linux - 利用格式字符串漏洞/攻击是什么？我的猜测是 "printf(nameBuf); and that it should be "printf ("%s", nameBuf);

Question

// Lab 2 -- String Format Attack: reading other items on the stack!
#include <stdio.h>
int win(){
  puts("Good job! Now run './vulnProg' and get the real secret number and string! ");
}
int main (int argc, char** argv){
  //Here is out secret number.
  //The user will never know what it is without the source code! /s
  int secret = 1337;
  char *nameBuf = malloc(20);
  // Make sure this string prints before we accept user input
  puts("Input name: ");
  // Get a string of characters from the user.
  read(0, nameBuf, 20);
  printf("Hello, ");
  printf(nameBuf);    <-------
  puts("\nDid you get the secret number? What is it? ");
  int num = 0;
  scanf("%d", &num);
  if(num-secret == 0){
    win();
  }
  printf("\nExiting...\n");
  return 0;
}

利用格式字符串漏洞/攻击是什么？我的猜测是 "printf(nameBuf); 它应该是 "printf("%s", nameBuf);您能否解释一下攻击的原理？

Answer 1

my guess is "printf(nameBuf); and that it should be "printf("%s", nameBuf);

你的猜测是正确的。

Could you please explain how the attack works?

前提是程序编译e。 G。与 -O0 ， 我。 e.在某种程度上 secret没有优化堆栈，输入转换规范代替名称导致 printf()获取实际上没有给出的参数；取而代之的是获取并打印堆栈上存在的内容，其中可能是 secret数。

输入/输出示例，其中 secret是堆栈中的第六个下一项:

Input name:
<i>%d %d %d %d %d %d</i>
Hello, 149766152 20 -5603784 -144465003 -143142016 1337