OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: format-string exploit under Wndows?
From: Tomasz Grabowski (cadenceAPOLLO.ACI.COM.PL)
Date: Tue Jul 11 2000 - 10:52:33 CDT

Hello.

I wondering if there is possibility to exploit that "user-supplied format
string error" under Windows.

Let's look at the package "make" source code.

In file main.c in section #ifdef WINDOWS32 (about line number 500) we can
find the following:

 LPSTR cmdline = GetCommandLine();
 LPSTR prg = strtok(cmdline, " ");
 CHAR errmsg[1024];

[...]

sprintf(errmsg, _("%s: Interrupt/Exception caugh "), prg);

[...]

fprintf(stderr, errmsg);

First of all I'm not sure how exactly works that 'LPSTR', but I think
it can be an unlimited-lenght string.

Nice sprintf().
No matter...

The important for me is fprintf() without proper format string.
So is it possible to exploit that vulnerbility in fprintf() by putting
some evil code to 'prg' ? Assuming it is less than 1024 because of buffer
overflow in sprintf() :)

Someone has tried something like this with his own Windows?
Hints?

___
{Tomasz Grabowski} (cadenceaci.com.pl) [Akademickie Centrum Informatyki]