Format String Vulnerabilities

Front 1

What is a format string?

Back 1

A format string is simple a string of characters with special format string identifiers.

Front 2

What is a print specifier or format specifier?

Back 2

This is what's placed in the string passed to one of the printf functions that tells printf what format to print the matching variable.

Examples - %s, %d, %n, %x

Front 3

What is a format string bug / How can they be vulnerable?

Back 3

When the programmer forgets to include the print specifier in the format string of printf.

Correct:

printf("%s", string_to_print);

Vulnerable:

printf(string_to_print);

Front 4

What is the functionality of the printf function if the print specifier is left off?

Back 4

If the print specifier is left off, printf family of functions will continue to search / seek by the format string identifiers in the buffer (or input)

Front 5

What are the three main things can you accomplish with a format string exploit? (More can be accomplished)

Back 5

1. You can read data off the stack.

1.1. Passing multiple %x will show you values on the stack in hex format. Possibly containing passwords, etc. %s can also be used.

2. You can write to locations in memory using the %n specifier. (Overwrite saved RTN, GOT / PLT, DTORS, etc)

3. You can call functions that regular program flow wouldn't have called.

Front 6

How do you write to memory locations with %n?

Back 6

%n will write a value into the memory location you specify. The value it writes is the amount of characters, including spaces before the %n in the format string.

This allows you to write at least up to 255. You can write 1 byte at a time to fill a 4 byte memory adress.

Front 7

How can you easily add characters before %n?

Back 7

One way is to use the width specifier in printf:

%x%x%10x%n - The 10 easily adds larger values to what n will write.

Front 8

What is DPA and how does it help format string vulns?

Back 8

DPA = Direct Parameter Access

DPA allows you to access a parameter directly without listing all preceding parameters before it.

Front 9

As an example, what would the following call to printf print?

printf("4th: %4$d\n", 7, 20, 44, 65, 28, 2);

Back 9

This is using DPA to access the 4th parameter, which is 65.

Front 10

What is the %hn modifer?

Back 10

This allows us to write 16 bits at a time. Instead of 4 separate 1 byte writes, we do the full 4 byte(16 bit) write at once with %h