1

I have a question,

I have a device that i can perform on it buffer overflow.

The problem is that is that there is an ASLR(on all addresses in /proc/binary/maps, but not on the binary itself, but all addresses in binary are starting with two null bytes for example 0x00002000) and there is as well as DEP(on heap an stack). I can override the return address(for the first gadget) but not possible to write additional addresses for ROP since all addresses from the binary starts with null bytes. I also can`t leak an address and it is not possible to perform brute force in order to guess addresses for example from libc. Does anyone have an idea how can perform the overflow in this case ?

Improve this question
8
  • 1
    I think your question could be improved with more detail via an edit. Is the binary's architecture x86? What function causes the overflow to occur (read, strcpy, memcpy), etc.? What type of application; does it fork for each attempt? The more detail you can add, the more likely it will be solved.
    – multithr3at3d
    May 22, 2020 at 13:19
  • 1
    Keep in mind on a little endian system, your address is sent as e.g. \x01\x20\x00\x00. If what you are overwriting already ends with two zeros, it may not matter that you can't send them. Although, this will only let you jump once, which may be enough depending on the stack/register setup (e.g. call system).
    – multithr3at3d
    May 22, 2020 at 13:24
  • Hi, This is an ARM( little endian). Yes it is strcpy(not using fork),I am able to overwrite the return address, but it is not enough for performing rop gadget. Do you have any idea ?
    – Logan
    May 22, 2020 at 15:32
  • 1
    Maybe you don't need to ROP though. Do you have control over data in any of the argument registers?
    – multithr3at3d
    May 22, 2020 at 17:24
  • Hi,The end of the function end with pop into r4-r7 and to pc. but the problem i can copy only one valid address contains null bytes , since the strcpy will stop copy once it sees null bytes
    – Logan
    May 23, 2020 at 18:09

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.