GCIH: GIAC Certified Incident HandlerDemo

Question

You came across the following code snippet while investigating an incident involving a business-critical system. The code crashed immediately after a user supplied the following input:

%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s

#include &lt;stdio.h&gt;  
#include &lt;conio.h&gt;  
#include &lt;string.h&gt;  
#include &lt;stdlib.h&gt;  
void main()  
\{  
char a[200];  
scanf(`%s`, a);  
printf(a);  
\}

What caused the crash?

A This is a buffer overflow attack that is caused by the stack address space being pushed to printf()
B This is a format-string attack that could have referenced a reserved address space or the memory pointed by that number might not exist
C The crash could have been due to mismatch in the address space that is being referenced in the code

Explanation

Passing untrusted data directly as the first argument to printf makes that data a format string. Repeated %s specifiers make printf read nonexistent variadic arguments as pointer values and dereference them as strings; an invalid or inaccessible address can therefore trigger a crash.

GCIH: GIAC Certified Incident HandlerDemo

AstroTutor

Notes

Readiness

QuestionQ716

Community Discussion