Disclaimer: this exploit is purely for educational use. In this exploit I play the role of the victim and the software exploited is written by me alone.
I have a simple HTTP server that I want to exploit with a buffer overflow attack. I am sending a maliciously crafted HTTP request that overflows the buffer of a request variable via the strcpy
function - the scenario being that the developer forgot to use strncpy
.
However, there are two challenges with overwriting the return address in this program that I don't know how to solve:
strcpy
will stop copying when it encounters aNULL byte
in the source string. Therefore, is it possible to overwrite the return address with a target address that contains theNULL byte 0x00
? For example, if the target address is0x407200
, we must write\x00\x72\x40
. However,strcpy
will return upon the first\x00
, and will not copy the\x72\x40
. Therefore, is it possible to encode\x00
such that it does not causestrcpy
to return prematurely?Likewise, the HTTP parser in my HTTP server splits the HTTP request into tokens with the space character
\x20
as the delimiter. Therefore, is it possible to escape this character, like theNULL
terminator above, such that an address that contains\x20
does not get split into two seperate tokens by strtok?
If not, is this just a limitation of buffer overflow attacks, in that, due to the construction of the program in question it is not always possible to overwrite the return address with a target address of your choice?