Chapter 10 practical examples of format string attacks
the unauthorized reproduction in whole or in part of this publication in any form is prohibited.
We will now copy the required files from the disk enclosed with the set.
Let's unpack and run the susceptible application.
The shout cost server.
After startup on another terminal we can begin to analyze the application behavior
by applying an appropriate format string.
We will try to save the value in the memory of the susceptible program.
As we can see the program has been closed due to an attempt to write to an unavailable memory area which
we forced with the percent and formatting tag.
Let's continue our analysis in order to reach the address searched in the program memory
this time we entered tag quanties that were too big because the server didn't process our query.
Let's now try using two independent queries.
We did it.
We have found the data transferred in the format string.
We will use it to write the address of our shellcode
as we can see the application of percentile $34 sign X tag will not be successful as the server filters
this type of query.
Finally we managed to transfer four addresses that will serve to indicate our shellcode.
Let's familiarize ourselves with the shellcode.
It makes available the command line on port seven thousand.
Let's test it.
Let's use the LBJ dump program to obtain an address that can be overwritten with the address of our
shellcode.
We have chosen the Sprint function its address in the global offset table ghoti is 0 x 0 8 0 6 4 9 3C
as well we can see the substitution of the Sprint function with the address we gave causes the jump.
It is here where we will write the address of our shellcode.
Let's take a closer look at a ready made exploit that draws on our experience
in the first query.
We will transfer the address of the Sprint function and the show code in a second we will transfer the
tags to write the shellcode address.
It worked as we can see the program tried to perform a jump to the address 0 x 6 6 6 6 6 6 6 6.
What caused it to close.
All we have to do is determine the address of our shellcode in memory and to transfer it in a format
string using the gdb application we can view the content of the program memory.
Our shellcode starts from the sequence.
Backslash x 31 backslash x c 0 backslash x 50 backslash x 50.
We can search for it
as we can see the address of the beginning of the show code is 0 x B-F 3 F E 0.
Now we can take advantage of it.
The ready made query is located in the modified version of our exploit.
Our actions have been successful.
We have obtained access to remote shell.