format-string-exploitation
This skill covers format string exploitation from vulnerability identification through advanced attack chains. Learn to read stack memory with %p, perform arbitrary writes using %n variants, leak canaries and ASLR offsets, and overwrite GOT entries or hooks for code execution. Includes pwntools automation and blind exploitation techniques.
Format String Exploitation teaches stack reading, memory writes, and GOT overwrites via format string vulnerabilities.
AI-generated summary based on this skill's SKILL.md
Install
yaklang/hack-skills/format-string-exploitation · repository language: CSS
git clone https://github.com/yaklang/hack-skills
cp -r hack-skills/skills/format-string-exploitation ~/.claude/skills/format-string-exploitationnpx skillfed install yaklang/hack-skills/format-string-exploitationFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is format string exploitation tutorial material in this skill?
format-string-exploitation covers the complete attack surface: identifying vulnerable printf calls, reading stack memory with %p to leak canaries and ASLR offsets, performing arbitrary writes via %n and %hn variants, and chaining attacks to overwrite GOT entries or hooks. The skill progresses from basic memory leaks through advanced code-execution payloads, with pwntools automation and blind exploitation techniques for hardened targets.
How can I exploit printf format string vulnerabilities?
format-string-exploitation teaches exploitation by first mapping the stack layout to find target addresses, then using format specifiers like %p to leak memory contents and %n to write arbitrary values. You'll learn to craft payloads that overwrite function pointers, GOT entries, or __malloc_hook, and automate the process with pwntools fmtstr_payload to handle offset calculation and payload generation.
Can format-string-exploitation help me leak canary and ASLR addresses?
Yes. format-string-exploitation demonstrates memory leak techniques using %p to read stack values, identifying canary positions and leaked libc pointers to calculate ASLR offsets and PIE base addresses. These leaks defeat protections and enable reliable code execution by revealing runtime memory layout before launching the write phase of the exploit.
What are %n arbitrary write exploit techniques covered here?
format-string-exploitation details %n (4-byte write), %hn (2-byte write), and %hhn (1-byte write) variants for precise memory modification. You'll learn to chain writes across multiple format string invocations, use short-write techniques to minimize payload size, and leverage pwntools to automate offset discovery and payload construction for reliable arbitrary writes.
Does this skill cover format string GOT overwrite methods?
Yes. format-string-exploitation teaches GOT overwrite attacks by leaking libc addresses to calculate function offsets, then using %n writes to redirect function pointers to system() or gadget chains. The skill includes both direct overwrites and multi-stage attacks that bypass mitigations like FORTIFY_SOURCE and partial RELRO.
How does format-string-exploitation handle blind format string exploitation?
format-string-exploitation covers blind exploitation where you cannot observe output: using out-of-band channels (DNS, HTTP), timing side-channels, or crash-based inference to confirm writes. Techniques include writing to predictable memory locations, leveraging error messages, and using pwntools to automate payload generation when direct feedback is unavailable.
SKILL.md
rendered from the published skill — quoted content, verbatim
SKILL: Format String Exploitation — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert format string techniques. Covers stack reading, arbitrary write via %n, GOT overwrite, __malloc_hook overwrite, pointer chain exploitation, blind format string, FORTIFY_SOURCE bypass, 64-bit null byte handling, and pwntools automation. Distilled from ctf-wiki fmtstr, CTF patterns, and real-world scenarios. Base models often miscalculate positional parameter offsets or forget 64-bit address placement after format string.
0. RELATED ROUTING
- stack-overflow-and-rop — combine format string leak with stack overflow for full exploit
- binary-protection-bypass — format string is the primary canary/PIE/ASLR leak method
- arbitrary-write-to-rce — convert format string write primitive
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
skills/format-string-exploitation/SKILL.md