Intro Format String Vulnerability | PicoCTF 2017 [39] "I've Got a Secret"

[@alexpaww]

I think the binary running on the server was 64bit? If so, the stack layout could have been slightly different, this screwing up the results

[@_JohnHammond]

Oooooh! That must be it. I'll recompile our source binary as 64-bit and see if the stack layout matches up a bit better. Good call!!

[@WhiterockFTP]

John Hammond did it?

[@alexpaww]

I love the new intro dude!

[@jakegamingking5355]

Love it keep it up i want something beginner friendly if you have any series on those

[@DHIRAL2908]

Thanks man! Really helped me understand it!!!

[@neafirmisani5199]

help, I want to learn reverse enigneeing. Do you have any website for learning reverse engineering? for beginners?

[@_JohnHammond]

Reverse engineering is hard to learn; I am still pretty bad at it. But crackmes.one/ is a good site to practice, it has does have a lot of binaries to learn reversing with.

[@sluge1]

That's interesting, thanks)

[@statistics5607]

is String format attack even possible if we don't have the source code of the binary?

[@omerreich1926]

It is, but you will have to brute force the offset, and this makes it less practical in most softwares.

[@adamkadaban]

@@omerreich1926 def don't _have_ to bruteforce it. You can find it in gdb

[@adamkadaban]

@@oppenheimer11 I have a GitHub repo called Adamkadaban/LearnPwn Look in the canary folder. it details a challenge that leaks a stack canary using a format string vulnerability and does so in a procedural way

[@adamkadaban]

@@oppenheimer11 the 3rd one. feel free to dm me on twitter if you need any help

[@sorrefly]

what about changing the secret in the stack to a custom value using %n

[@James-wg2qm]

nice Shirt :) Gauntlet

[@vaibhavanand470]

what if we are just given the binary and not the source code? example: this challenge backdoor.sdslabs.co/challenges/weekly-1-3

[@houba1263]

how can i get the flag when im not connected to the server i have to use pwn tools?