Disclaimer: this exploit is purely for educational use. In this exploit I play the role of the victim and the software exploited is written by me alone.
I have a simple HTTP server that I want to exploit with a buffer overflow attack. I am sending a maliciously crafted HTTP request that overflows the buffer of a request variable via the strcpy function - the scenario being that the developer forgot to use strncpy.
However, there are two challenges with overwriting the return address in this program that I don't know how to solve:
Strcpy will stop copying when it encounters a NULL byte in the source string. Therefore, is it possible to overwrite the return address with a target address that contains the NULL byte 0x00? For example, if the target address is 0x407200, we must write \x00\x72\x40. However, strcpy will return upon the first \x00, and will not copy the \x72\x40. Therefore, is it possible to encode \x00 such that it does not cause strcpy to return prematurely?
Likewise, the HTTP parser in my HTTP server splits the HTTP request into tokens with the space character \x20 as the delimiter. Therefore, is it possible to escape this character, like the NULL terminator above, such that an address that contains \x20 does not get split into two seperate tokens by strtok?
If not, is this just a limitation of buffer overflow attacks, in that, due to the construction of the program in question it is not always possible to overwrite the return address with a target address of your choice?