Format String Vulnerabilities
Exploit printf format strings to read arbitrary memory and write to arbitrary addresses.
What is a Format String Vulnerability?
A format string vulnerability occurs when user input is passed directly as the format string argument to printf() or similar functions. The attacker can read memory, leak stack addresses, and write arbitrary values.
The Vulnerable Pattern
Vulnerable vs safe:
// VULNERABLE - user controls the format string:
printf(user_input);
fprintf(stderr, user_input);
// SAFE - user input is a data argument:
printf("%s", user_input);All lessons in this course
- Stack Buffer Overflows
- Return-Oriented Programming (ROP)
- Format String Vulnerabilities
- Heap Exploitation: Use-After-Free and Heap Spraying