Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [format-string]

The format strings in functions like "printf" specifies a method for rendering an arbitrary number of varied data type parameters into a string.

2
votes
0answers
63 views

Format String Vulnerability - Can't read an address from stdin with read() in C

I wanted to exploit this code using format string vulnerability: int jackpot; void fmt_str(void) { char buf[128]; puts("Give me a string to print"); read(0, buf, 128); printf(buf); ...
2
votes
0answers
46 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
2
votes
0answers
148 views

Help with Format String Exploit

I am working on a 32-bit binary which reads an input from the user and uses that input as a format string for printf. I need to overwrite a specific address with a single byte. The issue is that I ...
1
vote
1answer
431 views

Hydra: Brute force an http form, all arguments are supplied but the login error has other string formats and is too big

I am using Hydra to brute force a login http form (Method: post), but I'm getting false positives (passwords that aren't valid) I believe I know the reason, I just don't know how to handle it: The ...
1
vote
1answer
47 views

Incomplete Data In Format String Dump

I've been practicing format-string attacks lately and I thought I knew how it works but after hours of research I did not manage to get the expected results. I made a sample program which has a ...
2
votes
0answers
74 views

Stack behavior on function call during a format string exploit

I have some issues trying to resolve a war game with a format string vulnerability. So here is the code of the program: #include <stdio.h> #include <string.h> #include <stdlib.h> ...
4
votes
1answer
872 views

Overwrite return adress with a format string vulnerability without gdb

I try exploit a format string in a vulnerable program. For information, it is the lab4A of the RPIsec course. The NX protection and ASLR is disable but the program is FULL RELRO. So my idea, it is ...
1
vote
1answer
160 views

Is it possible to write a value larger than 64bit using a format string attack (%n)?

I am currently exploring format string attacks. However, the buffer in this example is not located on stack but on heap, so the most common approach does not work and my options of addresses I can ...
4
votes
1answer
2k views

Can I do a String Format Exploit for x64 systems? [closed]

I was trying to replicate the experiment in Gray Hat Hacking - Third Edition, Chapter 12, about Format String Exploits, but their architecture is IA32, while mine is AMD 64bits. Therefore when I check ...
1
vote
1answer
3k views

How to Leak Addresses with Format String Exploits

By playing various wargames I noticed that I kept on getting stuck on format strings vulnerabilities, so I decided to step back and relearn them from scratch. In the process I realized that I couldn't ...
4
votes
0answers
70 views

CSAW 2012 challenge2 can't get shell out side of gdb

I tried to solve this problem. I found FSB at 0x08048bfe _snprintf. I loaded shell code by \n. ssc function checks whether user input include /bin/sh. Most of shell code includes /bin/sh. I found ...
1
vote
0answers
151 views

Exploitability of Heap Vulnerabilities

I'm researching memory safety vulnerabilities and noticed that in non-browser applications (for example the Linux kernel) the CVE details entries for use-after-free vulnerabilities almost always list ...
0
votes
1answer
514 views

Is there a good site I can use to convert a string into any encoding? [closed]

I am working on a ctf (capture the flag) challenge and I have a string that I believe is important, but I don't know what encoding it is in. Is there a way I can decode the string in all of the ...
1
vote
1answer
3k views

Reading off arbitrary addresses in format string attack

I am trying to carry out a simple format string attack on this program: #include <stdio.h> int main(int argc, char *argv[]) { printf(argv[1]); } I face no problem leaking the stack in the ...
3
votes
2answers
1k views

Segmentation fault trying to exploit printf vulnerability

I am trying to learn more about printf vulnerability. I understand the theory but I am unable to put it into practice. TL;DR All my attempts to write a single byte into memory result in a ...
1
vote
1answer
1k views

How to turn off ASLR under Windows? [closed]

I'm experimenting a bit with formatstring attacks with a little program (all vulnerabilities intended): #include <stdio.h> int main(int argc, char *argv[]) { char string[100]; gets(...
2
votes
0answers
179 views

How exactly does format string vulnerable code read data from stack?

If we have a code like printf(buffer) where the user can control the buffer, I understand that the user could insert something like AAAA%08x%08x%08x... and would as the output get the content of a ...
4
votes
2answers
393 views

What kind of bugs can be found by dumb fuzzing a desktop app?

I'm just starting out to learn about fuzzing and have made a dumb fuzzer that changes several random bytes in a pdf file to random values, opens it and detects if Acrobat Reader has crashed. What ...
4
votes
1answer
182 views

Will Intel's MPX extension make C/C++ completely safe to use?

This is apparently an extension that will eliminate buffer overflow and format string vulnerabilities in C/C++ programs, I would guess by providing hardware support for, e.g. converting scanf to fgets ...
2
votes
1answer
706 views

How to exploit this piece of code? (format string in printf?) [closed]

So this piece of code is vulnerable to format string vuln (I think) in the printf() function. It reads a file in /tmp/file so I've tried writing different modifier/strings in that file and see what ...
3
votes
1answer
904 views

Uncontrolled Format String Vulnerability in JavaScript

I have been working on input validation vulnerabilities and very new to Uncontrolled Format String Vulnerabilities, as I learned so far its usually exploited through printf functions with "%". I ...
3
votes
1answer
208 views

Sudo debug function vulneability

I am quite stuck with an assignment question, exploiting vulnerability (vfprintf) in sudo_debug function with ASLR (CVE: 2012-0809). I can only use string format exploits. ONLY ASLR IS ENABLED < NO ...
1
vote
1answer
48 views

Does Perl's unpack function have format vulnerabilities?

I'm using Perl for the first time for production software and I have some trust issues with it. When I use the unpack() function, is it safe to use user input in the TEMPLATE string? I'm using a ...
2
votes
1answer
153 views

What is the ideal HMAC message format if message is an array?

I'm using HMAC exactly as intended to verify the integrity of a message. However, the message is really an associative array (or a hash). Since this will be done on various platforms (within and ...
3
votes
2answers
3k views

PHP sprintf vulnerability?

On some sites such as WriteCodeOnline, sprintf, vsprintf and other related formatted string functions are disabled for security reasons: Warning: vsprintf() has been disabled for security reasons ...
0
votes
1answer
347 views

libraries alternative to gcc stack-protector / fortity source feature on linux

is there external library/approach/whatever to add canary protection (stack-protector equivalent) extra buffer boundary check (fortity source equivalent) on a C software without using glibc / gcc ...
0
votes
1answer
1k views

Fomat String vulnerability used to display data outside the function stack frame?

if we run the following code using the input "hi", the output will simply be "hi" main(int argc, char **argv) { char *secret = "This is a secret 1\n"; char *secret2 = "This is ...