Format String Exploits - Introduction

pwn.college

4 chapters7 takeaways9 key terms5 questions

Overview

This video introduces format string vulnerabilities, focusing on the `printf` function. It explains how `printf` uses format specifiers (like `%s` for strings, `%d` for integers, `%f` for floats) to substitute values from subsequent arguments. The core vulnerability arises when a user can control the format string itself, as `printf` blindly trusts the specifiers and attempts to read arguments from registers and the stack. This can lead to unintended memory reads or writes, which will be explored in future videos. The video demonstrates this using GDB to show how arguments are passed to `printf` via registers and the stack, highlighting the potential for exploitation when the format string doesn't match the provided arguments.

How was this?

Save this permanently with flashcards, quizzes, and AI chat

Chapters

The `printf` function in C can accept a variable number of arguments.
The first argument is a format string that dictates how subsequent arguments are interpreted and displayed.
Format specifiers like `%s`, `%d`, and `%f` tell `printf` the expected data type of the corresponding argument.
`printf` substitutes these specifiers with the actual values from the provided arguments.

Understanding how `printf` formats and substitutes values is crucial because it forms the basis of how format string vulnerabilities are exploited.

Calling `printf("Hello %s\n", name);` where `name` is a string like "Pone College" results in "Hello Pone College\n".

When `printf` needs more arguments than can fit in standard registers (RDI, RSI, RDX, etc.), it retrieves them from the stack.
The C code's arguments are pushed onto the stack in a specific order.
Debugging with GDB reveals that the format string is in RDI, initial arguments are in registers (RSI, RDX, etc.), and subsequent arguments are found on the stack.
This mechanism applies to various data types, not just integers.

Knowing where `printf` looks for arguments (registers and stack) is essential for understanding how an attacker can manipulate these locations to their advantage.

In GDB, after setting up `printf` with seven integer arguments (a-g), the values 1-5 are found in registers RDI through R9, while 6 and 7 are found on the stack at addresses pointed to by RSP and RSP+8, respectively.

A format string vulnerability occurs when a user controls the format string passed to `printf`.
The vulnerability arises because `printf` blindly trusts the format string and attempts to read arguments based on the specifiers it finds.
If the number or type of specifiers in the format string doesn't match the actual arguments provided, `printf` will read unintended data from the stack or registers.
This can lead to leaking sensitive information or even overwriting memory.

This is the core concept of the vulnerability: `printf`'s trust in the format string, combined with user control over it, creates a security flaw.

If a program calls `printf(user_controlled_string);` without providing any additional arguments, and `user_controlled_string` contains specifiers like `%x` or `%s`, `printf` will attempt to read and display data from the stack, potentially revealing memory contents.

The only requirement for a format string vulnerability is user control over the `printf` format string.
Even if no extra arguments are passed, `printf` will still try to interpret specifiers by reading from the stack.
The `printf` function is surprisingly powerful, being Turing complete when used with a `while` loop construct.
Abusing format strings allows attackers to read and write to memory.

This highlights the severe security implications, as even simple user input can be leveraged to compromise a system's memory.

The existence of projects like 'Brainfuck' implemented using `printf`'s `while` loop functionality demonstrates the advanced capabilities that can be built upon `printf`'s behavior.

Key takeaways

1The `printf` function substitutes format specifiers in its first argument (the format string) with values from subsequent arguments.
2Arguments beyond those fitting in registers are passed on the stack.
3A format string vulnerability exists when an attacker can control the format string passed to `printf`.
4`printf` blindly trusts the format string, leading to vulnerabilities when specifiers don't match actual arguments.
5This trust allows attackers to read unintended data from the stack or registers.
6Format string vulnerabilities can be used to leak memory contents or even modify them.
7User control over the format string is the sole requirement for this type of vulnerability.

Key terms

Format StringprintfVulnerabilityFormat SpecifierStackRegistersCalling ConventionGDBTuring Complete

Test your understanding

1How does the `printf` function use format specifiers to substitute values?
2What is the role of the stack in passing arguments to `printf` when registers are full?
3What specific condition must be met for a format string vulnerability to exist?
4Why does `printf`'s behavior of trusting the format string lead to security vulnerabilities?
5What are the potential consequences of exploiting a format string vulnerability?