Format String printf Vulnerabilities (PicoCTF 2022 #46 'flag-leak')

[@rey3081]

i look forward to these videos every day and I'm not even signed-up for the CTF. hearing how you think through these challenges is priceless.

[@LDowning0190]

Cool challenge and a great video. Keep them coming sir.

[@tekneinINC]

That was a pretty cool one. Never though of printf as being an exploit to walk through the stack like that, being able to see and -even better- write to env variables…. seems like it could be useful in a future challenge.

[@verolyn8459]

Cool, didnt know a simple printf can be weaponize

[@skeeberk.h.4396]

My favorite Vulnerability

[@abdelHsn]

thank you as always for you incredible video.

[@adam-nw5cn]

thank you for making this ♥️♥️

[@dtvdavid]

I laughed hard when I saw that "vuln" vomited garbage data and other variables. I know it could be dangerous in production environment, but that was fun! :'D

[@arbibab]

That was cool! This world needs more hackers like you John:)

[@alimustafa2682]

Let’s roll !!

[@mcw67]

Format strings vulns is my favourite, pity its pretty rare at IRL - stil I did found one exploitable in the wild once ))

[@marveII0us]

Early gang

[@Colaholiker]

Could the missing "pico" and "john" be an alignment thing? Both are 4 bytes long... 🤔

[@somesugar]

I think so

[@d21852]

Hey John I found a CVE in an email provider, tried to inform them about it so that I could help them fix it for some cash but they didn't care and they still haven't fixed it months later 😬 what would you do in this scenario 🤔

[@__theycallmeaadi3316]

Public it.

[@verolyn8459]

Okay if they dont care. then its not your fault.

[@MrHuyche]

So how do you capture the whole flag, including 'pico'?

[@almatsumalmaadi8103]

Just imagine if the memory was filled with a sensitive information!! All of them will be leaked!!?

[@bhagyalakshmi1053]

Shark window opening how to repair

[@bech2342]

just use single or double quotes

[@passaronegro349]

hello ..would it be possible to put subtitles in portuguese ?? because we follow here in Brazil!!🇧🇷

[@mr0x3ss71]

Cool

[@guilherme5094]

👍!

[@ArSiddharth]

Hello!

[@kelsoswimmer7148]

cool

[@aminel2a]

I'm wondering if %23$s.%24$s works well🙄

[@brighthades5968]

no, %23$s was empty or maybe a newline

[@bhagyalakshmi1053]

Red desinr

[@aeion2184]

second

[@firewall_chronicles]

First

[@LinuxJedi]

there’s a literal man page function in the terminal cmon man