title: Overwrite return address simple format string exploit
body: <p>Yes, quite a few similar questions exist already (5037601, 19166698, 4855162, 14505995, 5052648, 13409508, 7745146, 7459630; sorry, not enough rep for more than 2 links), and yes, there are some nice articles explaining this kind of thing (<a href="http://www.loko.nu/formatstring/format_string.htm" rel="noreferrer">click</a>, <a href="http://www.cis.syr.edu/~wedu/Teaching/cis643/LectureNotes_New/Format_String.pdf" rel="noreferrer">click</a>, http ://codearcana.com/posts/2013/05/02/introduction-to-format-string-exploits.html). I've read them and I think I get the general idea, but I still fail at succesfully exploiting the easiest training toy example that I could think of.</p>
  
  <pre class="lang-c prettyprint-override"><code>#include &lt;stdio.h&gt;
  
  void f(char* a)
  {
      printf("a: %p\n", &amp;a);
      printf(a);
      return;
  }
  
  void main(int argc, char** argv)
  {
      f(argv[1]); //please ignore the lack of any check
      return;
  }
  </code></pre>
  
  <p>Yes, the stack is executable and yes, memory layout randomisation is disabled. Each execution gives me the same address of <code>a</code>. I can feed it for instance <code>$ ruby -e 'print "AAAA"+("%08x."*16)'</code>, and that results in:</p>
  
  <pre class="lang-none prettyprint-override"><code>a: 0xbfffece0
  AAAAbfffece0.bfffecf0.b7fd7ff4.00000000.00000000.bffffcf8.080484b0.bfffecf0.00000fff.b7fd8420.00000000.41414141.78383025.3830252e.30252e78.252e7838.
  </code></pre>
  
  <p>So now I can see where my input ends up in memory. I can write a value to the stack with <code>$ ruby -e 'print "12345%n"+("%08x."*16)'</code>, which results in this:</p>
  
  <pre><code>a: 0xbfffece0
  12345bfffecf0.b7fd7ff4.00000000.00000000.bffffcf8.080484b0.00000005.00000fff.b7fd8420.00000000.34333231.256e2535.2e783830.78383025.3830252e.30252e78.
  </code></pre>
  
  <p>Obviously, my ultimate goal would presumably be something like <code>&lt;something&gt;&lt;NOPs&gt;&lt;shellcode&gt;</code>, where <code>&lt;something&gt;</code> overwrites the return address of <code>f</code> so that the program will jump into the NOP sled and execute the shellcode. But the address of the saved return address seems to depend on my input now, right? Something similar to <code>0xbfffece0 - len(input) - 12</code>, assuming a 12-byte prologue? Perhaps this example is not the easiest after all...</p>
  
  <p>I'm getting confused. Any ideas?</p>