格式化字符串漏洞：任意写

漏洞程序vuln.c

#include <stdio.h>

int auth = 0;

int main() {
    char password[100];

    puts("Password: ");
    fgets(password, sizeof password, stdin);
    
    printf(password);
    printf("Auth is %i\n", auth);

    if(auth == 10) {
        puts("Authenticated!");
    }
  }

程序分析

1. 编译

gcc -m32 -no-pie -fno-stack-protector -z execstack vuln.c -o vuln

程序保护：

└─$ checksec --file=./vuln
[*] '/home/kali/exploits/str_arb_write/vuln'
    Arch:     i386-32-little