CODEWITHSUNDEEP
securityassemblybuffer-overflowexploitshellcode
Tommy95
Tommy95

Reputation: 193

How to deal with a bad char in a shellcode buffer overflow?

So I got recently interested in buffer overflow and many tutorials and recourses online have this CTF like attack where you need to read the content of a flag file (using cat for example).

So I started looking online for assembly examples of how to do this and I came accross sites like this or shell-storm where there are plenty of examples on how to do this.

So I generated my exploit and got this machine code (it basically executes a shell doing cat flag):

shellcode = b'\x31\xc0\x50\x68\x2f\x63\x61\x74\x68\x2f\x62\x69\x6e\x89\xe3\x50\x68\x66\x6c\x61\x67\x89\xe1\x50\x51\x53\x89\xe1\x31\xc0\x83\xc0\x0b\xcd\x80'

The problem is that, thanks to stepping in with GDB to debug the problem, I noticed that my buffer doesn't get copied starting with \x0b towards the end of the shell code. I know the problem is there because if I change it to say \x3b then it works (with the rest of my exploits not copied here) even if it obviously crashes when it reaches the wrong value there but at least the whole buffer gets copied. Now doing some research it seems like \x0b is a "bad char" which can cause issues and should be avoided. Having said this I don't understand how:

I will add that I am on Ubuntu and trying to make this work on 64 bits.

Upvotes: 1

Views: 4300

Answers (2)

Nate Eldredge
Nate Eldredge

Reputation: 58825

One thing that's special about byte 0x0b is it's ASCII Vertical Tab, which is considered a whitespace character.

So I'm going to make a wild guess that the code you're exploiting looks something like

// Dangerous code, DO NOT USE
char buf[TOO_SMALL];
scanf("%s", buf);

since scanf("%s") is a commonly (mis)used input mechanism that stops when it hits whitespace. If so, then if your shellcode contains 0x0b or any other whitespace character, it will get truncated.

To your first question, as to "why do other tutorials use shellcode like this", they may be thinking instead of exploiting code like

// Dangerous code, DO NOT USE
char buf[TOO_SMALL];
gets(buf);

where gets() will not stop reading at 0x0b but only at newline 0x0a. Or maybe they are thinking of a buffer filled by strcpy() which will only stop at 0x00, or maybe a buffer filled by read() with a user-controlled size which will read the full amount of data no matter what bytes it contains. So the question of which characters are "bad" depends on what the vulnerable code actually does.

As to how to handle it, well, you need to modify your shellcode to use only instructions that don't contain any whitespace bytes. This sort of thing is more an art than a science; you have to know your instruction set well, and be creative in thinking about alternative instruction sequences to achieve the desired result. Sometimes you may be able to do it with minor tweaks; other times a wholesale rewrite may be needed. It really varies.

In this case, luckily the 0x0b is the only whitespace character in the whole code, and it appears in the instruction

83C00B  add eax, 0x0b

Since eax was previously zeroed, the goal is to load it with the value 0xb which is the system call number of execve. When the "bad byte" appears as part of immediate data, it is usually not too hard to find another way to get that data to where it needs to go. (Life is harder when the bad byte is part of the opcode itself.) In this case, a simple solution is to take advantage of two's complement, and write instead

83E8F5  sub eax, -0x0b

The single byte -0x0b = 0xf5 gets sign-extended to 32 bits and used as the value to subtract, which leaves 0x0b in eax as desired. Of course there are lots of other ways, some of which may have smaller code size; I'll leave this to your ingenuity.

Upvotes: 2

TIAOWANG
TIAOWANG

Reputation: 82

To find out the "bad char" for the shellcode is an important step to exploit an overflow vulneribility.

first, you have to figure out how many bits the target can be overflow (this field is also for the shellcode). if this zone is big enough and you can use all the "char"(google bad char from \x01 to \xff. \x00 is bad char) to act as shellcode send to target.

Then you can get find the Register to see what the char left.(if the zone is not big enough for all the chars you can send just some chars one time and repeat)

you can follow this https://netsec.ws/?p=180.

Upvotes: 0

Related Questions