Questions tagged [format-string]

The format strings in functions like "printf" specifies a method for rendering an arbitrary number of varied data type parameters into a string.

7 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
71 views

CSAW 2012 challenge2 can't get shell out side of gdb

I tried to solve this problem. I found FSB at 0x08048bfe _snprintf. I loaded shell code by \n. ssc function checks whether user input include /bin/sh. Most of shell code includes /bin/sh. I found ...
2
votes
0answers
128 views

Format String Vulnerability - Can't read an address from stdin with read() in C

I wanted to exploit this code using format string vulnerability: int jackpot; void fmt_str(void) { char buf[128]; puts("Give me a string to print"); read(0, buf, 128); printf(buf); ...
2
votes
0answers
60 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
2
votes
0answers
171 views

Help with Format String Exploit

I am working on a 32-bit binary which reads an input from the user and uses that input as a format string for printf. I need to overwrite a specific address with a single byte. The issue is that I ...
2
votes
0answers
90 views

Stack behavior on function call during a format string exploit

I have some issues trying to resolve a war game with a format string vulnerability. So here is the code of the program: #include <stdio.h> #include <string.h> #include <stdlib.h> ...
2
votes
0answers
190 views

How exactly does format string vulnerable code read data from stack?

If we have a code like printf(buffer) where the user can control the buffer, I understand that the user could insert something like AAAA%08x%08x%08x... and would as the output get the content of a ...
1
vote
0answers
167 views

Exploitability of Heap Vulnerabilities

I'm researching memory safety vulnerabilities and noticed that in non-browser applications (for example the Linux kernel) the CVE details entries for use-after-free vulnerabilities almost always list ...