1

I'm trying to solve a problem on format string exploitation in which I have to overwrite anything in a specific address. Since the target address has a null byte at the begining, I need to write it at the end of the format string, and I want to locate where the last 4 bytes of my format string are, so I just made some format strings like

"%08x " * whatever_integer + "AAAA"

until I find some memory leak of the form 0x41414141.

However, I don't get the right output of my "AAAA" always. For example, if I use a factor of 35, I get the following:

$ ./format-two "`python -c 'print "%08x " * 35 + "AAAA"'`"
Welcome to phoenix/format-two, brought to you by https://exploit.education
00000000 0000004d ffffe83b 01010101 ffffe49f ffffe4e0 ffffe4e0 ffffe5e0 00400705 ffffe638 00400368 78383025 30252078
20783830 38302520 25207838 78383025 30252078 20783830 38302520 25207838 78383025 30252078 20783830 38302520 25207838
78383025 30252078 20783830 38302520 25207838 78383025 30252078 00414141 00000000 AAAABetter luck next time!

As it can be seen, I only get three 0x41, so one of them is missing despite the fact that it should be in a contiguous memory location. If I repeat the process with a factor of 40, suddenly it behaves as expected:

    $ ./format-two "`python -c 'print "%08x " * 40 + "AAAA"'`"
    Welcome to phoenix/format-two, brought to you by https://exploit.education
    00000000 00000034 ffffe822 01010101 ffffe48f ffffe4d0 ffffe4d0 ffffe5d0 00400705 ffffe628 00400368 78383025 30252078
    20783830 38302520 25207838 78383025 30252078 20783830 38302520 25207838 78383025 30252078 20783830 38302520 25207838
    78383025 30252078 20783830 38302520 25207838 78383025 30252078 20783830 38302520 25207838 41414141 00000000 00000000
    00000000 AAAABetter luck next time!

Why is this happening? Is there an exact way of using format strings such that memory is printed correctly?

1
  • Is this a 32 or 64-bit system? Apr 3 at 17:12
1

The answer is simple: your %08x are also in memory!

Did you try decoding the section before the AAA in memory (78383025 30252078 20783830 38302520 25207838 78383025 30252078 00414141)? It's something like 0% x x8080% % x8x80%0% x.AAA after hex decoding. The memory output here is aligned by 4 bytes, but you chose to write 35x5 bytes before your A's, which is 175; 4 does not go evenly into 175. For your second attempt, you did 40x5 == 200, which does evenly divide by 4, hence the correct alignment in your output.

As far as the missing 0x41 goes, I suspect this is a 64-bit system and you are only printing 4 bytes per every 8, so one of them simply isn't being printed. If this is a 64-bit system and you are trying to print the whole 8 bytes, I suggest using %p instead of %08x as a format specifier.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.