2

So this piece of code is vulnerable to format string vuln (I think) in the printf() function. It reads a file in /tmp/file so I've tried writing different modifier/strings in that file and see what happens but I got nothing interesting. When I write few lines containing %x %x %x %x %s I can see that sometimes the line break is not there and I get a line actually containing 2 lines.

I can also insert a \0 at the beginning of the line for example if I do \0 AAA and the same thing for b and c and then copy/paste this a few time the result is:

\0 AAAA
\0 bbbbb
\0cccccc\0 AAAA

The exploitation goal is to read some file in a protected directory but I have no idea how I would do that using this vulnerability. Any tips is welcome, thank you.

#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>

int main(int arc, char **argv)
{

    int fd;
    fd = open("/tmp/file",O_RDONLY);

    if (fd < 0)
    {
        printf("Cannot open file\n");
        exit(1);
    }

    int nb_lus;
    char line[20];
    while ((nb_lus = read(fd,line,20)) > 0)
    {
        line[nb_lus-1] = '\0';
        printf("%s",line);
    }

    close(fd);
    system("/bin/rm /tmp/file");
    return 0;

}

closed as off-topic by Iszi, TildalWave, Steffen Ullrich, Xander, Deer Hunter Nov 20 '15 at 8:32

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Iszi, TildalWave, Steffen Ullrich, Xander, Deer Hunter
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Comments are not for extended discussion; this conversation has been moved to chat. – Rory Alsop Nov 19 '15 at 21:44
  • Please give information about the security challenge where this is from. – Neil Smithline Nov 20 '15 at 3:58
1

As I understand, you control the input file /tmp/file and this piece of program is run with privileges to read a protected file. Your goal is to read the protected file.

I failed to see any issue in this code. The format string is not controlled by the input and the missing line feeds you saw was because the last char of every 20 bytes is being replaced with a \0 (which stops printf from reading beyond the buffer).

However, as @MikeOunsworth suggested, all you have to do is to make /tmp/file a symlink to the protected file and you'll get the contents (with every 20th byte replaced, of course).

Not the answer you're looking for? Browse other questions tagged or ask your own question.