Format string attack - Revision history

Luilom90: Review size buffer of Example1.

2015-04-16T07:06:21Z

Review size buffer of Example1.

MediaWiki spam cleanup: Reverting to last version not containing links to www.textractarelli.com

2009-05-27T18:31:25Z

Reverting to last version not containing links to www.textractarelli.com

Deleted user at 20:45, 22 May 2009

2009-05-22T20:45:53Z

KirstenS at 23:20, 7 April 2009

2009-04-07T23:20:32Z

KirstenS at 19:24, 15 February 2009

2009-02-15T19:24:01Z

KirstenS: /* Example 2 */

2008-09-14T12:26:32Z

‎Example 2

KirstenS: /* Example1 */

2008-09-14T12:25:41Z

‎Example1

KirstenS: /* Example1 */

2008-09-14T12:25:22Z

‎Example1

KirstenS: /* Example1 */

2008-09-14T12:23:48Z

‎Example1

KirstenS: /* Description */

2008-09-14T12:22:44Z

‎Description

@@ Line 127: / Line 127: @@
   #include  <stdio.h>
   #include  <string.h>
-  #include  <stlib.h>
+  #include  <stdlib.h>
   int main (int argc, char **argv)
+  {
-  	char buf [100]
+  	char buf [100];
-  	int x = 1
+  	int x = 1 ;
   	snprintf ( buf, sizeof buf, argv [1] ) ;
-  	buf [ sizeof buf -1 ] = 0
+  	buf [ sizeof buf -1 ] = 0;
   	printf ( “Buffer size is: (%d) \nData input: %s \n” , strlen (buf) , buf ) ;
   	printf ( “X equals: %d/ in hex: %#x\nMemory address for x: (%p) \n” , x, x, &x) ;
@@ Line 145: / Line 145: @@
   ./formattest “Bob”
-  Buffer size is (16)
+  Buffer size is (3)
   Data input : Bob
   X equals: 1/ in hex: 0x1
@@ Line 154: / Line 154: @@
   ./formattest “Bob %x %x”
-  Buffer size is (27)
+  Buffer size is (14)
   Data input : Bob bffff 8740
   X equals: 1/ in hex: 0x1

