How to exploit a C-style variadic function in C++? [closed] - c++

Question

Closed. This question needs details or clarity. It is not currently accepting answers.
Want to improve this question? Add details and clarify the problem by editing this post.
Closed 2 years ago.
Improve this question
I saw a conclusion that a C++ variadic function using C-style ellipsis can be vulnerable when an attacker designs some kind of input into the function to run arbitrary code. But how can it be done? I mean, how to design an attack vector to exploit the vulnerability?

Answer 1

If you mean a format string exploit to run arbitary code it works as such:
printf allows you to give a format string not matching the argument counts. In such a case variables are pulled off the stack. A function call (like printf) is done by putting all the function's arguments onto the stack, roughly like this:
(low addresses)
^^^^^^ stack growth direction ^^^^^^
---------printf-stack------------
printf function arguments
stack base pointer of caller
return address for when printf() ends
---------printf-stack------------ <-- stack base pointer register (cpu)
---------caller-stack------------
stack variables (int a = 5, char cstr[500] = "hello world!", etc)
caller function arguments
stack base pointer of caller-caller
return address for when caller() ends
---------caller-stack------------
(high addresses)
Reading out more arguments than were given will print the stack base pointer of the calling function, then the return address and eventually variables of the caller function.
To allow arbitrary code execution you need to overwrite the return address of any function. Unfortunately printf allows you to write a variable with %n (which, really is just a bad idea.). This will write the number of characters printed so far to the int pointer provided at the argument's position.
This doesn't seem useful at first, but the user could alter some stack variable to point to the return address on the stack. Then he could print an arbitrary number of characters and use &n to write that number of characters to that stack location (containing the return pointer for the function). The user can place his shellcode whereever and execute by returning into it.
A detailed video by LiveOverflow explaining all this can be found here.
I imagine similar behavior (writing to a pointer given as an argument) can be exploited in other variadic functions.