So I have this vulnerable piece of code in which I'm trying to exploit to print out Come on in.. Below is the code mentioned.
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
int user_age;
void secretClub(){
if(user_age<18){
printf("Come back when your old enough!!");
}
else{
printf("Come on in.");
}
}
int main(){
char name[30];
user_age = 17;
gets(name);
printf("Hello there ");
printf(name);
}
Now, I'm aware that since the function secretClub is never called, I would need to overflow the buffer name in so that the return address points at the address for secretClub. I'm also aware that there exists a format string vulnerability in printf in main that could be exploited to change the variable user_age.
I'm struggling to see how you would piece this all together. Is it possible that the use of a format string attack is actually redundant here and you could just redirect with a buffer overflow so that it prints out "Come on in."?
I'm new to this and still learning, I'd really appreciate any form of guidance. Thank you!