Full Disclosure mailing list archives
Re: Small buffer format string attack
From: "dong-h0un U" <xploit () hackermail com>
Date: Thu, 12 Jun 2003 15:59:39 +0800
Here is the original Korean version of the previous article in case anyone is interested.. URL: http://x82.inetcop.org/h0me/lectur3/0x82-Small-format-kr.txt And, the following is added contents. (My answer about question) -- All systems is different format string result. Therefore, `%8x', or must set by `$-flag'. Did as following in my server, displayed very well. int main() { char string[]="It's test!"; char format_str[]="\x34\x85\x04\x08%12$s\n"; // %12$s printf(format_str); } Result: -- bash-2.04$ ./test It's test! bash-2.04$ -- Or, as following, int main() { char string[]="It's test!"; char format_str[]="\x60\x85\x04\x08%8x%8x%8x%8x%8x%8x%8x%8x%8x%8x%8x%s\n"; printf(format_str); } Result: -- bash-2.04$ ./test 4001663840016c50 d696910bffffb604000d758 29 8048580bffffb40 b 8048560bffffb70It's test! bash-2.04$ -- Thank KF. :-D -- _______________________________________________ Get your free email from http://www.hackermail.com Powered by Outblaze _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Small buffer format string attack dong-h0un U (Jun 08)
- <Possible follow-ups>
- Re: Small buffer format string attack dong-h0un U (Jun 12)