format-string-exploitation

An expert attack playbook for exploiting format string vulnerabilities, the class of bugs that arises when printf-family functions such as printf, fprintf, sprintf, and snprintf receive a user-controlled format argument. When an attacker controls the format string, format specifiers become primitives: %p and %s turn into arbitrary stack and memory reads, while %n, %hn, and %hhn become arbitrary memory writes. The playbook walks through confirming the vulnerability (for example sending AAAA%p%p%p... and watching for 0x4141414141414141 to locate the input offset) and distinguishing vulnerable calls from safe fixed-format usage.

The reading section covers sequential and positional stack leaks (%p versus %N$p), dereferencing pointers with %s, and leaking specific targets such as stack canaries, saved RBP, return addresses for PIE base calculation, and libc addresses. The writing section details byte-, short-, and int-width writes with separate 32-bit and 64-bit strategies, notably placing addresses after the format specifiers on 64-bit so embedded null bytes do not terminate the string. Automation is handled through pwntools, using fmtstr_payload() for one-shot GOT overwrites and the interactive FmtStr class with auto-detected offsets.

Later sections turn a write primitive into code execution: overwriting GOT entries (printf, strlen, puts, atoi, exit) to redirect to system, and hook targets like __malloc_hook and __free_hook on glibc before 2.34. Advanced material covers stack pointer chain exploitation when the format string is not directly on the stack, two-stage writes through existing pointer chains, and a blind methodology for remote services with no binary or source. Use it during CTF challenges or real-world binary exploitation whenever a printf-family sink is reachable with attacker input, or when combining a format string leak with stack overflow, canary/PIE/ASLR bypass, or heap exploitation.