Exploit › Module 2 › Lesson 3
Format String Named
Format string bugs misuse printf-family format specifiers — name the class on $PWN_LAB; defenders use constant format strings and -Wformat.
Visual · pwn_format_string_named
Format string class literacy. $PWN_LAB only. Original Cyberlium.
Opening
When user input becomes the format string, the program trusts attacker-controlled directives — a named class, not a stack-reading tutorial.
printf(user_input) is unsafe: specifiers like %x and %n interpret stack or memory contents. Legitimate code uses printf("%s", user_input) — format string is constant. Impact ranges from info leak to memory writes depending on platform and mitigations — defenders prevent the bug at source. Cyberlium names format-string misuse on YOUR toy C at $PWN_LAB — observe crash or sanitizer report, not %n write recipes. Next: Classes Lab.
1. Constant format vs attacker-controlled format
Safe: printf("%s ", name). Unsafe: printf(name) when name is user-controlled. Same rule applies to sprintf, fprintf, syslog with variable format.
On $PWN_LAB, compile a toy that passes argv[1] directly to printf — note warning or sanitizer finding; do not craft arbitrary write chains.
Command guide
Try these commands — Constant format vs attacker-controlled format
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CWE-134 — https://cwe.mitre.org/data/definitions/134.html (format string vulnerability) CWE-120 — https://cwe.mitre.org/data/definitions/120.html (related memory corruption) LiveOverflow — https://www.youtube.com/c/LiveOverflow (format string concept videos)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install build-essential sudo apt install curl
macOS:
Command — copy this
xcode-select --install # or brew install gcc
Windows: Use WSL or MinGW Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
cat > "$LAB_PWN/src/fmt_vuln.c" <<'EOF'
#include <stdio.h>
int main(void) {
char buf[64];
puts("Format-string literacy toy — never pass user buf as format");
if (!fgets(buf, sizeof(buf), stdin)) return 1;
buf[strcspn(buf, "
")] = 0;
printf(buf); /* BUG: user-controlled format — literacy only */
putchar('
');
return 0;
}
EOFCommand — copy this
cat > "$LAB_PWN/src/fmt_safe.c" <<'EOF'
#include <stdio.h>
int main(void) {
char buf[64];
if (!fgets(buf, sizeof(buf), stdin)) return 1;
buf[strcspn(buf, "
")] = 0;
printf("%s
", buf); /* SAFE: fixed format string */
return 0;
}
EOFCommand — copy this
gcc -Wall -O0 -g -o "$LAB_PWN/bin/fmt_vuln" "$LAB_PWN/src/fmt_vuln.c" gcc -Wall -O0 -g -o "$LAB_PWN/bin/fmt_safe" "$LAB_PWN/src/fmt_safe.c" curl -sS https://cwe.mitre.org/data/definitions/134.html | head -8
Primary tools to practice this lesson: gcc, curl. Reference sites: CWE-134 (https://cwe.mitre.org/data/definitions/134.html); CWE-120 (https://cwe.mitre.org/data/definitions/120.html); LiveOverflow (https://www.youtube.com/c/LiveOverflow). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why the class matters to defenders
Info leaks aid further attacks in adversary models — your job is to eliminate the bug class in code you ship. Compiler -Wformat and -Wformat-security flag many mistakes.
Static analysis and code review check for non-literal format strings in privileged code paths.
3. Mitigations and secure habits
Always pass user data as variadic arguments, never as the format. Prefer C++ iostreams or rust fmt for new code. FORTIFY and modern libc reduce some impact — still fix the call site.
Ship: format-string card — safe vs unsafe call pattern, one compiler flag, one $PWN_LAB finding. Next: Classes Lab.
4. What you ship: format string class card for $PWN_LAB
Safe vs unsafe printf pattern. -Wformat note. Toy finding — no %n exploit steps. chmod 600.
5. What you record before the next lesson
Date. Format string card. $PWN_LAB named. File t24-m02-l03-format-string-named.txt chmod 600.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Tutorial on %n arbitrary write. Run format bug against production logging.
Right
Write format string class card from YOUR toy. Next: Classes Lab.
Mission: name format string bug class
1) Write safe vs unsafe printf example in comments. 2) Name -Wformat-security purpose. 3) Quote one sanitizer or warning line from toy. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Fixing printf(user) to printf("%s", user) is real security work.
Knowledge Check
APPLY: Format string literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: printf(user_input) is unsafe when user_input is untrusted.
True or False
Knowledge Check
APPLY: Safer pattern is:
Multiple choice