Format Strings - Sheridan Lecture

Format String Attacks

API, like printf, has issues with exploits

Character	Description
d, i	Signed integer
u	Unsigned integer
f, F	Double
e, E	Double in normal form (think IEEE 754 floating point standard)
g, G	Double in scientific notation
x, X	Unsigned integer as a hex number
o	Unsigned int in octal (ya, octal, some people still want to know this)
s	Null terminated string
c	Character (char data type)
p	Pointer to void…depends on implementation.
n	Don’t print anything but write the number of characters successfully written so far into an int pointer

Invocation of printf

Insufficient Arguments to printf

• In this case, once the program is done reading the value at memory address b, it will continue to read what is on the stack (where the “cursor” left off). In this case it will print whatever value is above the memory address of b.

**Exploiting Inconsistent printf

Crashing a Program

Printing Contents of Stack

Printing any Memory Location (1)

(2)

(3)

More Format Specifiers

• Reduce the number of %x with %N$s
  • 
  • 
• %n format specifier:
  • Returns the number of characters printed so far.
    • i is filled with 5 here
    • 
• %hn format specifier (Will only use 16 bits, can be used to store large numbers):
  •  Used to write a short integer value into memory
  • It takes the number of characters printed so far by printf and writes that number, as a short integer, into a memory location that you specify as the target argument.

Overwrite an Arbitrary Location

• Using the same approach to read data from any location, printf can be used to modify a location as well
  • Can be used to change function pointers as well as return addresses

With some Number

With Arbitrary Number

• Arbitrary number in this case is %53x, as shown before %7$n
  • 

%n in printf

• There are 16 characters before %n, so the value of c would be 16.

Recon

• This basic level of reading stack data can be used for recon against a target program

• Useful for reading usernames, passwords, return addresses, canary values, and other interesting data from the stack

• What about using %n specifier to write arbitrary values in conjunction with the %0##x function used previously ???

Safe Code for printf