1

I'm currently playing with buffer overflow and ROP-chains, and I'm facing a weird behavior that I don't know how to deal with.

I don't know why, but i cannot correctly push the address of my first ROP gadget into the stack.

With the specific binary that i am trying to exploit, I have to fill a 28 bytes buffer before overwriting the instruction pointer.

If I do the following test, everything seems in order:

gdb-peda$ run < <(python -c 'print("A"*28 + "BBBB")')
[...]
> Stopped reason: SIGSEGV
> 0x42424242 in ?? ()

My first gadget is at the address "0x0806ee6b".

But when I try the following test, there is a difference between my input and what's pushed on the stack:

gdb-peda$ run < <(python -c 'print("A"*28 + "\x6b\xee\x06\x08")')
[...]
> Stopped reason: SIGSEGV
> 0x06aec36b in ?? ()

If I take a look at the stack before the retn instruction that trigger the buffer-overflow, my little-indian formatted address is not the same anymore:

gdb-peda$ x/50x $esp
0xffffdaec: 0x06aec36b  0x00000008  0x0804f02b  0x080da000

If I try to push an arbitrary address, like "0x08064141", everything is ok:

gdb-peda$ run < <(python -c 'print("A"*28 + "\x41\x41\x06\x08")')
[...]
gdb-peda$ x/50x $esp
0xffffdaec: 0x08064141  0x00000000  0x0804f02b  0x080da000

I tried with some twists, to see how it goes, but the result is still the same. The "\xee" is always translated into "\xae\xc3" when pushed on the stack. And that's the same for some other specific address.

I really don't get it, I can push the address 0x08065e6b without any issue:

gdb-peda$ run < <(python -c 'print("A"*28 + "\x6b\x5e\x06\x08")')
[...]
gdb-peda$ x/10x $esp
0xffffdaec: 0x08065e6b  0x00000000  0x0804f02b  0x080da000

But not the address 0x0806ee6b:

gdb-peda$ run < <(python -c 'print("A"*28 + "\x6b\xee\x06\x08")')
[...]
gdb-peda$ x/10x $esp
0xffffdaec: 0x06aec36b  0x00000008  0x0804f02b  0x080da000

What am I missing here ?

1

By the looks of it, 0xee is a bad character if its getting truncated like that. What you should do first is look for bad characters and when youre done, you have an idea of what gadget you can and cannot use.

If that is THE only gadget, I would look into alternatives that do the same thing. So pop a random number into eax, add an offset and then eax will have what you want if its some type of call. Something of the like

|improve this answer|||||
  • Well, I tried to check for bad chars, and something stranger happened... It's a binary related to a past CTF, but the server are still online for a few time. When I check for bad characters in my local machine, I can generate a precise list (including the \xee byte). But on the remote server, those bad chars are not an issue, and I can push my previous problematic value "0x0806ee6b". The target binary is the same in my local machine and on the remote server. What can cause a difference between the binary behavior on my local system and on the remote one ? – Guillaume Oct 29 '19 at 8:35
  • 1
    @Guillaume might be a locale issue. Are you using a non-English locale? – Igor Skochinsky Oct 29 '19 at 10:44
  • @IgorSkochinsky My machine have indeed a non-English locale (fr_FR.UTF-8 UTF-8). The remote server is setup with the following locale configuration: en_US.UTF-8 UTF-8. I'll try to change mine in order to match the remote server locale, and see how it goes. – Guillaume Oct 29 '19 at 12:15
  • @IgorSkochinsky The result is the same, even after editing and re-generating my locale file. That's not where the issue come from – Guillaume Oct 29 '19 at 16:51
0

I can not comment yet, but the concern is probably a function that filters, or stops reading, each character. The problem can also come from how you send these data in remote.

|improve this answer|||||
  • The vulnerable function is a simple gets(), so the \xee byte should not be consider as a bad character. In remote, I use the exact same command than on my machine, through a SSH session. – Guillaume Oct 29 '19 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.