2 byte format string attacks

Question

Protostar

I was doing the protostar format string (3rd challenge). where we have to change the value of a variable target with format string buffer overflow. so, I came up to this medium article: HERE

So, he has described three types of attacks. the second and third ones seem hard to understand.

2 byte

I want to know that he has divided the target value (0x00000000) into 2 bytes (0000) in the second method. it means that we are splitting the values into two bytes. am I right? and if I am right what is the thing he did for getting the second address of the target(0x80496f6). how could he possibly get that from the real address (0x80496f4)? all I can understand is he might have subtracted 0x2 from the real address(0x80496f4). Does the value of the target stores into two addresses? His command is :

python -c 'print "\xf4\x96\x04\x08" + "\xf6\x96\x04\x08" + "%13$hn" + "%12$hn"'

Answer 1

The second and third methods are simply variants of the first method, using different write sizes.

The %n format specifier writes 4 bytes to the destination address. There are times where you may not want to write this many bytes as once; maybe you only want to partially overwrite a value, or more importantly, it may be too slow this way. Let's say you wanted to write the value 0xdeadbeef; in this particular case, the program has to print out 3,735,928,559 characters, which can take a while to write. It is often quicker to do several smaller writes instead of one huge write. So, the specifier can be used with a length modifier to change the number of bytes written. %hn is 2 bytes, and %hhn is one byte.

So, you can break the problem into two chunks. Let's use the address from your example, 0x80496f4, as the target where we want to write. The first 2 bytes (little endian, 0xefbe) can be written at 0x80496f4 with an %hn. Since we're going 2 bytes at a time, the next write needs to be at 0x80496f4+2, which is where 0x80496f6 comes from. Here, the next two bytes can be written with %hn, 0xadde.

Or, you can do it in 4 chunks by doing single-byte writes.