Format string exploitation

A format string is an ASCIIZ string that contains text and format parameters. The format string vulnerability occurs when the submitted data of an input string is evaluated as a command by the application. With the help of this method, the attacker could execute code, read the stack, and may cause a segmentation fault. Format string vulnerability exist in most of the printf family functions, such as printf, sprintf, and fprintf. These are the common parameters that can be used in format string vulnerabilities:

• "%x": It reads data from the stack
• "%s": It reads character strings from the process memory
• "%n": It writes an integer to locations in the process memory
• "%p": It's external representation of a pointer to void

Getting ready

We need a 32-bit x86 Linux real or virtual environment for creating the vulnerable application and getting the basic idea about the process involved in it. It is also a prerequisite to have a basic idea about some concepts in Linux environments...