search
Personal WebsiteGithubLinkedIn

Format Zero

This level introduces format strings, and how attacker supplied format strings can modify the execution flow of programs.

Hints

  • This level should be done in less than 10 bytes of input.

  • “Exploiting format string vulnerabilities”

hashtag
Source code

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

void vuln(char *string)
{
  volatile int target;
  char buffer[64];

  target = 0;

  sprintf(buffer, string);
  
  if(target == 0xdeadbeef) {
      printf("you have hit the target correctly :)\n");
  }
}

int main(int argc, char **argv)
{
  vuln(argv[1]);
}

The program expects one user supplied argument as shown by vuln(argv[1]);.

The code then uses sprintf which is where the vulnerability lies.

Before we exploit the program, we need to know how the stack is laid out.

Let's disassemble the vuln function.

We can see that the line at vuln+26 makes the call to sprintf.

The first argument is the address ebp-0x4c and it is loaded into eax.

If we look at the man page of sprintf we can see that the first argument is a pointer to the buffer.

Looking back at the disassembled code of vuln at vuln+34 a comparison is being made.

This is checking if the target variable is set to 0xdeadbeef. The value being compared is being moved from ebp-0xc.

So we know the location of the buffer as well as the target variable. Let's find the distance between them.

So the distance is 64 bytes but we have been instructed to use less than 10 bytes. Which means a classic buffer overflow will not work.

This is where the format string attackarrow-up-right comes in.

Instead of submitting 64 bytes of padding we can submit the format string %64c which translates to 64 characters.

When fprintf is executed, it takes the bytes after the format string and overwrites the target variable.

hashtag
Exploit

Note that you can use other format specifiers mentioned herearrow-up-right.

Last updated