Format String printf Vulnerabilities (PicoCTF 2022 #46 'flag-leak')

Help the channel grow with a Like, Comment, & Subscribe!
Check out the affiliates below for more free or discounted learning!

📧Contact me! (I may be very slow to respond or completely unable to)

[rey]

i look forward to these videos every day and I'm not even signed-up for the CTF. hearing how you think through these challenges is priceless.

[LDowning]

Cool challenge and a great video. Keep them coming sir.

[fart_mnster_]

Cool! I didn't realize printf could be dangerous every time I used it. Thankyou for teaching something new

[verolyn]

Cool, didnt know a simple printf can be weaponize

[tekneinINC]

That was a pretty cool one. Never though of printf as being an exploit to walk through the stack like that, being able to see and -even better- write to env variables…. seems like it could be useful in a future challenge.

[dtvdavid]

I laughed hard when I saw that "vuln" vomited garbage data and other variables. I know it could be dangerous in production environment, but that was fun! :'D

[abdelHsn]

thank you as always for you incredible video.

[arbibab]

That was cool! This world needs more hackers like you John:)

[mcw]

Format strings vulns is my favourite, pity its pretty rare at IRL - stil I did found one exploitable in the wild once ))

[d]

Hey John I found a CVE in an email provider, tried to inform them about it so that I could help them fix it for some cash but they didn't care and they still haven't fixed it months later 😬 what would you do in this scenario 🤔

[Colaholiker]

Could the missing "pico" and "john" be an alignment thing? Both are 4 bytes long... 🤔

[almatsumalmaadi]

Just imagine if the memory was filled with a sensitive information!! All of them will be leaked!!?

[MrHuyche]

So how do you capture the whole flag, including 'pico'?

[passaronegro]

hello ..would it be possible to put subtitles in portuguese ?? because we follow here in Brazil!!🇧🇷

[aminela]

I'm wondering if %23$s.%24$s works well🙄

[LinuxJedi]

there’s a literal man page function in the terminal cmon man