Arbitrary Read with {%s

}

%s treats the corresponding argument as a pointer and prints the

string it points to. If we control that argument, we control what gets read.

Goal: read the bytes at address 0x404060 (a GOT entry, say)

payload = p64(0x404060) + b"%7$s"
          ^ address sits at offset 7   ^ deref+print it

• The 8-byte address is placed into the buffer, which lands at argument slot 7 on the stack.
• %7$s tells printf: take slot 7 as a char* and print the string there —- leaking arbitrary memory.
• Beware embedded 00 bytes in the address vs. input functions that stop at NUL; positioning the address after the specifiers avoids truncating the format text.