Having a program vulnerable to stack based buffer overflow with setuid bit set, and want to fill the buffer with ROP gadgets.
If setuid(0) is needed to spawn a shell with root privilege, then '0' would be written in the stack, so setuid() can take it as the unique argument. The 0 breaks the sequence we want to write in the stack so an alternate way to write it is needed.
Reading about printf and format string, i'll fill the buffer with ROP gadgets this way:
<higher address> .... printf's argument setuid's argument addr. of pop\ret addr. of setuid() addr. of printf's argument addr. of pop\ret ESP--> addr. of printf()
When it's time to return to the calling function, what is pointed from ESP is loaded into EIP, so the cpu execute the printf() with its argument and so on.
What i'm not understanding is how printf() plays in writing the 0 in the "setuid's argument" position.
I'm on a 32-bit linux system.