4

I have the following scenario: printf is called with a 20 byte long string (19 characters + 0x00) which I control. The string cannot contain n, s, S and $.

My goal is to bypass a strcmp with a random value (either by using the exploit to read the random value or using it to alter that value)

This is what the stack looks before printf is called:

0xffffcf90: 0xffffcfb8 - this points to my input string
0xffffcf94: 0xffffd00c - this points to the bytes I have to guess
0xffffcf98: 0x00000001
0xffffcf9c: 0x00f0b6ff
0xffffcfa0: 0xffffcfde
0xffffcfa4: 0x00000001
0xffffcfa8: 0x000000c2
0xffffcfac: 0xffffd00c
0xffffcfb0: 0xffffcfde
0xffffcfb4: 0x00000013
0xffffcfb8: 0x61616161 - this is where my input string is located
0xffffcfbc: 0x61616161
0xffffcfc0: 0x61616161
0xffffcfc4: 0x61616161  
0xffffcfc8: 0x00616161 - end of input string    
0xffffcfcc: 0x594e1600
0xffffcfd0: 0x00000000
0xffffcfd4: 0xffffd074
0xffffcfd8: 0xffffd028
0xffffcfdc: 0x08048944
0xffffcfe0: 0xffffd00c
0xffffcfe4: 0x0000002f
0xffffcfe8: 0xf7e17dc8
0xffffcfec: 0xf7fbf000
0xffffcff0: 0x00008000
0xffffcff4: 0xf7fbb000
0xffffcff8: 0xf7fb9244
0xffffcffc: 0xffffd0d4
0xffffd000: 0x00000001
0xffffd004: 0x00000000
0xffffd008: 0x00000000
0xffffd00c: 0x5f526b6c - start of the bytes I have to guess
0xffffd010: 0xb5a551b9
0xffffd014: 0x29a9bfd5
0xffffd018: 0x00f8b9d0
0xffffd01c: 0x594e1600 - end of the bytes I have to guess
0xffffd020: 0xf7fbb3dc
0xffffd024: 0xffffd040  
0xffffd028: 0x00000000  
0xffffd02c: 0xf7e23637

Because 0xffffd00c is on the stack, %s would have easily solved my problem; however, I can't use %s or %S. I can't use $, so direct parameter access is out of the question. And I can't use %n so I can't override the string I have to guess to make it easier.

If I use use %p%p%p%p%p%p%p%p%p this will give me data between 0xffffcf94 and 0xffffcfb4

I tried %llu to get 64 bits, but my input only holds 19 characters.

From what I know about string formats, %s is the only one that treats the parameter as a pointer, giving me what's at the address represented by the value, not the value. %p just outputs the value as a pointer, giving me 0xFFFFFFFF instead of FFFFFFFF (as %x does)

This scenario is part of a wargame challenge and the string format exploit is one of the weaknesses found. I'm not 100% certain that this is the way to go so I'm asking if I'm missing anything when it comes to string format exploits (given the restrictions I have), before I explore other scenarios

Improve this question
3
  • how exactly does the strcmp look like? Are you given the source code or did you disassemble it and discover that you need to bypass it?
    – Paweł Łukasik
    Commented Dec 27, 2016 at 13:03
  • I have the source. It's something like strcmp(seed, buf); seed is the string I need to guess, buf is my input. As mentioned in the initial message, I'm just asking if I'm missing anything when it comes to string format exploits / printf format parameters. I want to solve it myself :)
    – Timo89
    Commented Dec 27, 2016 at 18:09
  • can't you somehow predict the next value being generated? how it is done? If string format is only one of the vulns I think it's always good to check other options.
    – Paweł Łukasik
    Commented Dec 28, 2016 at 10:46

1 Answer 1

Reset to default
1

Conversion specifiers - a, A, e, E, f, F, g, or G - for long double arguments can be used to get 64 bits at a time.

Basically, printf("%a") will get 64 bits from the stack and convert them to a Hexadecimal Floating-Point Constant.

More info about Hexadecimal Floating Point Constants - http://www.exploringbinary.com/hexadecimal-floating-point-constants/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .