Class 06 · KP 18 / 18

Tie-in to Lab 3

Lab 3 gives you a small binary with a printf(buf) bug in an isolated CTF container.
Milestones:
Find your format-string offset with a %N$p probe.
Use %s to leak an address (canary or libc/PIE base).
Use fmtstr_payload to overwrite a GOT entry (or saved RIP) and redirect execution to win().
Do everything inside the provided lab VM only —- these techniques are for authorized, educational use.

Key Takeaway

Format string = read + write + repeatable. Leak to beat ASLR (Class 05), then %n to take control. The fix is one literal "%s".