I am doing a bit off research on exploiting mips embedded applications and I am in a situation where I am able to trigger a buffer overflow, effectively being able redirect execution to any location in memory. There are restrictions however; the memory address I return to and any shellcode I use has to be UTF-8 compatible. This is because the payload has to be stored in an ID3 tag (metadata of an mp3 file).

Since this is mips, I have not come across any encoders that can support creating UTF-8 or alphanumeric shellcode. I am now wondering if this is the case because writing an encoder or shellcode for this architecture is not feasible?

  • Why not encode (most) of the shellcode in other parts of the mp3 file? say exploit using the ID3 tab but jump to data in the mp3 media stream? – NirIzr Apr 26 '17 at 9:31
  • In my case, only the metadata of the file is parsed and by the time the vulnerability is triggered the file is closed. However, I haven't explored if there are parts of the mp3 file that are in memory at the time the vulnerability is triggered which I could use that do not have UTF-8 restriction. Thanks for the hint. – Masande Apr 26 '17 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.