A simple Format String exploit example - bin 0x11
Why Stack Overflow recommends it
Stack Overflow users link it as a worked demonstration of how printf format string exploits read the stack with %x and overwrite memory with %n, both when explaining the concept and when trying to reproduce it.
Recommended by 0 people across 0 different months, 2018 to 2021.
What it is
LiveOverflow walks through solving the format1 challenge from exploit-exercises (Protostar) using a printf format string vulnerability. He explains how format strings work, leaks stack values with %x, and uses %n to write a value to a target variable in memory.
What people said
Cites Cole the questioner · 2018-09 · Stack Overflow · on “printf string exploit returning unexpected hex”
I'm just starting to get into reverse engineering and I came across a video by live overflow showcasing string format exploits using printf. I tried to reproduce his results but with no luck. My code is the same as in his video. I used radare2 to find the address of my target variable. video: [this video] radare2 output: radare2 command prompt output [LINK] myCode: #include <iostream> using namespace std; int overwritten; void vuln(char *sdf) { printf("typed stuff! -> "); printf(sdf); if(overwritten) { printf("\nyou overwrote the var!"); } } int main(int argc, char *argv[]) { vuln(argv[1]); } The part I'm having trouble with is at 7:54 in his video. He runs the program with a python script printi
Cites John Pence · 2018-10 · Stack Overflow · on “How do paddings in format string of C/C++ get stored in virtual memory of Linux?”
Also in another video : [this video] @7:10 we can see that the format string of printf had 200*%x in it and all of them are stored on the stack as you can see in the video( he can see the values of stack by using printf because of format string exploit which leaks stack values)
Cites FalcoGer · 2021-01 · Stack Overflow · on “How to exploit a C-style variadic function in C++?”
If you mean a format string exploit to run arbitary code it works as such: printf allows you to give a format string not matching the argument counts. In such a case variables are pulled off the stack. A function call (like printf) is done by putting all the function's arguments onto the stack, roughly like this: (low addresses) ^^^^^^ stack growth direction ^^^^^^ ---------printf-stack------------ printf function arguments stack base pointer of caller return address for when printf() ends ---------printf-stack------------ <-- stack base pointer register (cpu) ---------caller-stack------------ stack variables (int a = 5, char cstr[500] = "hello world!", etc) caller function arguments stack b