Format String Vulnerabilities

Question 1

What does %x do?

Answer 1

Tells printf to fetch whatever is at the top of the stack and interpret it as a hexadecimal number

Question 2

What is %u used for?

Answer 2

Padding

Question 3

What does %n do?

Answer 3

Writes the number of output characters to a memory address

Question 4

What do we need to exploit the vulnerability?

Answer 4

• Distance from the buffer (offset)
• Location of shellcode (return address)
• Location of GOT entry to overwrite (return location)
• Split retaddr into incremental retlocs

Question 5

What does the executable file contain in static vs dynamic linking?

Answer 5

Static: whole code, data of shared library
Dynamic: code, references to symbols to be used from shared libraries

Question 6

What is the PLT?

Answer 6

Procedure Linkage Table
Used to call and external procedures/functions whose address is only known at run time, as an indirect layer to the invocation of library functions.
When a shared library function is called by a program it calls the address in the corresponding entry in the PLT
Read-only

Question 7

What is the GOT?

Answer 7

Global Offset Table
Used to resolve addresses
A memory region that contains several function pointers, executables and shared libraries
Readable and Writeable