4

I have the following scenario: printf is called with a 20 byte long string (19 characters + 0x00) which I control. The string cannot contain n, s, S and $.

My goal is to bypass a strcmp with a random value (either by using the exploit to read the random value or using it to alter that value)

This is what the stack looks before printf is called:

0xffffcf90: 0xffffcfb8 - this points to my input string
0xffffcf94: 0xffffd00c - this points to the bytes I have to guess
0xffffcf98: 0x00000001
0xffffcf9c: 0x00f0b6ff
0xffffcfa0: 0xffffcfde
0xffffcfa4: 0x00000001
0xffffcfa8: 0x000000c2
0xffffcfac: 0xffffd00c
0xffffcfb0: 0xffffcfde
0xffffcfb4: 0x00000013
0xffffcfb8: 0x61616161 - this is where my input string is located
0xffffcfbc: 0x61616161
0xffffcfc0: 0x61616161
0xffffcfc4: 0x61616161  
0xffffcfc8: 0x00616161 - end of input string    
0xffffcfcc: 0x594e1600
0xffffcfd0: 0x00000000
0xffffcfd4: 0xffffd074
0xffffcfd8: 0xffffd028
0xffffcfdc: 0x08048944
0xffffcfe0: 0xffffd00c
0xffffcfe4: 0x0000002f
0xffffcfe8: 0xf7e17dc8
0xffffcfec: 0xf7fbf000
0xffffcff0: 0x00008000
0xffffcff4: 0xf7fbb000
0xffffcff8: 0xf7fb9244
0xffffcffc: 0xffffd0d4
0xffffd000: 0x00000001
0xffffd004: 0x00000000
0xffffd008: 0x00000000
0xffffd00c: 0x5f526b6c - start of the bytes I have to guess
0xffffd010: 0xb5a551b9
0xffffd014: 0x29a9bfd5
0xffffd018: 0x00f8b9d0
0xffffd01c: 0x594e1600 - end of the bytes I have to guess
0xffffd020: 0xf7fbb3dc
0xffffd024: 0xffffd040  
0xffffd028: 0x00000000  
0xffffd02c: 0xf7e23637

Because 0xffffd00c is on the stack, %s would have easily solved my problem; however, I can't use %s or %S. I can't use $, so direct parameter access is out of the question. And I can't use %n so I can't override the string I have to guess to make it easier.

If I use use %p%p%p%p%p%p%p%p%p this will give me data between 0xffffcf94 and 0xffffcfb4

I tried %llu to get 64 bits, but my input only holds 19 characters.

From what I know about string formats, %s is the only one that treats the parameter as a pointer, giving me what's at the address represented by the value, not the value. %p just outputs the value as a pointer, giving me 0xFFFFFFFF instead of FFFFFFFF (as %x does)

This scenario is part of a wargame challenge and the string format exploit is one of the weaknesses found. I'm not 100% certain that this is the way to go so I'm asking if I'm missing anything when it comes to string format exploits (given the restrictions I have), before I explore other scenarios

  • how exactly does the strcmp look like? Are you given the source code or did you disassemble it and discover that you need to bypass it? – Paweł Łukasik Dec 27 '16 at 13:03
  • I have the source. It's something like strcmp(seed, buf); seed is the string I need to guess, buf is my input. As mentioned in the initial message, I'm just asking if I'm missing anything when it comes to string format exploits / printf format parameters. I want to solve it myself :) – Timo89 Dec 27 '16 at 18:09
  • can't you somehow predict the next value being generated? how it is done? If string format is only one of the vulns I think it's always good to check other options. – Paweł Łukasik Dec 28 '16 at 10:46
1

Conversion specifiers - a, A, e, E, f, F, g, or G - for long double arguments can be used to get 64 bits at a time.

Basically, printf("%a") will get 64 bits from the stack and convert them to a Hexadecimal Floating-Point Constant.

More info about Hexadecimal Floating Point Constants - http://www.exploringbinary.com/hexadecimal-floating-point-constants/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.