How can I perform a "printf string attack" using a buffer overflow?

Question

The code:

void doit()
{       
      system("/bin/sh");
      exit(0); 
}       

int main(int argc, char **argv)
{       
    static int the_var;
    char buf[512];

    the_var = 20;

    strncpy (buf, argv[1], sizeof(buf) - 1);

    printf (buf);

    if (the_var != 20)
    {
            doit();
    } else {
            printf ("\nthe_var @ 0x%08x = %d 0x%08x\n", &the_var, the_var, the_var);
    }
}

Program is running with sticky bit (owner uid 0) all I have to do is to crack it and run the /bin/sh as the root.

I know how to crack the program with fe. buffer overflow and strcpy (shellcode), but don't how to to use 'format string attack' on this one.

As you can see, there is a var the_var, if it is not equal to 50 then shell is running (maybe try to change it somehow, some dirty magic?). Anyway, there is a printf (buf)

ouah · Accepted Answer · 2012-06-17 09:06:14Z

5

You control buf. Pass %x format strings to dump the stack and %n to overwrite the object the_var in the stack. From your program if the object the_var is overwritten, the doit function will be called and /bin/sh will be executed.

answered Jun 17, 2012 at 9:06

ouah

147k16 gold badges287 silver badges338 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

makowiecki Over a year ago

Thanks for the hint, it was simple.

Collectives™ on Stack Overflow

How can I perform a "printf string attack" using a buffer overflow?

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related