@@ Line 1: / Line 1: @@
 {{Template:Attack}}
@@ Line 11: / Line 10: @@
 The Format String exploit occurs when the submitted data of an input string is evaluated as a command by the application. In this way, the attacker could execute code, read the stack, or cause a segmentation fault in the running application, causing new behaviors that could compromise the security or the stability of the system.
-To understand the attack, itâs necessary to understand the components that constitute it.
+To understand the attack, it’s necessary to understand the components that constitute it.
-â¢The '''Format Function''' is an ANSI C conversion function, like '''printf, fprintf''', which converts a primitive variable of the programming language into a human-readable string representation.
+•The '''Format Function''' is an ANSI C conversion function, like '''printf, fprintf''', which converts a primitive variable of the programming language into a human-readable string representation.
-â¢The '''Format String''' is the argument of the Format Function and is an ASCII Z string which contains text and format parameters, like: '''printf ("The magic number is: %d\n", 1911)''';
+•The '''Format String''' is the argument of the Format Function and is an ASCII Z string which contains text and format parameters, like: '''printf ("The magic number is: %d\n", 1911)''';
-â¢The '''Format String Parameter''', like '''%x %s''' defines the type of conversion of the format function.
+•The '''Format String Parameter''', like '''%x %s''' defines the type of conversion of the format function.
-The attack could be executed when the application doesnât properly validate the submitted input. In this case, if a Format String parameter, like %x, is inserted into the posted data,  the string is parsed by the Format Function, and the conversion specified in the parameters is executed.   However, the Format Function is expecting more arguments as input, and if these arguments are not supplied, the function could read or write the stack.
+The attack could be executed when the application doesn’t properly validate the submitted input. In this case, if a Format String parameter, like %x, is inserted into the posted data,  the string is parsed by the Format Function, and the conversion specified in the parameters is executed.   However, the Format Function is expecting more arguments as input, and if these arguments are not supplied, the function could read or write the stack.
 In this way, it is possible to define a well-crafted input that could change the behavior of the format function, permitting the attacker to cause denial of service or to execute arbitrary commands.
@@ Line 64: / Line 63: @@
 Below are some format parameters which can be used and their consequences:
-â¢"%x" Read data from the stack
+•"%x" Read data from the stack
-â¢"%s" Read character strings from the process' memory
+•"%s" Read character strings from the process' memory
-â¢"%n" Write an integer to locations in the process' memory
+•"%n" Write an integer to locations in the process' memory
@@ Line 136: / Line 135: @@
   	snprintf ( buf, sizeof buf, argv [1] ) ;
   	buf [ sizeof buf -1 ] = 0
-  	printf ( âBuffer size is: (%d) \nData input: %s \nâ , strlen (buf) , buf ) ;
+  	printf ( “Buffer size is: (%d) \nData input: %s \n” , strlen (buf) , buf ) ;
-  	printf ( âX equals: %d/ in hex: %#x\nMemory address for x: (%p) \nâ , x, x, &x) ;
+  	printf ( “X equals: %d/ in hex: %#x\nMemory address for x: (%p) \n” , x, x, &x) ;
   	return 0 ;
+  }
-Next is the output that the program supplies when running with expected inputs. In this case the program received the string âBobâ as input and returned it in the output.
+Next is the output that the program supplies when running with expected inputs. In this case the program received the string “Bob” as input and returned it in the output.
-  ./formattest âBobâ
+  ./formattest “Bob”
   Buffer size is (16)
@@ Line 151: / Line 150: @@
   Memory address for x (0xbffff73c)
-Now  the format string vulnerability will be explored. If the format string parameter â%x %xâ is inserted in the input string, when the format function parses the argument, the output will display the name Bob, but instead of showing the %x string, the application will show the contents of a memory address.
+Now  the format string vulnerability will be explored. If the format string parameter “%x %x” is inserted in the input string, when the format function parses the argument, the output will display the name Bob, but instead of showing the %x string, the application will show the contents of a memory address.
-  ./formattest âBob %x %xâ
+  ./formattest “Bob %x %x”
   Buffer size is (27)
@@ Line 162: / Line 161: @@
 The inputs Bob and the format strings parameters will be attributed to the variable buf inside the code which should take the place of the %s in the Data input. So now the printf argument looks like:
-  printf ( âBuffer size is: (%d) \n Data input: Bob %x %x \nâ , strlen (buf) , buf ) ;
+  printf ( “Buffer size is: (%d) \n Data input: Bob %x %x \n” , strlen (buf) , buf ) ;
 When the application prints the results, the format function will interpret the format string inputs, showing the content of a memory address.

