A simple Format String exploit example - bin 0x11

Key Takeaways

[Music] in this episode we will have a look at format level one from explored exercises Proto store this class of vulnerability is weird but I was mind-blowing to me when I first saw it so first of all what are forat strings probably the most known function in C is print F printf prints formatted data to SD out in my programming and C video I've used print F to print a name that a user can supply the parameters of print f are the following the first parameter is the so-call format string in that early video that was KN knock and the percentage s and as the second parameter we used arv1 which contains a string so print F read the format string and found the percentage s which means that at this position belongs a string so it takes the first supplied variable in this case AR be one and places a string there format string supports a lot of different types of variables for example percentage D which is assigned decimal integer or percentage X to display a number in HEX and you can do even more than that for example if you specify a number between the percentage and the specifier you can tell what size it should be petted to and you can for example preent a zero to that number to bet the results with zero format string functions like that exist also in other l languages for example you can use pretty much the same features in Python print a former string with percentage and then the variables afterwards with another percentage sign or better use the format function which has a slightly different syntax but in the end it's all the same and now you wonder how the hell can something that just prints text be exploited so let's have a look at the source code of format level one main calls the function W with the string from rv1 and that string is placed in print F and then we have a global variable Target which is checked if we got modified so pretty similar to some earlier stack buffer overflow challenges we need to manipulate this value but how can we manipulate this variable in memory with printf well let's do this step by step let's first execute the program as you can see it will simply print whatever we Supply in Arc V1 that looks simple but there is one small thing you should notice which parameter of print F does the attacker control it's not the second parameter like in the programming and C video it's the first parameter the forat string can we just use some percentage syntax let's try let's enter a format string test percentage D oh damn it printed a number weird let's add some more W more numbers numers let's print them as hex instead of sign decimal numbers that looks familiar remember the videos where we were looking at the stack do those values starting with b remind you of something those were stack addresses so what are we printing here if you have watched the previous episode about reversing C you know how functions are being called especially in 32 bit the parameters are simply placed on the stack and then the function is called so if you would use print if normally your variables that you want to print would be placed on the stick well now there there are no variables being placed on the stick so what values are are we reading obviously we are reading whatever print F can find on the stick so any value on the stick so what can you do with it first of all it's a Memory leak vulnerability you can leak all kinds of stuff from the sck imagine you had a program with aslr meaning that the location of the stack in memory is random and you don't know where it is but you need the address for buffer overflow to jump to Shell Code with this here you can leak values from the process memory most specifically from the stack and that's possibly leaking stack addresses which then you can use in a second step for buffer overflow in a recent CTF which I played there was an exploitable challenge where I use the format stream vulnerability to leak the stack Canary I will do a video about exploit mitigations at another point but the stack Canary is a random value which protects from buff overflows if I can get this number I can defeat the protection which I did so at first leaking some weird values from a process memory doesn't S like doesn't sound like much but there are many examples you can come up with where disclosing some memory could help exploiting a Target after all bugs like heart bleed were just leaking some memory and it was awful okay but in our particular case how can we use that to modify a value at the moment it only looks like we can leak values from the stack let's have a look at the print F man page Man 3 printf and let's scroll to the well-known bux section it says here if something comes from untrusted user input it may contain percentage n causing the print F call to write to memory and creating a security hall and a little bit further up the specifier N is explained as the number of characters written so far is stored in the integer indicated by the in pointer or variant pointer argument so percentage n writes the amount of characters that were already printed into a variable and a variable is just some area in memory and we know that to specify where the area is we need to use a pointer if we just look at the sampler code a pointer is simply an address so that printer knows where to write the result so if you were to write The Ledger Z program with percentage n you would place a pointer to an integer variable as a parameter to print F but in assembler this is just simply putting an address of the variable variable on the sck this means that whatever value is on the deack is used as a location where print F will write to now you can basically solve this challenge alone we need to write a value in Target so let's use object D minus t to find all symbols from the binary and here's the address of the target variable now when we want to print F to write something at this location we have to find this address on the deck let's start investigating I will use python in a on line script or inline script directly from the command line via minus C to help me with printing a test string for example 10 hex numbers hm maybe I want to separate them doesn't look like the addresses is here maybe if we print more values from this deck nope not here maybe more wait a minute what is that weird pattern from the values of the those hex values it could beesy hex 20 is a space after all with python we can quickly convert those hex values to S characters and War percentage X that looks like our string that we have supplied let's test this with um adding some Capital A's because we can recog ize those SK values easily now we just have to look for for1 for1 for1 for1 and indeed there are our A's and it makes sense because the program arguments are simply stored on a STI like the environment variables and other stuff cool this means we can simply place the address from the Target on the stack ourselves by adding it to our string so get the address again for Target and then we can add the address in our string maybe wrap it in some A's and B's so we can find it in the output easily oh yes there it is cool so in theory we just have to place the percentage X that was printing this address with percentage n to instead right to this location to do this we first have to change our format string and making the number of x's we print lower so then we can use a percentage n to write to that number and now I'm start fiddling around with it trying to get the right number and if you pay attention to looking for the A's and B's again that are wrapping the address you see that it's not perfectly aligned anymore so it's some trial and eror figuring out how many X's we need so that the next X that I append will hit the address exactly so I can replace that with an N you could do it more intelligently but I will just figure it out with try and error you have to be careful because uh remember from our previous videos where this deck was shifting around around because of stuff like environment variables the different length program argument that we Supply moves around the stack as well so you might have to fiddle around quite a bit until you just get it right okay that took a bit but looks cool the last X seems to reference our address now and when we place the X with the N to write to that address we modify the Target and you can imagine that if we can write anywhere in memory we could overwrite things to redirect code execution as well well so that will be the case in later levels just a small tip uh when you work with for string exploits it makes sense to keep your ATT attack string always the same length then you don't have to fiddle around much um just use Python script that always extends or cuts the string to at like 500 characters or something and then you have enough space to play around and a deck doesn't move around [Music] much