Exploit › Module 2 › Lesson 3
Format String Named
Format string bugs misuse printf-family format specifiers — name the class on $PWN_LAB; defenders use constant format strings and -Wformat.
Visual · pwn_format_string_named
Format string class literacy. $PWN_LAB only. Original Cyberlium.
Opening
When user input becomes the format string, the program trusts attacker-controlled directives — a named class, not a stack-reading tutorial.
printf(user_input) is unsafe: specifiers like %x and %n interpret stack or memory contents. Legitimate code uses printf("%s", user_input) — format string is constant. Impact ranges from info leak to memory writes depending on platform and mitigations — defenders prevent the bug at source. Cyberlium names format-string misuse on YOUR toy C at $PWN_LAB — observe crash or sanitizer report, not %n write recipes. Next: Classes Lab.
1. Constant format vs attacker-controlled format
Safe: printf("%s ", name). Unsafe: printf(name) when name is user-controlled. Same rule applies to sprintf, fprintf, syslog with variable format.
On $PWN_LAB, compile a toy that passes argv[1] directly to printf — note warning or sanitizer finding; do not craft arbitrary write chains.
Command guide
Try these commands — Constant format vs attacker-controlled format
═══ LINUX (Binary Analysis & Reverse Engineering) ═══
Disassemble main function using Intel assembly syntax
Command — copy this
objdump -d -M intel -j .text ./target_binary 2>/dev/null | head -30
Check binary security mitigations (NX, Canary, ASLR, PIE)
Command — copy this
checksec --file=./target_binary 2>/dev/null || readelf -l ./target_binary | grep GNU_STACK
Generate unique cyclic pattern for buffer overflow offset calculation
Command — copy this
python3 -c "
from itertools import product
chars = [b'A', b'B', b'C']
pattern = b''.join(b''.join(p) for p in product(b'ABCDEFGHIJKLMNOPQRSTUVWXYZ', b'abcdefghijklmnopqrstuvwxyz', b'0123456789'))[:128]
print('Cyclic Test Pattern (128 bytes):', pattern.decode())
"GDB debugging session quick start gdb -q ./target_binary (gdb) disassemble main (gdb) info registers
Primary tools to practice this lesson: gcc, curl. Reference sites: CWE-134 (https://cwe.mitre.org/data/definitions/134.html); CWE-120 (https://cwe.mitre.org/data/definitions/120.html); LiveOverflow (https://www.youtube.com/c/LiveOverflow). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why the class matters to defenders
Info leaks aid further attacks in adversary models — your job is to eliminate the bug class in code you ship. Compiler -Wformat and -Wformat-security flag many mistakes.
Static analysis and code review check for non-literal format strings in privileged code paths.
3. Mitigations and secure habits
Always pass user data as variadic arguments, never as the format. Prefer C++ iostreams or rust fmt for new code. FORTIFY and modern libc reduce some impact — still fix the call site.
Ship: format-string card — safe vs unsafe call pattern, one compiler flag, one $PWN_LAB finding. Next: Classes Lab.
4. What you ship: format string class card for $PWN_LAB
Safe vs unsafe printf pattern. -Wformat note. Toy finding — no %n exploit steps. chmod 600.
5. What you record before the next lesson
Date. Format string card. $PWN_LAB named. File t24-m02-l03-format-string-named.txt chmod 600.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Tutorial on %n arbitrary write. Run format bug against production logging.
Right
Write format string class card from YOUR toy. Next: Classes Lab.
Mission: name format string bug class
1) Write safe vs unsafe printf example in comments. 2) Name -Wformat-security purpose. 3) Quote one sanitizer or warning line from toy. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Fixing printf(user) to printf("%s", user) is real security work.
Knowledge Check
APPLY: Format string literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: printf(user_input) is unsafe when user_input is untrusted.
True or False
Knowledge Check
APPLY: Safer pattern is:
Multiple choice