SKILL: Format String Exploitation, Expert Attack Playbook

AI LOAD INSTRUCTION: Expert format string techniques. Covers stack reading, arbitrary write via %n, GOT overwrite, __malloc_hook overwrite, pointer chain exploitation, blind format string, FORTIFY_SOURCE bypass, 64-bit null byte handling, and pwntools automation. Distilled from ctf-wiki fmtstr, CTF patterns, and real-world scenarios. Base models often miscalculate positional parameter offsets or forget 64-bit address placement after format string.

0. RELATED ROUTING

• stack-overflow-and-rop, combine format string leak with stack overflow for full exploit
• binary-protection-bypass, format string is the primary canary/PIE/ASLR leak method
• arbitrary-write-to-rce, convert format string write primitive to code execution targets
• heap-exploitation, heap address leak via format string for heap exploitation

---

1. VULNERABILITY IDENTIFICATION

Vulnerable Pattern

printf(user_input);          // VULNERABLE: user controls format string
fprintf(fp, user_input);     // VULNERABLE
sprintf(buf, user_input);    // VULNERABLE
snprintf(buf, sz, user_input); // VULNERABLE

printf("%s", user_input);    // SAFE: format string is fixed

Quick Test

Input: AAAA%p%p%p%p%p%p%p%p
If output shows stack values (hex addresses): format string confirmed
Look for 0x4141414141414141 in output to find your input offset

---

2. READING MEMORY

Stack Leak (%p)

Format	Action	Use
%p	Print next stack value as pointer	Sequential stack dump
%N$p	Print N-th parameter as pointer	Direct positional access
%N$lx	Same as %p but explicit hex (64-bit)	Portable
%N$s	Dereference N-th parameter as string pointer	Read memory at pointer value

Finding Your Input Offset