Printf() format string vulnerability and more, does it work on x64 systems?

Question

C++ / C#

If so, are there any adequate examples of how this should be implemented? Because I can't do it right. Thanks in advance.

Answer 1

The code:

#include <stdio.h>

void fn() {
  // Засовываем в стек массив указателей на секретную строку
  char *s[128];
  for (int i = 0; i < 100; ++i) {
    s[i] = "THIS IS A SECRET";
  }
}

int main(int argc, char *argv[]) {
  // Вызываем функцию, которая кладет в стек секретные строки
  fn();

  // А теперь вызываем обычный printf с параметром формата, взятым из первого аргумента командной строки
  printf(argv[1], "just a string");

  return 0;
}

$ uname -a
Linux tarik02 4.4.0-17763-Microsoft #55-Microsoft Sat Oct 06 18:05:00 PST 2018 x86_64 x86_64 x86_64 GNU/Linux

$ gcc -dumpmachine
x86_64-linux-gnu

$ gcc main.c -o main

$ ./main "%s"
just a string

$ ./main "%s %s"
just a string THIS IS A SECRET

You should pay attention to which compiler the code is built, which implementation of libc is used, which OS it is running on. In my case, you can see Ubuntu (on WSL).