0

I'm learning on how to cause a buffer overflow. My victim program has to read input from a file encoded with UTF-16, 2-bytes by 2-bytes, and I want to overrun the EBP with an address like 0x0012F468. The 0xF468 part is read successfully but the program just ignores the 0x0012.

As I researched, I found out that not only 0x0012 but also the characters from 0x0000 to 0x001F, which are "control characters" are ignored as well.

My question is: How can I inject those characters as a input from a text file to my victim program?

2
  • 1
    Hi and welcome to RE.SE. You are aware that UTF-16 includes code points that are bigger than 2 bytes, right? It would also be interesting what OS this is and by which means your target program reads the input. Perhaps it's already prepared to take input from stdin by passing - as file name (a convention of many programs on unixoid platforms). In general you are not giving enough information to help you with a meaningful answer beyond guessing.
    – 0xC0000022L
    Oct 11 '19 at 10:18
  • I am testing on Windows XP SP3. My victim program reads input from a HTML file encoded using UTF-16 BE standard.
    – Thành Vũ
    Oct 12 '19 at 11:23
0

Unfortunately I'm still new around here and don't have enough reputation yet to comment so this will need to be an answer, hopefully it qualifies.

How are you reading and writing the file? Did you confirm that the file has the control characters embedded properly in a hex editor? You said earlier that your victim reads input from an HTML file, I assume by that you mean it actually reads the HTML file itself? Without knowing exactly how you're reading / writing it I can't be sure, but my guess would be that you're using a stream that filters out control characters appropriately. Something like the code below should work fine for your purposes.

void WriteTarget(const char* FilePath, uintptr_t TargetAddr)
{
    std::ofstream ofs(FilePath, std::ios::trunc | std::ios::binary);
    ofs.write(reinterpret_cast<const char*>(&TargetAddr), sizeof(uintptr_t));
    ofs.close();
}

void ReadTarget(const char* FilePath)
{
    std::ifstream ifs(FilePath, std::ios::in | std::ios::binary);

    ifs.seekg(0, std::ios::end);
    auto file_len = ifs.tellg();
    ifs.seekg(0, std::ios::beg);

    uint8_t* file_data = new uint8_t[file_len];
    memset(file_data, 0, file_len);

    ifs.read(reinterpret_cast<char*>(file_data), file_len);
    ifs.close();

    std::cout << "File Contents" << std::endl;

    for (auto i = 0; i < file_len; ++i)
        std::cout << "0x" << std::hex << std::uppercase << static_cast<uint32_t>(file_data[i]) << std::endl;

    delete[] file_data;
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.