I am currently exploring format string attacks. However, the buffer in this example is not located on stack but on heap, so the most common approach does not work and my options of addresses I can overwrite seem to be limited. Assume I need to write on 0x18 but nearest the address I can use with %n is 0x10. Is it possible to set up a format string which will allow me to fill the memory until I reach the right location and then write an arbitrary value?

Compiler used is GCC 5 on Debian OS x86-64.

  • Why wouldn't you be able to write to 0x18? – noone392 Jan 27 '18 at 0:50
  • I should have been clearer in what I am able to change in the program to reach my goal. It's all about format string attacks, so everything I can influence is the input via stdin. The source code includes an unsafe format string which I have to make use of. I have only a few stack addresses available to write an arbitrary value to using %n, but my target address is not on stack. However, the address target-8 is on stack. Can I use %n on target-8 with a large enough value to change target? – Calyx Jan 27 '18 at 8:41
  • Someone can correct me if im wrong, but if you target address is on the stack, you would get a stack overflow from most OS's if it was so big it would extend to the heap. I think we need more info because if your writable address is on the stack at target -8 then I don't think compiling code with gcc will result in target being on the heap – noone392 Jan 28 '18 at 16:34

assuming what you mean is that you want to write in the middle of your 64 bit address, because your on a 64 bit system you could just create 8 byte array and add them to an unsigned long long kind of in sudo code:

//get the pointer to the nearast address
unsigned long long * datapointer = 0x18;
//get all the data from the smallest adressible chunk for your system, in this case 64 bits
unsigned long long data = &(datapointer);
//some values of individual bytes you want to override
uchar a = 0x23;
ucahr b = 0x99;
//clear out the bytes you want to change
data = data & (data mask to be overidden);
//change the desired bytes with the desired values
data = data | a << (byte number for a in bits);
data = data | a << (byte number for b in bits);
//override the data chunk    
&datapointer = data;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.