資訊

• Question: Format string 0
• From: picoCTF Binary Exploitation
• Difficulty: 50 points

---

目錄

• 資訊
• 目錄
• 題目
• 解法
  • 概念

---

題目

Can you use your knowledge of format strings to make the customers happy?

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <signal.h>
#include <unistd.h>
#include <sys/types.h>

#define BUFSIZE 32
#define FLAGSIZE 64

char flag[FLAGSIZE];

void sigsegv_handler(int sig) {
    printf("\n%s\n", flag);
    fflush(stdout);
    exit(1);
}

int on_menu(char *burger, char *menu[], int count) {
    for (int i = 0; i < count; i++) {
        if (strcmp(burger, menu[i]) == 0)
            return 1;
    }
    return 0;
}

void serve_patrick();

void serve_bob();


int main(int argc, char **argv){
    FILE *f = fopen("flag.txt", "r");
    if (f == NULL) {
        printf("%s %s", "Please create 'flag.txt' in this directory with your",
                        "own debugging flag.\n");
        exit(0);
    }

    fgets(flag, FLAGSIZE, f);
    signal(SIGSEGV, sigsegv_handler);

    gid_t gid = getegid();
    setresgid(gid, gid, gid);

    serve_patrick();
  
    return 0;
}

void serve_patrick() {
    printf("%s %s\n%s\n%s %s\n%s",
            "Welcome to our newly-opened burger place Pico 'n Patty!",
            "Can you help the picky customers find their favorite burger?",
            "Here comes the first customer Patrick who wants a giant bite.",
            "Please choose from the following burgers:",
            "Breakf@st_Burger, Gr%114d_Cheese, Bac0n_D3luxe",
            "Enter your recommendation: ");
    fflush(stdout);

    char choice1[BUFSIZE];
    scanf("%s", choice1);
    char *menu1[3] = {"Breakf@st_Burger", "Gr%114d_Cheese", "Bac0n_D3luxe"};
    if (!on_menu(choice1, menu1, 3)) {
        printf("%s", "There is no such burger yet!\n");
        fflush(stdout);
    } else {
        int count = printf(choice1);
        if (count > 2 * BUFSIZE) {
            serve_bob();
        } else {
            printf("%s\n%s\n",
                    "Patrick is still hungry!",
                    "Try to serve him something of larger size!");
            fflush(stdout);
        }
    }
}

void serve_bob() {
    printf("\n%s %s\n%s %s\n%s %s\n%s",
            "Good job! Patrick is happy!",
            "Now can you serve the second customer?",
            "Sponge Bob wants something outrageous that would break the shop",
            "(better be served quick before the shop owner kicks you out!)",
            "Please choose from the following burgers:",
            "Pe%to_Portobello, $outhwest_Burger, Cla%sic_Che%s%steak",
            "Enter your recommendation: ");
    fflush(stdout);

    char choice2[BUFSIZE];
    scanf("%s", choice2);
    char *menu2[3] = {"Pe%to_Portobello", "$outhwest_Burger", "Cla%sic_Che%s%steak"};
    if (!on_menu(choice2, menu2, 3)) {
        printf("%s", "There is no such burger yet!\n");
        fflush(stdout);
    } else {
        printf(choice2);
        fflush(stdout);
    }
}

---

解法

說實話這題還沒看 source code 就解出來了，介面打開就像是把所有選擇跑過一次就會有 flag，啊剛好運氣又很好，很快就寫出來，不過還是仔細走一次程式碼吧！

Format string 的概念是使用者輸入的字串多了幾個壞壞的 % 這種特殊符號，而 programmer 沒有針對這部份好好濾除，反而直接拿來用，就會造成攻擊，簡單來說就是違反 "Seperate code from data" 的原則

舉例來說，programmer 想要做一個 echo 指令的功能，就寫了這段程式碼

#include <stdio.h>

int main()
{
    char str[100] = {0};
    fgets(str, 100, stdin);
    printf(str);
    return 0;
}

使用者輸入 "Hello world"，程式就會印出 "hello world"，因為第 7 行回被轉換成 printf("hello world")

但如果使用者今天輸入 "%s" 呢？程式碼第 7 行會變成 printf("%s")，這時候程式就會讀取 format string 上面的記憶體內容了，詳細可以去看 format string 的用法，或看看 printf 這種函式是怎麼存取需要的變數

概念