flags/format.c


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

void hax(char *shellcode) {
	int stack;
	printf(shellcode, &stack);
}

int main(int argc, char **argv) {
	char *buf, *p;
	int i;

	if(argc != 2) {
		printf("What? Are you chicken?\n");
		return -1;
	}
	// remove %n from format string, we're not *that* stupid
	buf = strdup(argv[1]);
	for(p = argv[1], i = 0; p[0]; ++p) {
		if(p[0] == '%' && p[1] == 'n') {
			++p;
			if(p[0]) {
				continue;
			} else {
				break;
			}
		}
		buf[i++] = p[0];
	}
	buf[i] = '\0';
	hax(buf);
	free(buf);
	putchar('\n');
	return 0;
}