How to store null bytes into memory address with strcpy

0

For a security course in university I need to execute a shell via a data only vulnerability.

The c code contains a strcpy() statement, so I can overwrite a struct with the memory address of a certain buffer. Let's say this buffer is allocated at 0xbfffecfc

I need to enter the value 1 (0x00000001) at this buffer address via the command line. This happens via the strcpy() function which writes directly to 0xbfffecfc

I already tried python -c 'print "\x01\x00\x00\x00" But this does not work, because the \x00 byte terminates the input.

How can I get this value of one into the buffer?

c
shell
security
command-line
asked on Stack Overflow Nov 17, 2020 by Jan D.M.

1 Answer

1

strcpy is for copying strings, which are sequences of characters whose end is marked with a null character. Therefore, it cannot copy beyond the first null character.

memcpy is for copying sequences of bytes of arbitrary length.

To copy "\0x01\0x00\0x00\0x00", which represents a four-byte 1 with little-endian byte order, use memcpy(destination, "\0x01\0x00\0x00\0x00", 4);.

To copy an int with value 1 in the native representation, use memcpy(destination, (int []) { 1 }, sizeof 1);.

answered on Stack Overflow Nov 17, 2020 by Eric Postpischil

User contributions licensed under CC BY-SA 3.0