Chapter 9 format string attacks
the unauthorized reproduction in whole or in part of this publication in any form is prohibited.
Let's look at the example of the use of format tags
as we can see the print function allows us to use many format tags as described in the system manual.
The use of mini format tags is possible thanks to the V.A. lists described in the SDD org.
Help.
Let's check to see what happens if we don't enter the call arguments for the print function.
After modification our program printed data located on the stack by using format tags we are able to
read the program memory to the bottom of the stack.
Our next example demonstrates us
to write the data we will use the percent in format tag.
We'll now take a look at how this works
the percentile in tag causes the number of currently printed characters to be written in The I.A. variable
and the subsequent example we will discover how to write any value to the address indicated in the program
memory.
We did it we wrote the value 5 at the address of the I.A. variable the value 5 corresponds to the address
length increased by the dash sign.
We'll now try to write the value 1000 0 x 3:08 in the hexadecimal system to the I.A. variable
as we can see writing a relatively small value does not constitute any problem.
We will now write the value 0 x 8 8 6 6 4 4 2 2 to the variable.
Unfortunately we don't have the ability to write such a big value.
The solution is the division of our address in four bright fragments.
Let's do it.
The address of our variable has changed and it is therefore necessary to correct it.
We did it the 0 x 8 8 6 6 4 4 2 to address has been written correctly into the i n t var. in the previous
example we were writing an address whose every byte was bigger than the previous one.
Now let's consider the reverse situation.
As we can see thanks to the manipulation of the specific bytes of the address we managed to obtain the
intended result.
Let's take advantage now of our ability in a practical example.
We obtained the address of the I.A. OK variable controlling access to the secured resources.
We'll try to change its value.
It worked.
But what will happen if in the susceptible program that there is no variable whose overriding can help
us
in the next example we will discover how to execute any code by overwriting the IP pointer.
We will now try to obtain the address of the copy of the IP register for the main function.
This will allow us to execute the indicated code immediately after terminating this function.
As we can see the copy of the IP register is located under the address 0 x b f f f f 3 9 C let's write
the address of our Shoko to this location.
We did it.
Now let's try to obtain the same effect without using the gdb taking advantage of the format string
attack.
After checking the address of our show code 0 x 8 0 4 9 5 2 0 we can start to construct an appropriate
format string.
We write the address of our show code under the address of the IP register copy beginning from the last
bite.
After performing the address correction we were able to execute the shell code.
Let's look at another technique overwriting the GOP section
the GOP section global offset table contains information on external functions used in the program
by overwriting the address of the print function in goaty with the address of our show code.
We will cause its execution.
It worked.
Now let's perform the same test using a format string exactly the same way as in the previous example.
As we can see the operation has been successful.
We can now use our abilities to overwrite the program destructor s. d. t o r s
by knowing the address of the end of the destructor list.
We can overwrite it with the address of the shellcode.
We did it the ability to write any address in the program memory made it possible to take control of
the application.