How can a buffer overflow exploit be implemented?

Question

linux

An interesting question has arisen. Read the tutorial on exploits. The fact is that the book is old and all manipulations there are carried out with a 32-bit architecture. The following exploit structure is used:
NOP chain - Payload (shellcode) - repeated return address.
Actually, in the 32-bit architecture, in those areas of memory into which the program is loaded, there are no zero bytes in the address (for example, 0x9f5b667d), the exploit code can be easily passed to the program through the program arguments. When a 64-bit architecture is used, then 2 zero bytes appear in the addresses and when they are entered into the program arguments, bash ignores them. This results in the problem that not what is needed is written to the return address. Example: the required return address is 0x0000ffffff5a673a, and the following is written to the stack area that stores the return address: 0xffffff5a673affff.
It turns out that you cannot use a repeating return address, but you need to accurately calculate the distance from the beginning of the buffer to the return address area, but this is not always possible, because it is not always possible to use a debugger when creating an exploit. Are there any alternatives here?

[[email protected] exploits]# ./buffer_overflow.bin $(perl -e 'print "\x5a\x6b\x38\x98\xff\xff\x00\x00"')
-bash: предупреждение: подстановка команды: во входных данных проигнорирован нулевой байт

Answer 1

Try writing the shellcode to a file beforehand and pass the contents of the file to the sample as input. I think this is the easiest way.