Hack Security Pro.pdf - Index of

printf type functions are functions with a varying number of arguments. So the number of arguments is
deduced from the format chain. When it has arrived in the printf function, the format chain is recovered
(it is the first argument recovered on the pile). Then this format chain is browsed. For each format
indicator ('%d', '%x', '%s', ...), an argument is recovered on the top of the pile. In our example, 4
arguments have been provided to to the printf function. So the format chain will be recovered on the
pile. Then, for each format indicator, (%d, %f et %s), an argument will be extracted from the pile (pop
assembler instruction).
The vulnerability
Let us now imagine that the user can control this format chain. A vulnerable program would look as
follows:
void main(int ac, char *av[]){
if( av[1] )
printf(av[1]);
printf("\n");
return;
}
bash# ./prog lol
lol
bash#
Up to this point, everything is normal. The program simply displays the chain passed on as an
argument. Let us now place format indicators in our chain.
bash# ./prog '%x %x %x'
589238 0 589238
#bash
What is happening? The printf function will try to recover the arguments on the pile according to the
format indicators, but none have been given to it. We will therefore be able to explore the whole pile.
So we can already recover a certain number of informations on the program memory (memory leak).
Exploitation
At first view, we might think that printf type functions only enable us to read information. Well, that is
not the case. There is a little-known format indicator that can enable us to write to any given address,
the '%n' indicator. This indicator gives the number of characters written (or that should have been
written) up to it and must be placed in the argument to which it corresponds. The argument
corresponding to '%n' must be an integer pointer.
void main(){
int i;
printf("foobarfoo%nbarbar\n", &i);
printf("i = %d\n", i);
}
bash# ./prog
foobarfoobarbar
i = 9;
bash#
The Hackademy DMP -154/209- SYSDREAM