@@ Line 1: / Line 1: @@
 {{Template:Attack}}
@@ Line 10: / Line 11: @@
 The Format String exploit occurs when the submitted data of an input string is evaluated as a command by the application. In this way, the attacker could execute code, read the stack, or cause a segmentation fault in the running application, causing new behaviors that could compromise the security or the stability of the system.
-To understand the attack, it’s necessary to understand the components that constitute it.
+To understand the attack, itâs necessary to understand the components that constitute it.
-•The '''Format Function''' is an ANSI C conversion function, like '''printf, fprintf''', which converts a primitive variable of the programming language into a human-readable string representation.
+â¢The '''Format Function''' is an ANSI C conversion function, like '''printf, fprintf''', which converts a primitive variable of the programming language into a human-readable string representation.
-•The '''Format String''' is the argument of the Format Function and is an ASCII Z string which contains text and format parameters, like: '''printf ("The magic number is: %d\n", 1911)''';
+â¢The '''Format String''' is the argument of the Format Function and is an ASCII Z string which contains text and format parameters, like: '''printf ("The magic number is: %d\n", 1911)''';
-•The '''Format String Parameter''', like '''%x %s''' defines the type of conversion of the format function.
+â¢The '''Format String Parameter''', like '''%x %s''' defines the type of conversion of the format function.
-The attack could be executed when the application doesn’t properly validate the submitted input. In this case, if a Format String parameter, like %x, is inserted into the posted data,  the string is parsed by the Format Function, and the conversion specified in the parameters is executed.   However, the Format Function is expecting more arguments as input, and if these arguments are not supplied, the function could read or write the stack.
+The attack could be executed when the application doesnât properly validate the submitted input. In this case, if a Format String parameter, like %x, is inserted into the posted data,  the string is parsed by the Format Function, and the conversion specified in the parameters is executed.   However, the Format Function is expecting more arguments as input, and if these arguments are not supplied, the function could read or write the stack.
 In this way, it is possible to define a well-crafted input that could change the behavior of the format function, permitting the attacker to cause denial of service or to execute arbitrary commands.
@@ Line 63: / Line 64: @@
 Below are some format parameters which can be used and their consequences:
-•"%x" Read data from the stack
+â¢"%x" Read data from the stack
-•"%s" Read character strings from the process' memory
+â¢"%s" Read character strings from the process' memory
-•"%n" Write an integer to locations in the process' memory
+â¢"%n" Write an integer to locations in the process' memory
@@ Line 135: / Line 136: @@
   	snprintf ( buf, sizeof buf, argv [1] ) ;
   	buf [ sizeof buf -1 ] = 0
-  	printf ( “Buffer size is: (%d) \nData input: %s \n” , strlen (buf) , buf ) ;
+  	printf ( âBuffer size is: (%d) \nData input: %s \nâ , strlen (buf) , buf ) ;
-  	printf ( “X equals: %d/ in hex: %#x\nMemory address for x: (%p) \n” , x, x, &x) ;
+  	printf ( âX equals: %d/ in hex: %#x\nMemory address for x: (%p) \nâ , x, x, &x) ;
   	return 0 ;
+  }
-Next is the output that the program supplies when running with expected inputs. In this case the program received the string “Bob” as input and returned it in the output.
+Next is the output that the program supplies when running with expected inputs. In this case the program received the string âBobâ as input and returned it in the output.
-  ./formattest “Bob”
+  ./formattest âBobâ
   Buffer size is (16)
@@ Line 150: / Line 151: @@
   Memory address for x (0xbffff73c)
-Now  the format string vulnerability will be explored. If the format string parameter “%x %x” is inserted in the input string, when the format function parses the argument, the output will display the name Bob, but instead of showing the %x string, the application will show the contents of a memory address.
+Now  the format string vulnerability will be explored. If the format string parameter â%x %xâ is inserted in the input string, when the format function parses the argument, the output will display the name Bob, but instead of showing the %x string, the application will show the contents of a memory address.
-  ./formattest “Bob %x %x”
+  ./formattest âBob %x %xâ
   Buffer size is (27)
@@ Line 161: / Line 162: @@
 The inputs Bob and the format strings parameters will be attributed to the variable buf inside the code which should take the place of the %s in the Data input. So now the printf argument looks like:
-  printf ( “Buffer size is: (%d) \n Data input: Bob %x %x \n” , strlen (buf) , buf ) ;
+  printf ( âBuffer size is: (%d) \n Data input: Bob %x %x \nâ , strlen (buf) , buf ) ;
 When the application prints the results, the format function will interpret the format string inputs, showing the content of a memory address.

@@ Line 5: / Line 5: @@
 <br>
 [[Category:OWASP ASDR Project]]
 ==Description==

@@ Line 5: / Line 5: @@
 <br>
 [[Category:OWASP ASDR Project]]
-[[ASDR Table of Contents]]__TOC__
+[[ASDR Table of Contents]]
 ==Description==

@@ Line 169: / Line 169: @@
 '''Denial of Service'''
-In this case,  when  an invalid address of memory is requested, normally the program is terminated.
+In this case,  when an invalid memory address is requested, normally the program is terminated.
   printf (userName);

@@ Line 164: / Line 164: @@
   printf ( “Buffer size is: (%d) \n Data input: Bob %x %x \n” , strlen (buf) , buf ) ;
-When the application prints the results, the format function will interpret the format string inputs showing the content of a memory address.
+When the application prints the results, the format function will interpret the format string inputs, showing the content of a memory address.
 ===Example 2===

@@ Line 121: / Line 121: @@
 ===Example1===
-The example demonstrates how the application can behave when the format function does not receive the necessary treatments for the validation in the input of format string.
+This example demonstrates how the application can behave when the format function does not receive the necessary treatments for validation in the input of format string.
-First is shown the application operating with normal behavior and normal inputs, then, the application operating when the attacker input the format string and the resultant behavior.
+First is the application operating with normal behavior and normal inputs, then, the application operating when the attacker inputs the format string and the resulting behavior.
 Below is the source-code used for the example.

← Older revision		Revision as of 12:22, 14 September 2008
Line 72:		Line 72:

	To discover whether the application is vulnerable to this type of attack, it's necessary to verify if the format function accepts and parses the format string parameters shown in table 2.		To discover whether the application is vulnerable to this type of attack, it's necessary to verify if the format function accepts and parses the format string parameters shown in table 2.
		+

	'''Table 2. Common parameters used in a Format String Attack.'''		'''Table 2. Common parameters used in a Format String Attack.'''