I made a little program for you to try to hack, as a demonstration of format string vulns.
It's quite easy to crash, and getting data from the stack isn't that hard.
Here's the code:
- Code: Select all
//This was only tested with Code::Blocks on Windows XP:
char str ;
printf("Welcome to hackme #1!\n\n");
printf("TESO's Format String vuln info may be useful.\nIt can be found at \"http://www.win.tue.nl/~aeb/linux/hh/formats-teso.html\".\n\nGood Luck!\n\n");
printf("You have 2 goals:\n *Crash The program.\n *Fetch any data from the stack.\n\n");
printf("Enter your name: ");
//I don't know about printf("Hello, %s.", str);
And for those of you who want to cheat (select to view):
To crash the program:
Or, buffer overflow style (92 a's!):
To get data from the stack [WIP]: