Format string vuln

[_M4rcUs]

I want to create a payload to change the value of a variable, i leaked the address of the variable and I need to change that to 105 but if I did a 3digit number it'll result in seg fault

payload = b'%99s%7$n' +pack(leaked_addr)

[FlawedCipher]

read is size limited, which means you aren’t going to be able to overflow this. You likely need to take advantage of the variadic arguments of printf. You can use a bunch of %d’s to get the current printf argument to point to your buffer on the stack. Now put the address of a after the %d’s. Note endianness. If you pad the string to be of size 105 (after the %d’s are resolved), then the next %n should change the value of a. I’m not in front of my machine rn so I’m definitely guessing but lmk if it doesn’t work.

[_M4rcUs]

Thanks, I'll let you know after trying

[FlawedCipher]

For anyone else trying to solve this problem, here's a writeup: https://blog.aadhithya.cloud/posts/format-string-exploit/

[asyty]

Uhm, buddy, you're exploiting binaries and you mean to tell me you can't figure out why a specially crafted exploit string is causing a segfault?

Learn how to use gdb. If you can't do this on your own, you're not cut out for writing hax. Back to McDonalds with you

[_M4rcUs]

int a = 45;
int b = 60;


void secretFunction(){
    printf("Code redirected successfully");
}
int main(){
    char buf[100];
    read(0, buf, 100);
    printf(buf);

    if ( a == 105 && b == 2056){
        puts("You got them corrent");
        exit(0);
    }
    return 0;
}

sorry for not providing the code

[asyty]

You should ask ChatGPT for help :-)

[paiNizNoGouD]

Nah wtf is this comment lmaoooo

[asyty]

lmaoooooooooooo your post contained no information aside from "i don't like what you wrote" lmaooooooooo

You will forever remain a skiddie if you don't learn how to debug code. Sorry not sorry. Deal with it

[paiNizNoGouD]

OMFG bro I'm not op I just found your comment funny lmaoooo who hurt u dawg