// Classic Vulnerable C Code
#include <stdio.h>

void vulnerable(char *input) {
    printf(input); // Uh oh! User input is the format string.
}

// Blind Vulnerable C Code
#include <stdio.h>

void blind_vulnerable(char *input) {
    char log_buffer[256];
    sprintf(log_buffer, input); // Vulnerability is here!
    // The log_buffer is then written to a file, a database, or just forgotten.
    // The user never sees the output of sprintf.
}

We can turn this write primitive into a read primitive using a side channel. The most common one is a crash/no-crash oracle. The logic is simple:

"If the byte I want to leak has value X, then crash the program. Otherwise, do nothing."

By iterating through all possible values for X (0-255), we can pinpoint the exact value of the byte. When the program doesn't crash, we've found our character! The trick is crafting a payload that uses %n to cause a conditional crash.

Crafting the Payload: A Step-by-Step Guide

Building the payload is a multi-stage process. Let's assume our goal is to leak a secret byte-by-byte using a crash oracle.

Step 1: Find the Offset

First, we need to find out where our input is on the stack relative to the format string function's arguments. You can do this by sending a unique pattern and seeing which part you can control. A payload like AAAA.%p.%p.%p.%p... is standard. If you can't see the output, you can try to cause a crash. Sending %7$s tells printf to treat the 7th argument as a string pointer. If you send AAAA.%7$s and the program crashes trying to read from address 0x41414141, you've found your offset! The 7th argument points to your input.

Step 2: Control the Write Address (The 'Where')

With our offset, we can use %n to write to an address we control. For example, the payload [ADDRESS_TO_WRITE_TO]%100c%7$n would:

1. Place ADDRESS_TO_WRITE_TO on the stack.
2. Print 100 padding characters.
3. Use %7$n to take the 7th argument (which now points to ADDRESS_TO_WRITE_TO) and write the value 104 (4 bytes for the address + 100 for padding) into it.

Step 3: Build the Conditional Crash

This is the clever part. We can't directly compare a byte in memory. Instead, we can use the format string's processing to do it for us. We'll use a specifier like %hhn (writes a single byte) or %hn (writes two bytes) for more precision.

Imagine we want to check if the byte at SECRET_ADDRESS is the character 'A' (ASCII 65). We can construct a payload that prints exactly 65 characters and then uses a specifier that references the secret byte itself.

This gets complex quickly. A simpler, more universal method is to leak one bit at a time. We use our write primitive (%n) to overwrite a pointer that the program will use later, like a function pointer in the Global Offset Table (GOT). We can overwrite the least significant byte of this pointer. If the bit we're leaking is 1, we overwrite it to point to a valid instruction. If the bit is 0, we overwrite it to point to an invalid address (like 0x00), causing a crash.

Here's a comparison of payloads for a hypothetical scenario where we test a byte value. Let's say we have control of the 8th parameter and want to test if the byte at an address we can leak (the 10th parameter) is 65.

Condition to Test	Conceptual Payload Logic	Expected Outcome
Is `leaked_byte` == 65?	%[leaked_byte]c%[padding]c%8$n	If `leaked_byte` is 65, the total characters printed before %n will match a target value. We use this to write a 'good' value to a critical pointer.
Is `leaked_byte` != 65?	%[leaked_byte]c%[padding]c%8$n	If `leaked_byte` is not 65, the character count is different, and our %n write will corrupt a critical pointer with a 'bad' value, causing a crash.

Note: This is a simplified model. Real-world exploits often involve more intricate pointer manipulation.

Putting It All Together: A Practical Example

Let's walk through a scenario:

1. Target: A web service with a "Set Nickname" function that logs the name but never shows it.
2. Goal: Leak the `SECRET_KEY` variable from the program's memory.
3. Discovery: We input %s%s%s as our nickname and the server's worker process dies. We have a crash oracle!
4. Find Offset: After trying AAAA%7$s, the process crashes trying to read from 0x41414141. Our offset is 7.
5. Find Leak Address: We need to find the address of `SECRET_KEY`. This often requires another info leak to defeat ASLR, perhaps by first using the blind format string bug to leak a pointer from the stack or GOT, and then calculating the base address of the binary.
6. Exfiltration Loop: Now we script it. For each byte of the secret:
   • Iterate through all possible characters (e.g., 'a' through 'z', '0' through '9').
   • For each character, craft a payload that will not crash only if the byte in memory matches our guess.
   • Send the payload. If the server responds (doesn't crash), we've found the correct character for that position! Record it, and move to the next byte.

Automation is Your Friend: Scripting the Leak

Manually testing 256 possibilities for each byte is impossible. Automation is key. Here's a Python-esque pseudocode of what this script looks like:

import requests

SECRET_ADDRESS = 0x0804a080 # Address we want to leak
leaked_data = ""

def does_it_crash(payload):
    try:
        requests.post("http://target.com/set_nickname", data={"nick": payload}, timeout=2)
        return False # It responded, no crash
    except requests.exceptions.Timeout:
        return True # It timed out, likely crashed and restarted

# Loop for each byte of the secret we want to leak
for i in range(32): # Assuming a 32-byte secret
    current_address = SECRET_ADDRESS + i
    # Loop through all printable characters
    for char_code in range(32, 127):
        # This function creates the complex payload to test for a specific character
        # It's designed to NOT crash if the byte at current_address == char_code
        payload = create_conditional_payload(current_address, char_code)

        if not does_it_crash(payload):
            leaked_char = chr(char_code)
            leaked_data += leaked_char
            print(f"Found byte {i}: {leaked_char}")
            # We found the byte, break inner loop and move to the next byte
            break

print(f"\nLeaked Secret: {leaked_data}")

Mitigation: How Developers Can Prevent This

Preventing format string bugs is one of the simpler tasks in secure coding.

• Never use user input as the format string. This is the golden rule. Instead of printf(input), always do printf("%s", input). The function will then treat the input as a simple string to be printed, not a list of commands.
• Enable Compiler Warnings: Modern compilers like GCC and Clang have powerful security flags. Using -Wformat -Wformat-security will generate a warning or error whenever it detects a potential format string misuse. Integrate these flags into your CI/CD pipeline.
• Use Modern Tools: Many modern languages and frameworks (like Python, Rust, Go) don't have this type of vulnerability by design, as they don't expose low-level memory formatting functions in the same way as C/C++.

Conclusion: The Art of Patient Pwning

Blind format string vulnerabilities are a beautiful example of how a seemingly useless bug can be transformed into a full-blown information disclosure vulnerability. They force you to think outside the box, turning crashes, timing delays, or other state changes into a binary oracle. While they require more setup and patience than their classic counterparts, the underlying logic is a masterclass in exploit development: find a primitive, build a tool, and patiently extract the secrets hidden in plain sight.

The next time an input field gives you the silent treatment, don't walk away. It might just be waiting for the right question.