Format String Exploit and overwrite the Global Offset Table - bin 0x13

-=[ 🔴 Stuff I use ]=-

-=[ ❤️ Support ]=-

-=[ 🐕 Social ]=-

-=[ 📄 P.S. ]=-

All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.

#BinaryExploitation #FormatString

[nikoshalk]

Probably one of the hardest exploits to grasp in your series, but once you do, damn! It's beautiful

[mequambluespark]

can't overwrite the return pointer? no prob, we GOT this :P

[thrndm]

now..that's a lot of info to grasp....and again...i'm going to watch this 10 times

[rakshitawasthi]

This channel is the best for learning Binary Exploitation, thanks for those amazing videos.

[stek]

For the "double write", instead of %n(int*), we could use %hn(short int*)

[epicm]

That method of setting the GOT entry from 0x84b4 to 0x0804 is insanely cool. What I did was write the bytes in reverse, where I switched the order of the addresses I used as input and wrote 0x0804 to the first half of the address and then then wrote 0x84b4 to the second half. Worked in format3, but I've got to try your method too.

[nicolasschleicher]

I've had to watch this a few times to understand it but I've learned a lot. Carry on doing what you do!

[grelyelo]

Thanks this video really helped with my school assignment to overwrite the GOT

[sciencebug]

you could also write individual bytes with "%hhn" (half half int = byte)

[Anonymouspock]

Python tip @5:10: this pad function should just be .ljust(512, 'X')

[dplastico]

Im a big fan, I know this is old, but the EXIT_PLT name confuses, cause its actually EXIT at GOT, right? Such a good material keep up the good work!

[Occcc]

Awesome tutorial as usual.
By the way, do you use the shellcoder's handbook as resource for making these? It seems like you cover the book's topic in sequence pretty smoothly, which also lines up with the exploit exercises.

[typedeaf]

Question you ask @10:13 "How do we get a lower number, if we can only increase the amount of character?"
I would respond with, "You write the lower number first?"
I am guessing that the reason you don't write the lower number first, is because of what you mention later, about the least significant bytes actually overwriting the entire 4 bytes? ie. the second write would clobber the higher bytes from the first write. Is that right?

[rekhispagatos]

good stuff.. thanks for showing people how to hack and not to use auto-tools. <3

[niektuytel]

i think actually 4000 people look this video 10 times XD

[xkjg]

6:58 i am not sure what is that supposed to mean: does the size of buffer matter? as long as the 134513844 is not bigger as the max memory limit of the current process(or stack?), we can at the end overwrite address in GOT.

[__mk_km__]

We can divide the address further into bytes, so we need to print even less.

Also, why do you pad the input there? I don't think its required for the exploit to work.

[tenghaooo]

wow i think this is the most difficult episode so far

[Zuzu-fqiv]

For me, i always use "info functions" in GDB because it will display all the functions and their address in the program

[achyuthvishwamithra]

Why is the global offset table's address remaining the same? Won't it change with ASLR?