title: Format String Vulnerability Lab
body: <p>First year Cybersecurity student here (I am new to a lot of things, like Linux and such)</p>
  
  <p>I am having some trouble modifying a secret value in my lab.
  Here is what I need to do for it</p>
  
  <ul>
  <li><p>gcc -z execstack -o vul_prog vul_prog.c</p></li>
  <li><p>sudo chown root vul_prog</p></li>
  <li><p>sudo chmod +s vul_prog</p></li>
  </ul>
  
  <p>Do the following successfully using a string format vulnerability
   Crash program</p>
  
  <ul>
  <li><p>Print secret value secret</p></li>
  <li><p>Modify secret value secret</p></li>
  <li><p>Modify secret value secret with a predetermined value 0x42454546</p></li>
  <li><p>Get a root shell (extra credit)</p></li>
  </ul>
  
  <p>here is the code that we are using </p>
  
  <pre><code>/*vul_prog.c*/
  #include&lt;stdio.h&gt;
  #include&lt;stdlib.h&gt;
  
  #define SECRET 0x44
  
  int main(int argc, char*argv[]) {
      char user_input[200];
      int secret;
      int a, b, c, d; /*other variables, not used here.*/
  
      /*getting the secret*/
      secret = SECRET;
  
      printf("The variable secretâ€™s address is 0x%8x\n", (unsigned int)&amp;secret);
      printf("The variable secretâ€™s value is 0x%x or %d\n", (unsigned int)secret, secret);
  
      printf("Please enter a string\n");
      scanf("%s", user_input); /*getting a string from user*/
  
      /*Vulnerable place*/
      printf(user_input);
      printf("\n");
  
      /*Verify whether your attack is successful*/
      printf("The original secret: 0x%x or %d\n", SECRET, SECRET);
      printf("The new secret: 0x%x or %d\n", secret, secret);
  
      return 0;
  }
  </code></pre>
  
  <p>I know what my secret value is, but I couldn't modify it. I know the commands that I have to use. I need to modify where 44 is stored at. In my case, the address is 0xbfffeb60</p>
  
  <pre><code>[10/23/19]seed@VM:~/Desktop$ ./vul_prog
  The variable secret’s address is 0xbfffeb60
  The variable secret’s value is 0x44 or 68
  Please enter a string
  .%x.%x.%x.%x.%x.%x.%x.%x.%x.%x
  .bfffeb64.44.b7fd6b28.b7ff37ec.0.b7fff000.bfffece4.44.2e78252e.252e7825
  The original secret: 0x44 or 68
  The new secret: 0x44 or 68
  </code></pre>
  
  <p>The commands I used so far</p>
  
  <p><code>sudo sysctl -w kernel.randomize_va_space=0</code></p>
  
  <p><code>gcc -z execstack -o vul_prog vul_prog.c</code></p>
  
  <p><code>sudo chown root vul_prog</code></p>
  
  <p><code>sudo chmod +s vul_prog</code></p>
  
  <p>after that, I ran the program <code>./vul_prog</code> and entered a bunch of %x to get address printed out. My professor said that the code for <code>vul_prog.c</code> is slightly modified from the original, and my book uses the original code and it gives the steps on how to modify it by using </p>
  
  <p><code>echo $(printf "\x04\xf3\xff\xbf").%x.%x.%x.%x.%x.%n &gt; input</code></p>
  
  <p><code>vul &lt; input</code></p>
  
  <p>here's what input file looks like after</p>
  
  <p><code>Póÿ¿.%x.%x.%x.%x.%x.%x.%x.%x.%n</code></p>
  
  <p>after I run these commands, nothing changes. Then I added 3 more of ".%x" and %n at the end and still nothing. When I try to do it with only </p>
  
  <p><code>.%x.%x.%x.%x.%x.%x.%x.%x.%n</code></p>
  
  <p>it will give me a segmentation error</p>
  
  <p>I tried emailing him today in the morning to ask him if I could meet him in his office and show him what I am doing wrong and he haven't responded yet, so I am hoping to get some more guidance from anyone who is an expert in his field.</p>
  
  <p>I will add more information if needed.</p>