3

I am quite stuck with an assignment question, exploiting vulnerability (vfprintf) in sudo_debug function with ASLR (CVE: 2012-0809). I can only use string format exploits.
ONLY ASLR IS ENABLED < NO FORTIFY_SOURCE
I must overwrite the value of user_details.uid variable. I have been examining stack to find patterns or offsets to crack it, but could not find any. I am quite unsure how to proceed. What to do next?

3

You could start by reading the full description of CVE: 2012-0809 and then look for a poc. A brief introduction to format string exploitation is a good starting point.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.