Re: Small buffer format string attack

From: dong-h0un U (xploitat_private)
Date: Thu Jun 12 2003 - 00:59:39 PDT

  • Next message: Ingevaldson, Dan (ISS Atlanta): "RE: Research on Source Code Review -C"

    Here is the original Korean version of the previous article in case anyone is interested..
    URL: http://x82.inetcop.org/h0me/lectur3/0x82-Small-format-kr.txt
    
    And, the following is added contents.
    (My answer about question)
    --
    
    All systems is different format string result.
    Therefore, `%8x', or must set by `$-flag'.
    
    Did as following in my server, displayed very well.
    
    int main()
    {
    	char string[]="It's test!";
    	char format_str[]="\x34\x85\x04\x08%12$s\n"; // %12$s
    	printf(format_str);
    }
    
    Result: --
    
    bash-2.04$ ./test
    It's test!
    bash-2.04$
    
    --
    Or, as following,
    
    int main()
    {
            char string[]="It's test!";
            char format_str[]="\x60\x85\x04\x08%8x%8x%8x%8x%8x%8x%8x%8x%8x%8x%8x%s\n";
            printf(format_str);
    }
    
    Result: --
    
    bash-2.04$ ./test
    4001663840016c50 d696910bffffb604000d758      29 8048580bffffb40      b
    8048560bffffb70It's test!
    bash-2.04$
    
    --
    
    Thank KF. :-D
    
    
    -- 
    _______________________________________________
    Get your free email from http://www.hackermail.com
    
    Powered by Outblaze
    



    This archive was generated by hypermail 2b30 : Thu Jun 12 2003 - 12:03:05 PDT