Format String Exploitation-Tutorial
Introduction:
I decided to get a bit more into Linux exploitation, so I thought it would be nice if I document this as
a good friend once said “ you think you understand something until you try to teach it “. This is my
first try at writing papers. This paper is my understanding of the subject. I understand it might not be
complete I am open for suggestions and modifications. I hope as this project helps others as it helped
me. This paper is purely for education purposes.
Note: some of the Exploitation methods explained in the below tutorial will not work on modern
system due to NX, ASLR, and modern kernel security mechanisms. If we continue this series we will
have a tutorial on bypassing some of these controls
What is a Format String?
A Format String is an ASCIIZ string that contains text and format parameters
Example:
printf(“my name is:%s\n”,”saif”);
If a program containing the above example is run it will output
My name is: saif
Think of a format string as a specifier which tells the program the format of the output there are
several format strings that specifies the output in C and many other programming languages but our
focus is on C.
Output Hexadecimal
Number
Number of bytes written
so far
Writes the number of
bytes till the format
string to memory
Table 1-1 Format Strings
Format String Vulnerability:
Format strings vulnerability exists in most of the printf family below is some.
Printf vsprintf
Fprintf vsnprintf
