tehmoon

Format0 introduces format string vulnerabilities.

The vuln relies on the fact that user input is not sanitized and can be used as format string fed into the printf family.

In this example sprintf() is used. It takes at least 2 arguments, the destination's string and the source's string. The idea is to do a classic buffer overflow and write 0xdeadbeef to target.

Here's the following exploit:

This is specific to Alpine using the go apk.

Compiling go binaries in same arch:

go build -buildmode exe -ldflags '-linkmode external -extldflags "-static"' .

Compiling go binaries in other arch:

extract the whole forked branch from merge commit:

git log @~1..@^2

Get all the tags that contain the commit:

git tag --contain

Run as:

powershell -ExecutionPolicy bypass Start-Process  .\log-exporter.exe, -Verb, RunAs, -ArgumentList "-u `"blih`""

Escape string + get current user:

$blih = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name

	package main

	import (
	"io"
	"syscall"
	"os"
	"errors"
	)

	func main() {

	package main

	import (
	"os"
	"os/exec"
	"io"
	"strings"
	"github.com/kr/pty"
	)

	package main

	import (
	"net/http"
	"fmt"
	"io"
	"os"
	"log"
	"crypto/x509"
	"crypto/x509/pkix"

	package main

	import (
	"io"
	"os"
	"net/http"
	"net/http/httputil"

	"net"
	"golang.org/x/crypto/ssh/terminal"

	package main

	import (
	"flag"
	"fmt"
	"os"
	)

	type Flags struct {
	}

	package main

	/*
	The goal of this PoC is to try to exec a payload built within the binary.
	I kind of use the same idea as for protobuf, compile the target into executable
	then copy the payload inside the program, do the reverse operation and exec it.

	It works like this:
	- compile your binary to the target arch
	- use cryptocli dd -in <binary> -encoders gzip,byte-string -out <temp_file>