain zero's for it to work.

Has anyone done this sort of thing? It does not matter even if the exploit is printing hello-world: is it possible?

2
  • Isn't Objdump a *nix utility? What happens if you used a Windows-specific debugger?
    – schroeder
    May 28, 2014 at 15:28
  • It might there on *nix as well but I have used it on windows as well. The issue is not related to debugger whether it is Windbg or Immunity Debugger.
    – Noname
    May 28, 2014 at 16:36

2 Answers 2

0

You should be able to remove the leading zeros, as 0x00401020 = 0x401020.

3
  • 1
    nopes , this does not work. the shell code fails if you simply remove zero's.
    – Noname
    May 28, 2014 at 14:05
  • Does it fail because of the missing zeros, or does it fail because removing the zeros change the size of the shellcode?
    – Corneliux
    May 28, 2014 at 14:21
  • 1
    Yes the size of shellcode changes as well as the 00's are replaced by next two digits/characters. This changes the shell code and renders it useless.
    – Noname
    May 28, 2014 at 16:44
0

Why not just shrink the shellcode to omit the most significant bytes? Almost all Windows-based machines (I think literally all current NT platforms) are little-endian, so the most significant byte (the 0x00) is at the end. If all you need to do is overwrite the return address, there's no need to write anything past the first few bytes of it.

Alternatively, find a library or ROP gadget mapped about 0x01000000. Some programs might not have any, if they're really tiny (and ASLR is turned off, as it seems to be here) since Windows likes to pack its system libraries as close to 0x00400000 as possible, but 0x01000000 is only 12 MiB above 0x00400000 so any program that is itself very large, or includes a lot of libraries (or just one big library), will have addresses above that point.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.