# Format String Exploitation

Format string exploitation playbook.

- Repository: https://github.com/yaklang/hack-skills (2601 stars)
- Category: Security
- License: MIT
- Last updated: 2026-09-13
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add yaklang/hack-skills --skill format-string-exploitation -g -a claude-code -y`
Codex: `npx skills add yaklang/hack-skills --skill format-string-exploitation -g -a codex -y`
Cursor: `npx skills add yaklang/hack-skills --skill format-string-exploitation -g -a cursor -y`
Gemini CLI: `npx skills add yaklang/hack-skills --skill format-string-exploitation -g -a gemini-cli -y`

## Description

Format string exploitation playbook. Use when printf-family functions receive user-controlled format strings, enabling arbitrary stack reads (%p/%s), arbitrary memory writes (%n/%hn/%hhn), GOT/hook overwrites, and canary/libc/PIE leaks.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# SKILL: Format String Exploitation, Expert Attack Playbook

> **AI LOAD INSTRUCTION**: Expert format string techniques. Covers stack reading, arbitrary write via %n, GOT overwrite, __malloc_hook overwrite, pointer chain exploitation, blind format string, FORTIFY_SOURCE bypass, 64-bit null byte handling, and pwntools automation. Distilled from ctf-wiki fmtstr, CTF patterns, and real-world scenarios. Base models often miscalculate positional parameter offsets or forget 64-bit address placement after format string.

## 0. RELATED ROUTING

- [stack-overflow-and-rop](../stack-overflow-and-rop/SKILL.md), combine format string leak with stack overflow for full exploit
- [binary-protection-bypass](../binary-protection-bypass/SKILL.md), format string is the primary canary/PIE/ASLR leak method
- [arbitrary-write-to-rce](../arbitrary-write-to-rce/SKILL.md), convert format string write primitive to code execution targets
- [heap-exploitation](../heap-exploitation/SKILL.md), heap address leak via format string for heap exploitation

---

## 1. VULNERABILITY IDENTIFICATION

### Vulnerable Pattern

```c
printf(user_input);          // VULNERABLE: user controls format string
fprintf(fp, user_input);     // VULNERABLE
sprintf(buf, user_input);    // VULNERABLE
snprintf(buf, sz, user_input); // VULNERABLE

printf("%s", user_input);    // SAFE: format string is fixed
```

### Quick Test

```
Input: AAAA%p%p%p%p%p%p%p%p
If output shows stack values (hex addresses): format string confirmed
Look for 0x4141414141414141 in output to find your input offset
```

---

## 2. READING MEMORY

### Stack Leak (%p)

| Format | Action | Use |
|---|---|---|
| `%p` | Print next stack value as pointer | Sequential stack dump |
| `%N$p` | Print N-th parameter as pointer | Direct positional access |
| `%N$lx` | Same as %p but explicit hex (64-bit) | Portable |
| `%N$s` | Dereference N-th parameter as string pointer | Read memory at pointer value |

### Finding Your Input Offset

The rest: https://github.com/yaklang/hack-skills/blob/HEAD/skills/format-string-exploitation/SKILL.md