I have the following scenario: printf is called with a 20 byte long string (19 characters + 0x00) which I control. The string cannot contain n, s, S and $.
My goal is to bypass a strcmp with a random value (either by using the exploit to read the random value or using it to alter that value)
This is what the stack looks before printf is called:
0xffffcf90: 0xffffcfb8 - this points to my input string 0xffffcf94: 0xffffd00c - this points to the bytes I have to guess 0xffffcf98: 0x00000001 0xffffcf9c: 0x00f0b6ff 0xffffcfa0: 0xffffcfde 0xffffcfa4: 0x00000001 0xffffcfa8: 0x000000c2 0xffffcfac: 0xffffd00c 0xffffcfb0: 0xffffcfde 0xffffcfb4: 0x00000013 0xffffcfb8: 0x61616161 - this is where my input string is located 0xffffcfbc: 0x61616161 0xffffcfc0: 0x61616161 0xffffcfc4: 0x61616161 0xffffcfc8: 0x00616161 - end of input string 0xffffcfcc: 0x594e1600 0xffffcfd0: 0x00000000 0xffffcfd4: 0xffffd074 0xffffcfd8: 0xffffd028 0xffffcfdc: 0x08048944 0xffffcfe0: 0xffffd00c 0xffffcfe4: 0x0000002f 0xffffcfe8: 0xf7e17dc8 0xffffcfec: 0xf7fbf000 0xffffcff0: 0x00008000 0xffffcff4: 0xf7fbb000 0xffffcff8: 0xf7fb9244 0xffffcffc: 0xffffd0d4 0xffffd000: 0x00000001 0xffffd004: 0x00000000 0xffffd008: 0x00000000 0xffffd00c: 0x5f526b6c - start of the bytes I have to guess 0xffffd010: 0xb5a551b9 0xffffd014: 0x29a9bfd5 0xffffd018: 0x00f8b9d0 0xffffd01c: 0x594e1600 - end of the bytes I have to guess 0xffffd020: 0xf7fbb3dc 0xffffd024: 0xffffd040 0xffffd028: 0x00000000 0xffffd02c: 0xf7e23637
0xffffd00c is on the stack,
%s would have easily solved my problem; however, I can't use
%S. I can't use
$, so direct parameter access is out of the question. And I can't use
%n so I can't override the string I have to guess to make it easier.
If I use use
%p%p%p%p%p%p%p%p%p this will give me data between
%llu to get 64 bits, but my input only holds 19 characters.
From what I know about string formats,
%s is the only one that treats the parameter as a pointer, giving me what's at the address represented by the value, not the value.
%p just outputs the value as a pointer, giving me
0xFFFFFFFF instead of
This scenario is part of a wargame challenge and the string format exploit is one of the weaknesses found. I'm not 100% certain that this is the way to go so I'm asking if I'm missing anything when it comes to string format exploits (given the restrictions I have), before I explore other scenarios