If you're using the example code from the book (below), at some point you should reach the "AAAAAAAA" pattern (0x41). Note that, since you're running it on a 64-bit machine that stores elements in the stack with 8 bytes each, you should run it with $ ./fmtstr "AAAAAAAA %016x %016x %016x %016x %016x %016x %016x %016x %016x %016x %016x %016x %016x" instead, or you will miss part of each element on the stack.
#include <stdlib.h>
int main(int argc, char *argv[]){
static int canary=0; // stores the canary value in .data section
char temp[2048]; // string to hold large temp string
strcpy(temp, argv[1]); // take argv1 input and jam into temp
printf(temp); // print value of temp
printf("\n"); // print carriage return
printf("Canary at 0x%08x = 0x%08x\n", &canary, canary); //print canary
}
You should pay attention to the quote in the book that states:
The fact that the fourth item shown (from the stack) was our format string depends on the nature of the format function used and the location of the vulnerable call in the vulnerable program. To find this value, simply use brute force and keep increasing the number of %08x tokens until the beginning of the format string is found. For our simple example (fmtstr), the distance, called the offset, is defined as 4.
Remember that the parameter being parsed to printf isn't the string itself, but the address of the string. So it's position on the memory layout of the program in relation to the printf stack is what will define how further you'll have to search to find it.
linux - Format string vulnerability exploit in 64 bits systems - Stack Overflow
64-bit Format String Exploitation.
what's the difference to x86 that is difficult for you?
More on reddit.comFormat string exploitation on 64 bit. How about the null bytes?
c - Format String Exploit, unexpected result - Stack Overflow
Videos
Hey LiveOverflow,
I've recently come across a few 64-bit Format String challenges in CTF's and they always seem to stump me. This is mainly because there seems to be very little on the web for 64-bit format strings exploitation (most is x86).
Are you aware of any content that could help me in learning how to pwn 64-bit format strings?
Thanks!
I'm new to the argument, but I'm trying to do some very simple exercises on format string vulnerability. I'm unfortunately incurring in a problem: when I write the target address in which I will write with %_c (for example \x38\xdb\xff\xff\xff\x7f for 0x00007fffffffdb38) im not able to replicate the 0x0000 right before 7fffffffdb38. So when I try to run it the program will try to write with %c in the address : 0x[ _ _ _ --> random values that were previously there]7fffffffdb38. How can I actually write there 0x00007fffffffdb38? Obviously by doing : \x38\xdb\xff\xff\xff\x7f\x00\x00 won't solve the problem, as it will not overwrite the first 4 slots of the address.
Thanks to anyone that will try to help me.