FSB (Format String Bug)

FSB (Format String Bug)

---

FSB (Format String Bug) is one of the buffer overflow hacking techniques — a vulnerability that lets you change the program's flow through the user's input.

FSB (Format String Bug)

1. The number of printf's arguments is determined by the number of format characters.
2. If we can freely input the value of buf, we can put in the format characters we want and manipulate it.
3. You can obtain the desired value even without a BOF occurring.

printf("%d", variable); vs printf("%d")

In the situation on the right, the FSB vulnerability occurs and you can expose all the contents of the main function's stack.

%p output

1. Through %p you can leak the next address, and through %[number]$p you can output the memory that number of positions away.

The state where AAAA went into the 2nd position

Entering it as above lets you leak the memory of the next stack. Above, you can confirm the AAAA we entered went into the second %p. Here the offset is 2.

%n input

1. This time it's not just leaking, but tampering with the stack's value.
2. %n writes, into the specified variable, the number of characters output before the %n, in decimal format.
3. %n : 4 bytes, %hn : 2 bytes, %hhn : 1 byte

printf's format characters

<table style="border-collapse: collapse; width: 100%; height: 180px;" border="1" data-ke-align="alignLeft"><tbody><tr style="height: 20px;"><td style="width: 50%; text-align: left; height: 20px;">%s</td><td style="width: 50%; text-align: left; height: 20px;">outputs a string until it meets '\0'</td></tr><tr style="height: 20px;"><td style="width: 50%; height: 20px;">%c</td><td style="width: 50%; height: 20px;">1 character</td></tr><tr style="height: 20px;"><td style="width: 50%; height: 20px;">%d</td><td style="width: 50%; height: 20px;">+/- signed integer</td></tr><tr style="height: 20px;"><td style="width: 50%; height: 20px;">%x</td><td style="width: 50%; height: 20px;">integer as lowercase hex</td></tr><tr style="height: 20px;"><td style="width: 50%; height: 20px;">%p</td><td style="width: 50%; height: 20px;">outputs a pointer value in 0x~ form, same as %lx</td></tr><tr style="height: 20px;"><td style="width: 50%; height: 20px;">%lx</td><td style="width: 50%; height: 20px;">outputs 8-byte hex</td></tr><tr style="height: 20px;"><td style="width: 50%; height: 20px;">%ld</td><td style="width: 50%; height: 20px;">long integer type</td></tr><tr style="height: 20px;"><td style="width: 50%; height: 20px;">%f</td><td style="width: 50%; height: 20px;">floating-point type</td></tr><tr style="height: 20px;"><td style="width: 50%; height: 20px;">%u</td><td style="width: 50%; height: 20px;">unsigned integer </td></tr></tbody></table>

In python

In actual fsb code it gets very complicated, but you can solve this easily with Python's pwntools.

Using fmtstr_payload(offset, writes), you can do fsb very simply.

fmtstr_payload(6, {e.got['printf']:e.symbols['win']})

Writing it as above, when the offset is 6, you can make printf become the win function.

Reference

See more

https://snwo.tistory.com/147

https://jiravvit.tistory.com/entry/64bit%EC%97%90%EC%84%9C-FSB-Format-String-Bug-%EC%9D%B4%ED%95%B4%ED%95%98%EA%B8%B0-1

---

Original (Korean): tistory — published 2021-09-09, migrated to this blog. This translation was generated with the help of AI.