Format String Theory Flashcards
What are the format strings?
They make possible for the programmer to include variables in a string format as he likes
What are the key elements in a format string?
The placeholders which specify how data is formatted into a string
What are some examples of format print functions?
They are:
- Printf
- fprintf
- sprintf
- snprintf
- vfprintf
- vsprintf
What are the parameters passed to the format print functions?
snprintf(buf, buf_size, “string + placeholders”, placeholder_values)
How does a format print function and the placeholders parameters relate
When the format string is parsed, the function expects The parameters values to replace the placeholders
According to the convention, these are expected to be pushed on to the stack by the caller
The function, therefore, expects the placeholder values to be on the stack
What happens when we do not place the placeholder values at the end of the format print functions
The function reads the values in the stack, even if they were not expected to be used in such way
We can also insert in the stack some contents through the format string functions. How can we find out in which position in the stack they were placed?
We can scan the stack with the %N$x syntax, which goes to the Nth parameter, along with a simple shell script
How can we use the scan on the stack as an information leakage vulnerability
By searching interesting in the memory
How can we write on the stack?
By using the %n placeholder, which writes in the address pointed by the argument, the number of chars printed so far
How can we use the format strings to write on the stack?
First, we put the address of the memory cell that we want to modify on the stack, then we use the %x to go find it on the stack (%N$x). Finally, we use the %n to write on the target address placed in the stack
How can we write a valid address on the stack
We use python to emit non-printable chars
How do we write in there arbitrary number that we can control?
We use the %c Parameter
What is the detailed steps to write an arbitrary number into a target address?
First, you put the target address on the stack as part of the format string, then you find it on the stack using the %N$x along with a shell script and finally you use the %c and %n to write a specific number to the target address
What is the problem in writing 32 bit addresses?
The size of the number
How can we write a 32 bit address
We split each DWORD (32 bits) into two WORDs (16 bit), and write then two rounds
What are the steps to write a 32 bit address to the target address
First, we put the two target addresses of the memory cells to modify as part of the foreman string, then we use the %N$x to find the position of the placed target address one (the position of the target address two will be the position of target address one+1). Finally we use %c and %n two right the lower and higher portions of the 32 bit address
What is the rational behind the size of the numbers to be written as part of the 32 bit address And the format string exploit
Since we are using the %c to control the number of chars printed and because of that we cannot reduced the number of chars printed we need to first place portion of the 32 bit address with the lower value then the higher one.
These difference in the order Of inserted values is done, mainly by exchanging addresses order in the stack
