Understanding the format string vulnerability step by step in this thorough tutorial explaining its very foundations, the underlying concepts. How do format string vulnerabilities happen, why and how can we abuse them. Format String vulnerabilities allow an attacker to both leak memory and corrupt it by writing arbitrary values. In this video we will learn how to leak memory by abusing a Format String vulnerability, aside from understanding what is happening internally. Step-by-step tutorial solving pwn106 from PWN101 binary exploitation room on TryHackMe.
Golden Format String papers and posts:
- Defcon Quals: babyecho (format string vulns in gory detail) blog.skullsecurity.org/2015/d...
- Exploiting Format String Vulnerabilities (scut / team teso) cs155.stanford.edu/papers/for...
- Format String Exploitation tutorial by Saif El-Sherei www.exploit-db.com/docs/engli...
- Exploit 101: Format Strings axcheron.github.io/exploit-10...
- Format String Vulnerability (Syracuse University) web.ecs.syr.edu/~wedu/Teachin...
- Lab 1: Format Strings cs-uob.github.io/COMSM0049/la...
My post about 32-bit format string:
- 247CTF - Confused Environment Read: razvioverflow.github.io/247ct...
Wikipedia printf format string: en.wikipedia.org/wiki/Printf_...
cplusplus.com printf: www.cplusplus.com/reference/c...
PWN101 Room: tryhackme.com/room/pwn101
Binary Exploitation PWN101 Playlist: • Binary Exploitation PW...
Binary Exploitation PWN101 Webpage: razvioverflow.github.io/tryha...
00:00 - Intro
00:12 - Checking binary protections
00:43 - Executing the binary
01:16 - Spotting the vuln: Format String
01:48 - Format String vulnerability
02:41 - Best Format String exploitation resources
04:53 - Explaining Format String vulnerability
07:25 - Playing with an example
07:54 - Testing and understanding the vulnerability
11:35 - Debugging the vulnerability
12:51 - Calling convention for 64-bit architectures
14:00 - Understanding the vulnerability
18:30 - Format specifiers and sub-specifiers
19:45 - Debugging again
22:07 - Recap
23:23 - Positional argument
25:50 - Leaking the toy secret
26:59 - Differences 32 and 64 bits
27:30 - Disassembling the binary
27:55 - Spotting the vulnerability
29:23 - Writing the exploit
31:50 - Spotting the position of the flag
32:30 - Exploiting locally
34:20 - Exploiting remotely
34:55 - Reading the flag
35:15 - Outro[*]
Exploit code, not people.
Twitter: @Razvieu
*Outro track: Etsu - Selcouth
GG