5

If you're using the example code from the book (below), at some point you should reach the "AAAAAAAA" pattern (0x41). Note that, since you're running it on a 64-bit machine that stores elements in the stack with 8 bytes each, you should run it with $ ./fmtstr "AAAAAAAA %016x %016x %016x %016x %016x %016x %016x %016x %016x %016x %016x %016x %016x" instead, or ...


5

Yes, it's not C/C++ language; however, perl, PHP, ruby and java are descendents that carry on various C language conventions. By not having %n, php gets rid of part of the problem, but it still has %x which can be exploitable under certain circumstances. Basically, printf() and its variants can allow control of the format string if you don't specify it. ...


4

Firstly, C++ has enough degrees of freedom that a computer cannot make it completely safe. C++ literally gives you full access to anything the CPU can do. Functions like fscanf are just routines that do looping and checking internally to give you higher-level functionality. However, fscanf has no knowledge of how far a buffer goes (I.e. how big it is). The ...


3

You could start by reading the full description of CVE: 2012-0809 and then look for a poc. A brief introduction to format string exploitation is a good starting point.


2

Carnary protections rely on the compiler adding code before and after each function body, and possibly resorting the function's local variables, so this is not possible for item 1. As for item 2, the only thing that does come to mind is running the executable under Valgrind for analysis. You will not want to do that in production, as it's slow. Furthermore, ...


2

@LiveOverflow helped me figuring out what I couldn't get. Both the assumptions I had were true printf simply prints what ever isn't a '%' and treats in a special way charcters following '%' Formatters (%x, %s, '%n, etc...) ONLY use addresses found on the stack (what I mean is that if we start popping off values using %x, those values will be popped of on ...


2

You can use CyberChef. It allows you to try out a lot of encodings, compression, etc and you can chain them together. Can run in the web or you can clone your own copy.


2

I recommend you to check if the 0x0804b795 address is writable. You can see the different regions of a running process in /proc/PID/maps. For example: $ sleep 10 & [1] 1438 $ cat /proc/$(pgrep -f 'sleep 10')/maps 08048000-0804d000 r-xp 00000000 08:01 399565 /bin/sleep 0804d000-0804e000 r--p 00005000 08:01 399565 /bin/sleep 0804e000-0804f000 rw-...


2

Dumb fuzzing I'm just starting out to learn about fuzzing and have made a dumb fuzzer that changes several random bytes in a pdf file to random values, opens it and detects if Acrobat Reader has crashed. What types of bugs can I expect to find using such a method? None. Such "dumb" fuzzing has incredibly limited coverage. I would be extremely surprised ...


1

I don't think that this approach will help to find any vulnerabilities in this scope since the Adobe PDF format is pretty complex. It's very unlikely that you will achieve a good code coverage in a reasonable amount of time. Instead have a look at the reference of the PDF format and the Adobe extensions and start writing tests for particular parts you find ...


1

It sounds like you understand basically what you're trying to do, so this is more a programming puzzle than a security one, at this point. If the buffer has the shellcode placed before the %Nu%n sequence, I won't know how many characters have been printed before I get to the first %n, since the shellcode will contain non-printable characters. Getting the ...


1

Typically you'd want your match string to just be long enough to prevent any false negatives/positives and nothing more. Given that your string includes accented characters, I would also strongly recommend checking how the landing page renders them. Hydra will be looking at the HTML source, not how a browser would render it. It's possible that é is ...


1

You're doing it correct, you're just not using the correct string format. The injected printf is reading memory 8 bytes (64 bits) at a time, but you're only printing 4 byte (32 bit) hex dumps. Try using a "long" version of the hex format instead: %016llx: $ ./a.out "`python -c 'print "%016llx\n" * 30'`" Data: '...


1

I found my answer here: https://stackoverflow.com/questions/17775186/buffer-overflow-works-in-gdb-but-not-without-it My problem was my shellcode is load in a environment variable. So for bypass this problem, I used a return libc attack!


1

assuming what you mean is that you want to write in the middle of your 64 bit address, because your on a 64 bit system you could just create 8 byte array and add them to an unsigned long long kind of in sudo code: //get the pointer to the nearast address unsigned long long * datapointer = 0x18; //get all the data from the smallest adressible chunk for your ...


1

It was rather trivial. Modifying the previous example a bit, for ((i = 1; i < 200; i++)); do echo -n "$i " && ./test "BBAAAACC%$i\$x" 0; done | grep 4141 the upper word of location 129 is filled with the B's, and the lower word of location 131 is filled with the C's - with the A's nicely sandwiched in the middle at location 130. So I simply had ...


1

Try taking a look here: Stack Overflows - Defeating Canaries, ASLR, DEP, NX It sounds like you might have a stack canary. You would need to specifically compile the target program without stack canary protection. Learn more about how here: https://stackoverflow.com/questions/2340259/how-to-turn-off-gcc-compiler-optimization-to-enable-buffer-overflow In ...


1

As I understand, you control the input file /tmp/file and this piece of program is run with privileges to read a protected file. Your goal is to read the protected file. I failed to see any issue in this code. The format string is not controlled by the input and the missing line feeds you saw was because the last char of every 20 bytes is being replaced ...


1

No, these are not possible in Node.js as sprintf is a basic string formatting utility. This is now built into the language as util.format. As per the documentation, this function only supports basic formatting such as %s, %d and %j. There is no way of retrieving a pointer value using %p, hex formatting it using %x or outputting the number of characters ...


1

The "p" template parameter will interpret its part of the input string as a memory address (available to the Perl interpreter's process), and copy all characters from that address, up to the next null character, into the returned string. This might also cause a segfault/access violation if memory at this address is not readable. The "P" template parameter ...


1

You could encode like this: x1key1y1data1x2key2y2data2 Where x1 is the lenght of the key, and y1 is the lenght of the data. This way you ensure that the keys are in the same order, and you can put any binary data on it. Just define a limit for the key and data lenght, and use padding to make sure x and y uses the same lenght: 004key1005test1002k1025long ...


1

Not in any traditional sense, as PHP's sprintf doesn't support any of the really dangerous conversions like %n. A user-controlled format string can still cause some limited havoc (consider %99999999s), but about the worst, It could do would be to consume memory and time. following is an integer overflow. Which leads to the following code:- <?php echo ...


Only top voted, non community-wiki answers of a minimum length are eligible