3

I'm working on a simple arc injection exploit, wherein this particular string gives me the desired address of the place where I'd like to jump: Á^F@^@. This is the address 0x004006c1 (I'm using a 64 bit Intel processor, so x86-64 with little endian arrangement).

When I provide this string Á^F@^@ as input to a vulnerable gets() routine in my function and inspect the addresses using gdb, the address gets modified to 0x00400681 instead of 0x004006c1. I'm not quite sure as to why this is happening. Furthermore, is there any way to easily provide hexadecimal values to a gets routine at stdin? I've tried doing something like: 121351...12312\xc1\x06\x40\x00, but instead of picking up \xc1 as it is, it translates individual character to hex, so I get something like 5c78.. (hex for \ and x, followed by hex for c and 1).

Any help is appreciated, thanks!

user2841250
  • 143
  • 1
  • 5
  • This seems to be a character encoding issue: Á is U+00C1 -- a Unicode value. However, your locale settings seem to suggest that it gets translated to UTF-8 as `\xC3\x81`, except for some reason the `\xC3` byte is dropped or swapped(?), or to GB 18030 as `\x81\x30\x86\x39`, in which case you'd see more if you printed more. It was just a quick Python encoding test, but UTF-8 and GB 18030 are the only ones that even have a byte sequence containing `\x81`. Personally, I'd go with the suggestion to just redirect `stdin` from a file to prevent encoding issues with character input like this. –  Mar 08 '15 at 12:16

1 Answers1

3

You could just put the raw bytes into a file somewhere and pipe it directly into your application.

$ path/to/my_app <raw_binary_data

Alternatively, you could wrap the application in a shell script that converts escaped hex bytes into their corresponding byte values. The echo utility will do this when the -e switch is set on the command line, for example:

$ echo '\x48\x65\x6c\x6c\x6f'
\x48\x65\x6c\x6c\x6f
$ echo -e '\x48\x65\x6c\x6c\x6f'
Hello

You can use this feature to process your application's input as follows:

while read -r line; do echo -e $line; done | path/to/my_app

To terminate the input, try pressing ControlD or ControlC.

r3mainer
  • 23,981
  • 3
  • 51
  • 88